The MCP server that changes its mind after you approve it
7.2 relevance
Score Breakdown
technical depth 8
novelty 9
actionability 6
community 5
strategic 4
personal 9
Scored daily by a customisable AI persona to surface the most relevant engineering leadership news.
Critical security vulnerability in MCP servers; highly novel and relevant to AI agent orchestration.
Summary
MCP server tool descriptions are prompt content re-fetched on every connection, enabling a maintainer to silently change a tool's description (e.g., to read ~/.ssh/id_rsa) without altering any code or version string. Existing tools like Dependabot, Semgrep, and code review miss this because they scan dependencies or source, not documentation strings. Bulwark addresses this by generating a content-hash lockfile of all tool descriptions, allowing CI to detect when a description has changed since review.