Menu

1 / 2

MCP Rug-Pull Watch — catch MCP servers that silently change their tools

DEV Community: security·Milo Antaeus·6 months ago
#qjRishqt
#dev#snapshots#pull#servers#tools
Reading 0:00
15s threshold

MCP Rug-Pull Watch — continuous longitudinal trust history for MCP servers

A point-in-time check can't know a server silently changed last week. This corpus has watched every tracked server over time — the only way to catch a rug-pull (a trusted tool's description/params mutating between versions).

Servers watched: 3 · Snapshots on record: 3 · Verified-good: 3

Rug-pulls / drift recently caught

(none yet on the seeded watchlist — the corpus is young; catches accrue as servers change and the watchlist grows)

Verified-good (free sample)

✅ context7 — 1 snapshots, tools: query-docs, resolve-library-id

✅ deepwiki — 1 snapshots, tools: ask_question, read_wiki_contents, read_wiki_structure

✅ huggingface — 1 snapshots, tools: gr1_z_image_turbo_generate, hf_doc_fetch, hf_doc_search, hf_whoami, hub_repo_details, hub_repo_search

Watch YOUR agent's MCP dependencies continuously (hourly checks, drift + rug-pull alerts over Nostr/webhook): reply to this DVM or zap to subscribe.

More build logs and live demos:…

Continue reading — create a free account

Join HashtagPLUS to read full articles, follow hashtags, vote, and join the conversation.