Summary
Vercel shipped ai@7.0.19 of its AI SDK with two utilities that defend against MCP 'rug pull' attacks, where a server serves a benign tool definition at approval time and a malicious one later. fingerprintTools hashes a tool set's server-controlled fields as a trust baseline, and detectToolDrift diffs a later fingerprint to surface injected descriptions or silently widened schemas.
What changed
On July 9, 2026 Vercel published ai@7.0.19, adding fingerprintTools (computing a fingerprint over each MCP tool's description, input schema, and title, captured at approval) and detectToolDrift (comparing a later fingerprint to the stored baseline to flag injected instructions or widened schemas before tools reach the model).
Why it matters
As agents wire in third-party MCP servers, a tool that mutates after approval is a real prompt-injection and privilege-escalation vector, and the protocol itself does not prevent it. Building drift detection into the most widely used TypeScript AI SDK pushes MCP supply-chain security toward a default developer concern, though Vercel notes this is detection, not prevention.
Evidence excerpt
Vercel published ai@7.0.19 on July 9, 2026 with two new utilities — fingerprintTools and detectToolDrift — aimed squarely at the MCP 'rug pull': a tool that turns malicious after you approve it.