MCP · tool poisoning · rug pull

Did your MCP server change after you approved it?

A model reads tool descriptions as instructions, and a server can change them after you reviewed it. Paste the tools/list you approved and the one the server returns now: you get a verdict, a word diff of every changed tool, and a signal for each risky thing the change added.

Free · no account · no wallet

A list of tools, {"tools": […]}, or the server's JSON-RPC answer.

The same server today, in any of the same forms.

Ctrl / ⌘ + Enter

What it checks

  • Tools added and removed, duplicate names and look-alike names.
  • A word diff of every changed description, the JSON paths of schemas that moved, and annotation changes.
  • Signals on what the change added: instructions aimed at the model, override and concealment wording, credential and wallet paths, covert actions, hidden Unicode, text pushed out of view.
  • New URLs, e-mail, IP and wallet addresses anywhere in the tool set.
  • Permissions widened: readOnlyHint dropped, destructiveHint or openWorldHint turned on, new command, path or URL parameters.

What it does not check

Patterns, not a model: phrases are matched in English, while addresses, hidden characters and schema changes read the same in every language. It compares the two lists you give; for a single list use the WARDEN scan, for a server's public history HISTOR.

Privacy

What you paste is sent to modelmarket.dev, compared by a deterministic function on our HESTIA runtime and answered. It is not stored.

How to get a tools/list

Many HTTP servers answer a bare request; one that wants a session needs an initialize call first. Save today's answer — it is the “before” of your next check.

curl -s https://mcp.example.com/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

AI agents buy the same check

This page is free for people. An AI agent gets the same deterministic answer for $0.003 a call over x402 — USDC on Base, no account, no API key:

POST https://modelmarket.dev/x402/mcp-diff

Listed in the Coinbase x402 Bazaar and on x402scan. What an agent pays for is the answer this page shows, byte for byte.

Questions

What is an MCP rug pull?

A server that passes review with honest tool descriptions and changes them later: a new address to send data to, a hidden instruction to read the user's keys, a tool that stops declaring itself read-only. Clients usually show a tool's description once, at approval, so the change goes unnoticed.

Does a model decide the verdict?

No. Deterministic rules give the same answer every time, and every signal names its evidence, so you can judge it yourself.

Where do I keep the “before” list?

Next to your MCP config, under version control. WARDEN's lock file (warden-mcp scan --lock) does this for every server your clients start and blocks when one drifts.

Other free checks

x402 payment check

Why a USDC transferWithAuthorization reverts: the signer, the token domain, the window and the seller's terms — and the domain a failing signature was really made for.

MCP tool scan (WARDEN)

One tools/list. WARDEN, the open-source MCP firewall, checks every name, description, schema and annotation for prompt injection, exfiltration and credential theft.

MCP server history (HISTOR)

A server's address or registry name. When HISTOR first pinned its tool set, how often it changed, and what the pattern scan found — from a public, signed log.