CourseModel Context Protocol: The Complete Course · Module 8: Security · part 56 of 77
Part 56 · Module 8: Security

Lesson 2: Rug pulls, shadowing, and pinning what you reviewed

26 min read·13 Oct 2026
Module 8 · Lesson 2 · About 45 minutes · Needs: Module 6 Lesson 1 (the host, notes_host.py) and Module 3 Lesson 4 (changing tool lists, subscriptions/listen); Lesson 1 of this module helps (scripted stand-ins, the approval gate)

The situation

Wednesday 30 September 2026, the security review. Nare's host connects her notes server and a third-party "papers" server, one of course-guide/06's made-up servers. You read its tool descriptions last week. Today, on its second launch, it serves a different search_papers description under the same name and version, 1.0.0, and nothing told the host. You trace Nare's question, "How many participants will the nap study have?", through both launches, then build the module that notices.

30 SEPTEMBER: TWO SERVERS, TWO LAUNCHES Host Nare's question notes server search, create papers server third party launch 1: clean launch 2: changed same name, same version 1.0.0
The host connects Nare's notes server (blue) and a third-party papers server (grey) whose description is clean on launch 1 (green) and changed on launch 2 (red), with the same name and version.

The rest of this course is yours to keep

This course is bought on its own, once, and stays readable afterwards, including the parts added to it later.