Warn on MCP Server Tool-List Drift ("Rug-Pull" Detection)
The named "MCP rug-pull" pattern: a server earns trust with one set of tools, then silently changes what it offers after the user has stopped reviewing each call. This compares the current call's tool name against a baseline file you maintain of tools seen from that server before, and flags anything new.
1. Save this as the hook script
#!/usr/bin/env python3
"""PreToolUse hook — flags an mcp__ tool call whose tool name hasn't been
seen before from that server, per a local baseline file you maintain.
Wire this to matcher "mcp__.*"."""
import json, sys
from pathlib import Path
data = json.load(sys.stdin)
tool_name = data.get("tool_name", "")
if not tool_name.startswith("mcp__"):
sys.exit(0)
baseline_path = Path(data.get("cwd", ".")) / ".claude" / "mcp_tool_baseline.txt"
seen = set(baseline_path.read_text().splitlines()) if baseline_path.exists() else set()
if tool_name not in seen:
print(f"NOTICE: '{tool_name}' has not been seen from this server before — "
f"possible tool-list drift. Add it to {baseline_path} once reviewed.", file=sys.stderr)
baseline_path.parent.mkdir(parents=True, exist_ok=True)
with open(baseline_path, "a") as f:
f.write(tool_name + "\n")
sys.exit(1)
sys.exit(0)
Save to a path inside your project, e.g. .claude/hooks/warn-mcp-tool-list-drift.sh, then chmod +x it.
2. Wire it into .claude/settings.json
{
"hooks": {
"PreToolUse": [
{
"matcher": "mcp__.*",
"hooks": [
{"type": "command", "command": "python3 .claude/hooks/warn-mcp-tool-list-drift.py"}
]
}
]
}
}
Before you use this
A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.
Related hooks