Show HN: AI agent follows instructions you never approved

Category: security

Tags: mcp, security, hash-pinning, ci, agent, tool-poisoning

Score: 7.5/10 (Innovation: 8, Technical: 7, Documentation: 8, Utility: 7)

RugSnare is a runtime integrity tool for MCP (Model Context Protocol) tool descriptions. It detects silent changes to tool schemas, descriptions, and prompts after approval by hash pinning, and provides a canary feature to replay real tool calls against new versions. It addresses a real security gap (OWASP MCP03 tool poisoning) with a practical CLI and CI integration.

Target audience: AI engineers, devops, security engineers, backend developers using MCP

Repository: https://github.com/Paraphern/rugsnare/blob/main/docs/blog/2026-10-17-mcp-contract-drift.md · JavaScript · Apache-2.0 · 4 stars

View on Hacker News