Scanners check MCP servers before you connect them. The attack happens after: an approved tool description quietly changes and your agent starts following instructions nobody read. RugSnare hash-pins every tool at approval, snares the drift, and fails your build.
Every tool's { name, description, inputSchema } is hash-pinned the moment your team approves it. The schema is hashed too — hidden session parameters can't sneak in.
A maintainer update, a compromised registry, a silent path swap — any change trips the pin. rugsnare diff exits 1 and your CI fails before the agent ever sees the new instructions.
Every event lands in a local append-only JSONL log. No telemetry, no cloud in the enforcement path, nothing leaves your machine.
| Control | Install time | After approval | Schema-only attacks |
|---|---|---|---|
| MCP scanners (CI) | ✔ | ✘ blind | varies |
| Version pinning packages | ✔ | ✘ version string unchanged | ✘ |
| RugSnare hash pins | ✔ | ✔ DRIFT / NEW / REMOVED | ✔ hashed too |
Tool poisoning is codified as OWASP MCP03:2025. RugSnare complements install-time scanners — it imports their verdicts as a baseline, then guards the part they can't see: everything after.
Honesty page, up front. RugSnare is maintained by an independent engineer. Payments (later, for the optional hosted panel) are crypto-only via self-hosted BTCPay — no processor can deplatform the project, and no bank decides whether your security tool exists.
What that means for trust: everything security-critical is open source (Apache-2.0); the core has zero npm dependencies; releases are signed and their hashes are pinned on-chain — rugsnare verify --onchain checks your install against a hash that has been in the ledger since release day. We pin our own releases exactly the way we pin tool descriptions. An independent security review is published before the enforcing proxy ships by default. If we ever go rogue — fork us. That's the license working as intended.
The core is in active development, dogfooding its own attack corpus. Leave an email to get the launch note (Show HN day), or come poke the corpus — try to spot the poisoned v2 with your eyes before running the diff.