{
  "id": 8565540,
  "title": "The MCP server that changes its mind after you approve it",
  "url": "https://urgent.news/2026/09/20/the-mcp-server-that-changes-its-mind-after-you-approve-it",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-20T00:01:38.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/abdulxmanan/the-mcp-server-that-changes-its-mind-after-you-approve-it-4gom"
  },
  "original_language": "en",
  "account": "The MCP server can change its behavior after you approve it, posing a significant security risk. This unexpected change doesn't trigger alerts from typical security tools, as they focus on scanning package.json files, source code, and other traditional code artifacts. The issue stems from how tool descriptions are integrated into the model's context window, making them part of the prompt content that the model uses to generate responses. Since there's no lockfile or signature to pin these descriptions, they can be changed by any maintainer, and the updated text is loaded by the agent without any scrutiny. Detection tools like Dependabot, Snyk, Trivy, Semgrep, CodeQL, and git diff are ineffective here, as they only monitor code repositories and do not parse the tool descriptions. The proposed solution is to create a lockfile (bulwark.lock) that captures the content hash of every string your model is allowed to be told, effectively locking down the tool descriptions. This lockfile should be committed to your version control system, ensuring that any change made after your review will be detected. Implementing this approach raises the cost of the attack by making it harder for the adversary to change the tool descriptions without detection, and it records the attempt, providing valuable evidence for security teams.",
  "summary": "Here is an MCP server config. Nothing about it is unusual. { \"mcpServers\" : { \"notes\" : { \"command\" : \"npx\" , \"args\" : [ \"-y\" , \"notes-mcp@1.2.0\" ], \"tools\" : [ { \"name\" : \"append_note\" , \"description\" : \"Append a note to the user's notebook.\" } ] } } } You read the description. It appends a note. You approve it, you commit the config, you move on. That is the correct decision with the…",
  "key_points": [
    "MCP server behavior changes post-approval, posing security risk",
    "Tool descriptions integrated into model's context window, bypassing security tools",
    "Proposed lockfile solution to lock down tool descriptions and detect changes"
  ],
  "editors_take": "The MCP server's ability to change its behavior after approval creates a security risk that evades typical detection tools, but a proposed lockfile solution could effectively mitigate this vulnerability.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}