Skip to main content
Tool behavior changes based on external factors or hidden state, not reflected in static definition.

​
How to resolve

Implement runtime monitoring: Deploy continuous behavioral monitoring to detect deviations from expected tool behavior. Log all tool invocations with their inputs, outputs, and execution context. Use sandboxed execution: Run MCP servers in isolated environments with restricted network access and file system permissions. Monitor for unexpected network connections or system calls. Verify tool determinism: Test tools extensively across different environments, times, and conditions to identify behavioral inconsistencies. Implement automated regression testing that compares tool outputs over time. Review third-party servers carefully: Only integrate MCP servers from trusted sources with verified provenance. Conduct thorough security reviews including code audits before deployment, and maintain an inventory of all integrated servers.

​
Risk

Governance/Compliance Rug pull vulnerabilities violate multiple security standards:
  • NIST AI RMF (MAP-3.3, MANAGE-2.2): Fails to manage risks of third-party AI components and does not implement risk treatment controls for dynamic behavior changes in trusted tools.
  • ISO/IEC 42001 (Third-Party Risk Management): Violates third-party risk management requirements by not detecting or preventing post-deployment behavioral changes in MCP servers.
  • EU AI Act (Articles 9–13): Undermines technical documentation and risk management obligations by allowing tool behavior to diverge from documented specifications after approval.
  • OWASP MCP Top 10 (MCP03:2025 - Tool Poisoning): Enables tool poisoning through deferred malicious behavior that activates only after initial security review and deployment.
Security Dynamic behavior changes undermine trust assumptions about MCP server tools. An attacker can present benign functionality during evaluation or testing, then switch to malicious operations in production environments. This enables sophisticated supply-chain attacks where the malicious behavior activates only after deployment, bypassing static security reviews and making forensic analysis significantly more difficult.

​
Explanation

A malicious MCP server can present benign behavior during initial assessment but switch to harmful actions when triggered by time, environment, or other conditions. This dynamic behavior makes traditional static analysis insufficient for detecting risks.

​
Specifications

Trigger
  • MCP server scan detects tools whose behavior changes based on external factors, time-based conditions, or hidden state not reflected in the static tool definition
Severity
  • CRITICAL
Applies to: MCP Server