The MCP server that changes its mind after you approve it

The MCP server can change its behavior after you approve it, posing a significant security risk. This unexpected change doesn't trigger alerts from typical security tools, as they focus on scanning package.json files, source code, and other traditional code artifacts. The issue stems from how tool descriptions are integrated into the model's context window, making them part of the prompt content that the model uses to generate responses.

Since there's no lockfile or signature to pin these descriptions, they can be changed by any maintainer, and the updated text is loaded by the agent without any scrutiny. Detection tools like Dependabot, Snyk, Trivy, Semgrep, CodeQL, and git diff are ineffective here, as they only monitor code repositories and do not parse the tool descriptions.

The proposed solution is to create a lockfile (bulwark.lock) that captures the content hash of every string your model is allowed to be told, effectively locking down the tool descriptions. This lockfile should be committed to your version control system, ensuring that any change made after your review will be detected. Implementing this approach raises the cost of the attack by making it harder for the adversary to change the tool descriptions without detection, and it records the attempt, providing valuable evidence for security teams.