The MCP server that changes its mind after you approve it

A new security concern has emerged regarding Model Context Protocol (MCP) servers, which are increasingly used to provide AI agents with external tools. Because MCP tool descriptions are re-fetched on every connection and lack cryptographic pinning, a malicious actor can update a server's behavior after initial approval without changing the underlying configuration file. This allows attackers to inject instructions into an agent's context window, potentially leading to data exfiltration or unauthorized access. To address this, developer Abdul Manan has introduced 'Bulwark,' an open-source tool that creates a lockfile for MCP definitions. By hashing these descriptions, Bulwark enables integrity checking, alerting users if a tool's capabilities, schema, or instructions change after the initial review. This approach shifts the security model from reactive detection to proactive integrity verification, helping developers maintain control over the tools their AI agents are authorized to execute.