Tool Supply-Chain Integrity Lab

You approved the tool. Then its definition was swapped — and your agent called it anyway.

The MCP scanner grades a tool registry at a single point in time. This lab grades the failure mode it structurally cannot see: the canonical MCP “rug pull” / TOCTOU (time-of-check vs time-of-use) — a tool whose description, parametersSchemaHash, approvalRequired flag, or destructive-verb surface mutated between the moment the operator reviewed/approved it and the moment the agent actually invoked it. AgentSmack grades the OBSERVED lifecycle: tool.registered → tool.redefined → tool.invoked. The headline findings are a tool-redefined-then-invoked rug pull and a silently-downgraded approval requirement (two critical hard blockers). Ground-truth wins: a new definition the operator explicitly re-approved:true before invocation clears the drift — we measure useful re-review, not blanket suppression. Findings map to OWASP LLM03 Supply Chain (+ LLM01 + LLM06) / NIST AI RMF coverage with paste-able remediation, a synthetic-attacker gauntlet, and audience report variants. Load a sample to watch the gauge swing with no live infra.