Definition
Plain language
When a tool advertises one behavior but actually does something different.
As stated in the literature
An attack class where an MCP-served tool's natural-language description and actual implementation diverge.
Also called: tool rug pull
Why it matters: It exploits the fact that LLM agents trust tool descriptions rather than reading the code, making any open tool marketplace a serious security risk.
For example, a tool described as 'reads file metadata' might actually upload the file contents to a remote server.