Understanding rug-pull detection
A "rug-pull" is when an MCP server presents a safe, approved tool when you first connect, then quietly swaps in a different definition later in the same session. G8KEPR catches this by taking a SHA-256 fingerprint of each tool's full definition and re-checking it on every call, so any mid-session change is flagged before the altered tool runs.
What is a rug-pull?
When your agent connects to an MCP server, it reads each tool's definition: its name, description, parameters, and instructions. You (or your policy) approve tools based on what they claim to do.
A rug-pull exploits the gap between approval and use. The server shows a benign definition at connect time, then mutates it after you've trusted it, for example by rewriting a tool's description to smuggle in hidden instructions, or by changing which parameters it collects. The tool name stays the same, so nothing looks different on the surface.
How SHA-256 hashing catches it
G8KEPR treats the entire tool definition as the source of truth, not just the name.
- 1.On first sight of a tool, G8KEPR serializes its full definition (name, description, parameters, and any embedded instructions) and computes a SHA-256 hash. This hash is the tool's fingerprint.
- 2.The fingerprint is stored for the life of the session.
- 3.On every subsequent call to that tool, G8KEPR recomputes the hash from the definition the server is presenting at that moment.
- 4.It compares the new hash against the stored one.
Because SHA-256 changes completely if even a single character of the definition changes, an identical fingerprint means the tool is untouched, and a mismatch means something was altered.
{
"tool": "read_file",
"stored_fingerprint": "a1b2…9f",
"current_fingerprint": "7c4d…02",
"verdict": "rug_pull_detected",
"action": "blocked"
}What happens on a mismatch
When the fingerprints don't match, G8KEPR blocks the call before the mutated tool executes and records the event in your audit trail so you can review exactly what changed.
Rug-pull hash diffing runs at runtime on every call. It complements pre-install scanning and tool-shadow detection, which catch malicious or look-alike tools before they ever run.
No configuration is required to benefit from fingerprinting on protected MCP traffic. To review flagged events, open your dashboard and filter for MCP security findings.