feat(prompts): per-prompt rug-pull baseline MVP (spec 100) (#1010)

Implements the core of spec 100 (merged in #1009): the tool-quarantine
(Spec 032) analogue for aggregated upstream prompts. A trusted server that
passes admission with a benign prompt and later mutates its advertised metadata
is now caught and the changed prompt is WITHHELD from prompts/list until
approved — closing the last F2 gap from the PR #973 review.

Scope (metadata only): the baseline hashes advertised LIST metadata
(name + description + arguments); get-time prompts/get message content is
inherently not baselineable here (spec Non-Goals) and stays defended by the
existing F2 sanitisation + F12 caps.

- storage: parallel PromptApprovalRecord + prompt_approvals bucket + CRUD
  (+ Manager wrappers), mirroring the tool ops 1:1 — NOT a ToolApprovalRecord
  overload (the server:tool / server:prompt key spaces would collide).
- engine (internal/server/prompt_quarantine.go): calculatePromptApprovalHash
  (sha256(name|desc|normalizeJSON(args)), excludes Meta/Title), checkPromptApprovals
  with the pending/changed/approved state machine + baseline-pass + QuarantineEnabled
  kill-switch + TrustMode/AutoApproveToolChanges reuse, a fail-closed
  enforcePromptInvariant transition spine, filterBlockedPrompts, and the
  ApprovePrompt/ApproveAllPrompts mutators (which re-baseline + RefreshPrompts()).
- hook: checkPromptApprovals + filterBlockedPrompts run in RefreshPrompts after
  the TPA scan-and-drop, before registration. Withholding IS the block — a prompt
  never passed to SetPrompts is absent from prompts/list and fails prompts/get
  natively, so there is no runtime get-time gate.

Tests: hash stability/change, fail-closed invariant, first-seen→pending,
approve→registered, rug-pull change→withheld→revert→re-approved, trust=auto
auto-approve, ApproveAllPrompts, and a full-RefreshPrompts withholding integration
test. Existing aggregation tests set quarantine off (they verify aggregation, not
the baseline).

Deferred to a follow-up: the quarantine_security MCP ops
(inspect_prompts/approve_prompt/approve_all_prompts), REST twins, and the Vue
review banner — the approve API (ApprovePrompt/ApproveAllPrompts) is ready to
wire. Adding the MCP tool-schema op requires regenerating the 3 frozen
tool-surface goldens, done deliberately in that PR.


Claude-Session: https://claude.ai/code/session_01H7J8Yv5zr4tMQZaY3ot3Za

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: Dumbris

internal/server/mcp_routing.go

@@ -795,10 +795,19 @@ func (p *MCPProxyServer) RefreshPrompts() {
 		// scanner before they are ever registered (parity with tool-description
 		// poisoning detection).
 		upstreamPrompts = p.scanAggregatedPrompts(upstreamPrompts)
+		// Spec 100: rug-pull baseline. Detect pending/changed metadata vs the
+		// approved baseline and WITHHOLD those prompts from registration (compose
+		// in series after the TPA scan — scan detects poison, baseline detects
+		// change). A withheld prompt is absent from prompts/list and fails
+		// prompts/get natively; there is no runtime get-time gate.
+		approval := p.checkPromptApprovals(upstreamPrompts)
+		upstreamPrompts = filterBlockedPrompts(upstreamPrompts, approval.blocked)
 		all = buildAggregatedServerPrompts(builtins, upstreamPrompts, p.getPromptAggregated, p.logger)
 		p.logger.Info("refreshed prompts",
 			zap.Int("upstream_prompt_count", len(upstreamPrompts)),
-			zap.Int("total_prompt_count", len(all)))
+			zap.Int("total_prompt_count", len(all)),
+			zap.Int("withheld_pending", approval.pending),
+			zap.Int("withheld_changed", approval.changed))
 	} else {
 		// nil upstreamPrompts: the aggregation loop never runs, so the nil
 		// getPrompt is never invoked.

internal/server/mcp_routing_test.go

@@ -948,6 +948,8 @@ func TestRefreshPrompts_AggregatesBuiltinsAndUpstream(t *testing.T) {
 	proxy, _ := createTestProxyWithRuntime(t, nil)
 	proxy.config.EnablePrompts = true
 	proxy.config.AggregateUpstreamPrompts = true // opt in to upstream aggregation
+	qOff := false
+	proxy.config.QuarantineEnabled = &qOff // spec 100: these tests verify aggregation, not the rug-pull baseline
 
 	upstreamSrv := newTestRefreshPromptsUpstream(t)
 	testServer := mcpserver.NewTestStreamableHTTPServer(upstreamSrv)
@@ -975,6 +977,46 @@ func TestRefreshPrompts_AggregatesBuiltinsAndUpstream(t *testing.T) {
 	require.Contains(t, prompts, "server-a__greeting", "aggregated upstream prompt must be registered under its direct name")
 }
 
+// TestRefreshPrompts_RugPullBaseline_WithholdsFirstSeen (spec 100) proves the
+// full RefreshPrompts path withholds a first-seen prompt on a quarantine-
+// enforced server, and that approving it registers it on the next refresh.
+func TestRefreshPrompts_RugPullBaseline_WithholdsFirstSeen(t *testing.T) {
+	t.Setenv("MCPPROXY_DISABLE_OAUTH", "true")
+
+	proxy, _ := createTestProxyWithRuntime(t, []*config.ServerConfig{
+		// Server present in config as manual trust + quarantine on (the default).
+		{Name: "server-a", Protocol: "streamable-http", Enabled: true, TrustMode: string(config.TrustModeManual)},
+	})
+	proxy.config.EnablePrompts = true
+	proxy.config.AggregateUpstreamPrompts = true
+
+	upstreamSrv := newTestRefreshPromptsUpstream(t)
+	testServer := mcpserver.NewTestStreamableHTTPServer(upstreamSrv)
+	t.Cleanup(testServer.Close)
+
+	um := upstream.NewManager(zap.NewNop(), proxy.config, nil, secret.NewResolver(), nil)
+	t.Cleanup(func() { um.DisconnectAll() })
+	require.NoError(t, um.AddServerConfig("srv-a", &config.ServerConfig{
+		Name: "server-a", Protocol: "streamable-http", URL: testServer.URL, Enabled: true,
+	}))
+	client, ok := um.GetClient("srv-a")
+	require.True(t, ok)
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	require.NoError(t, client.Connect(ctx))
+	proxy.upstreamManager = um
+
+	proxy.RefreshPrompts()
+	prompts := proxy.server.ListPrompts()
+	require.Contains(t, prompts, "setup-new-mcp-server", "built-ins are always registered")
+	require.NotContains(t, prompts, "server-a__greeting", "a first-seen prompt on a manual server is withheld (rug-pull baseline)")
+
+	// Approve it → it registers on the triggered refresh.
+	require.NoError(t, proxy.ApprovePrompt("server-a", "greeting", "tester"))
+	prompts = proxy.server.ListPrompts()
+	require.Contains(t, prompts, "server-a__greeting", "an approved prompt is registered")
+}
+
 // TestRefreshPrompts_AggregationDisabled_BuiltinsOnly verifies the default
 // safe posture (PR #973 review): with EnablePrompts on but the opt-in
 // aggregate_upstream_prompts flag off, RefreshPrompts serves ONLY the built-ins
@@ -1028,6 +1070,8 @@ func TestRefreshPrompts_ReadsLiveAggregateFlag(t *testing.T) {
 	live := rt.Config()
 	live.EnablePrompts = true
 	live.AggregateUpstreamPrompts = true
+	qOff := false
+	live.QuarantineEnabled = &qOff // spec 100: verify aggregation, not the rug-pull baseline
 
 	// Construction-time snapshot DISAGREES (aggregation off). If RefreshPrompts
 	// read p.config it would skip aggregation — the assertion below would fail.
@@ -1085,6 +1129,8 @@ func TestRefreshPrompts_PopulatesRoutingModeServers(t *testing.T) {
 	proxy, _ := createTestProxyWithRuntime(t, nil)
 	proxy.config.EnablePrompts = true
 	proxy.config.AggregateUpstreamPrompts = true // opt in to upstream aggregation
+	qOff := false
+	proxy.config.QuarantineEnabled = &qOff // spec 100: these tests verify aggregation, not the rug-pull baseline
 
 	upstreamSrv := newTestRefreshPromptsUpstream(t)
 	testServer := mcpserver.NewTestStreamableHTTPServer(upstreamSrv)