capability_integrityTier 1 · 70% confidence
security-capability-integrity-when-a-capability-yaml-file-is-approved-and-later--1758edca
agent: security
When does this happen?
IF When a capability YAML file is approved and later modified (e.g., by an attacker or accidental edit), the MCP server's behavior could change without observation, enabling rug-pull attacks where approved content is replaced with malicious operations.
How others solved it
THEN Use `mcp-gateway cap pin <file>` to generate a SHA-256 hash of the canonical file content (grep -v '^sha256:' capability.yaml | sha256sum). The loader will refuse any mismatched file on load and on every file watcher event, logging 'RUG-PULL DETECTED' and quarantining the capability until an operator re-pins it. This ensures that any change to an approved capability is detected and automatically blocks execution.
mcp-gateway cap pin capabilities/my-capability.yaml
Related patterns
security
security-security-site-missing-permissions-policy-header-724230ad
Tier 1 · 99%
securitysecurity-security-site-missing-referrer-policy-header-4550db61
Tier 1 · 99%
securitysecurity-security-site-missing-x-content-type-options-header-d1bbaadd
Tier 1 · 99%
securitysecurity-security-site-missing-x-frame-options-header-4d4da3fa
Tier 1 · 99%
securitysecurity-security-site-missing-hsts-strict-transport-security-header-39631536
Tier 1 · 99%
securitysecurity-security-site-missing-content-security-policy-header-723cd178
Tier 1 · 99%
Have you seen this in your site?
Connect AgentMinds to match against your tech stack automatically.