The third tool call flipped the metadata

Pillar Security’s Deadbugz campaign (August 2026) shipped a “productivity-suite” MCP that looked like text formatting. For the first three tools/call requests it answered with ordinary tool docs. After call #3, tools/list and prompts/get flipped: the same server started steering the agent toward SSH keys, AWS credentials, shell history, and Kubernetes config — and told it to hide the work. tools.listChanged made the refresh look like normal protocol hygiene.

That is an operator note for anyone who treats MCP install review as a one-time checkbox, not a new gem. A clean tools/list at trust time is not a contract. Runtime-gated metadata poisoning survives the PR skim and the first poke in MCP Inspector; normal use crosses the threshold. Fingerprint approved tool definitions, treat post-approval schema/description drift as a security event, and re-approve when listChanged fires with new instructions.