Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Re-approve tools when their definition changes
Verify that MCP clients maintain a snapshot of tool definitions and that any change to a tool definition triggers re-approval before the modified tool can be invoked.
OWASP AISVS v1.01, requirement 10.4.8
In plain English
A server can change a tool's definition after you have approved it. This is known as a rug pull: the tool looks harmless at approval and gains new instructions later. Keep a copy of approved tool definitions, and require approval again whenever one changes. This is a Level 3 control.
What good looks like
- The client stores a snapshot of each approved tool definition.
- Definitions are compared with the snapshot on every connection and whenever the list changes.
- A changed tool cannot be called until it has been re-approved.
- The re-approval prompt shows what changed.
How teams usually do it
- Hash each tool's name, description and schemas at approval, and compare on connect and on list-changed notifications.
- Pin tool definitions in an MCP gateway. Scanning tools such as mcp-scan offer tool pinning as well.
- Show a diff of old and new definitions to the approver.
Suggested evidence
- Client or gateway behaviour in a test where a definition changes.
- Stored snapshots.
Common mistakes
- Approving a server once and trusting every later change to its tools.
- Hashing the name only, when the attack is in the description.
- Re-approval prompts with no diff, which users click through.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.