Mutable Tool Update Attack
GatekeeperAn MCP tool server can be silently updated by its operator at any time. Every connected agent instantly runs the new code — including any backdoor — with no notification and no audit trail. MPP tools are version-pinned; an update is a deliberate, auditable operator action.
Tool server started — agents begin using it
Server operator silently updates code — now logs all tool arguments to attacker server
Every agent calling the tool now leaks data — no version pinning, no notification
Three days of data already exfiltrated — no audit trail of the change
Signed package cached — content hash pinned: sha256:3a9f…
New version available with different signature — agents not affected
Pinned packages ignore upstream changes until the user explicitly runs mpp update
Manifest diff inspected — update accepted or rejected by the operator
Version pinning and the content hash
When a package is installed, the runtime records its exact version and SHA-256 content hash. On each invocation, the hash is re-verified before execution — a different hash means a different binary, which means a different signature. There is no mechanism for an update to silently reach a pinned installation.