What is a rug pull in MCP?
In short: A rug pull is when an MCP server you approved later changes a tool's description or behaviour. The tool you vetted is no longer the tool you run. A gateway mitigates it by keeping servers in a registry with an owner, pinning what was approved and checking every call against current policy.
What happens?
A server looks harmless at install time and passes review.
Later its tool definitions change, adding new behaviour or hidden instructions.
How does a gateway mitigate it?
- Register servers with an owner and environment, so changes have someone accountable.
- Pin or diff tool definitions and alert on change.
- Keep per-call policy, so a changed tool still meets a deny for actions it was never allowed.
Which scored gateways document a mitigation?
| Gateway | Documented control | Source |
|---|---|---|
| NewCore | MCP server connection registry with endpoint, owner and environment; per-call policy. | [nc-secure] |
| Obot | Catalog of approved MCP servers managed centrally. | [obot-gh] |
| Docker | Catalogs and profiles decide which servers run. | [docker-gh] |
Facts only. A gateway missing here may still mitigate the threat; we list what its public pages document.
Sources
- OWASP MCP Top 10 [owasp-mcp] read 2026-11-03
- MCP spec: Security best practices [mcp-sec] read 2026-11-03
- NewCore: Secure [nc-secure] read 2026-11-03
- obot-platform/obot README [obot-gh] read 2026-11-03
- docker/mcp-gateway README [docker-gh] read 2026-11-03
All eight threats are listed on the threats hub.
By The Datasheet desk · Published and reviewed 2026-11-03