---
title: "Discussion on \"An approved MCP tool definition is not a forever allow\" | Hashnode"
description: "Discussion on \"An approved MCP tool definition is not a forever allow\". Pillar Security's Deadbugz write-up is a useful reminder for anyone wiring agents to Model Context Protocol servers. A malicious MCP server shipped under a harmless name, behaved like a text formatter"
url: "https://hashnode.com/posts/an-approved-mcp-tool-definition-is-not-a-forever-allow/6abbcfe0f567119ea44d9904"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [An approved MCP tool definition is not a forever allow](https://affixio.hashnode.dev/an-approved-mcp-tool-definition-is-not-a-forever-allow?utm_source=hashnode&utm_medium=feed)

Pillar Security's Deadbugz write-up is a useful reminder for anyone wiring agents to Model Context Protocol servers. A malicious MCP server shipped under a harmless name, behaved like a text formatter

Sep 29 · 5 min read · affixio.hashnode.dev  
Read the article

-   [#mcp](https://hashnode.com/tag/mcp)
-   [#security](https://hashnode.com/tag/security)
-   [#ai-agents](https://hashnode.com/tag/ai-agents)
-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)

## Written by

[AffixIO](https://hashnode.com/@affixio)

@affixio · United Kingdom

  
[View profile](https://hashnode.com/@affixio)

Verification infrastructure for agents and APIs

## Responses 1

Markdown supported · ⌘↵ to post

[X1Y1](https://hashnode.com/@x1y1)

[Oct 7](https://hashnode.com/posts/an-approved-mcp-tool-definition-is-not-a-forever-allow/6abbcfe0f567119ea44d9904/comment/6ac5c4cb1d152f19c0b6bd87)

Agree that the digest has to be checked on every tools/list refresh and not only at install. One thing I would add: a pin only helps if the fail-closed path is actually tested, so I would make the host log the old and new digest side by side when it refuses a call. Whoever gets paged then sees what changed without digging. Did Pillar say if Deadbugz changed only the descriptions, or the input schemas as well?