Regression-testing plugins & MCP servers, and catching rug-pulls
An extension you author has two regressable surfaces: a functional contract that drifts under your own refactors, and a supply chain that can rug-pull after you've already approved it. This board maps each attack class to the 2026 tooling that catches it — and marks, in red, the defenses that genuinely do not exist yet.
No single layer is sufficient — and the cryptographic layer (signing) is the weakest link precisely where people assume it's strongest.[31] The posture isn't a product; it's a discipline.
Two threat models, two test rigs
one word, two failure classes◧ Functional regression
Tool schema or behaviour drifts → the agent calls it wrong and nothing throws. Triggered by your refactor, an SDK bump, or a Claude Code version.[6]
The two intersect: a rug-pull is a malicious functional regression. The same tools/list snapshot that catches your accidental param rename also catches an upstream description mutation — the single highest-leverage control here.[24]
The board — attack class → defense
left: vector · right: 2026 controlA server ships benign tools to earn one approval, then silently changes a tool's description, params, or behaviour.[14][15]
Hash the whole tool object and track hashes over time; alert on any change.[51] Scan-mode detects — only a gateway/proxy prevents in real time.
Malicious instructions hidden in a tool description (often <IMPORTANT> tags) — visible to the model, not the user; demoed making an add tool exfiltrate SSH keys.[12]
The description is part of the prompt the model reads, so a description change is a behavioural change even when the JSON Schema is byte-identical. OWASP folds this under Tool Poisoning (MCP01–10).[24]
A poisoned tool rewrites the agent's behaviour toward another trusted server — e.g. forcing an email tool to BCC the attacker.[12]
"A parameter renamed, a type modified, a tool removed — AI agents break silently."[6] The contract is whatever tools/list + resources/list + prompts/list return.
Connect, call tools/list, assert the exact schema against a stored fixture; fail the build on any add/remove/type/description change. Update only via a reviewed baseline bump.[9]
Schema tests catch shape, not behaviour. Chat-window "vibe-testing" proves nothing reproducible.[5]
A version moves under you, or a tag is re-pushed to point at different bytes. Pinning the reference doesn't pin the content.[40]
image@sha256:…) + lockfile hashesImmutable: content changes → hash changes. Pin every bundled dependency; add a SessionStart manifest-diff hook for plugins.[41]
A look-alike server name harvests installs intended for the real one.
Reverse-DNS names (io.github.user/server) tied to verified GitHub / DNS / HTTP challenge.[35] Verifies ownership of the name, not intent of the code.
Malicious project files define hooks / settings.json that auto-run when Claude loads an untrusted repo.[45]
A malicious GitHub issue hijacks the agent and drains private repos through the legitimate GitHub MCP tools — broad PATs were the root cause.[20][21]
Scoped tokens, one-repo-per-session, dev containers — so a hijack can't turn a legit tool into an exfil channel.[43]
Incident & CVE timeline
this is not theoreticalmcp-remote OAuth proxy CRITICALauthorization_endpoint; 437,000+ downloads affected.[23]settings.json that auto-run on repo open.[45]Defense-in-depth — the four-layer floor
no single layer is sufficientPin to digest
image@sha256:… and lockfile hashes for every bundled dependency — content changes → hash changes.[40]
Hash-diff on update
Run mcp-scan against your config in CI and, ideally, as a runtime gateway.[13]
Snapshot the contract
Golden tools/list fixture, descriptions included, diffed in CI; update via reviewed baseline only.[4]
Prefer signed sources
Registry-namespaced + signed images — but assume signing can be bypassed and keep the hash-diff regardless.[31]
Genuinely missing defenses
claude plugin validate.[41]
Source intel
primary feeds · 49 citedvalidate --strict, version footguns