Skip to content

AgentCheck: A Reproduce-Intervene-Mitigate Workbench for LLM Agents over MCP

🕒 Published (v1): 2026-07-13 05:14 UTC · Source: Arxiv · link

Why this paper was selected

MCP-integrated reproduce-intervene-mitigate workbench; fills critical gap in agent failure tooling

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

AgentCheck is an open-source browser workbench that turns an MCP server into a fault-injection surface, enabling developers to reproduce tool failures, apply mitigations, and confirm fixes against the identical injected fault — all before deployment. Across five agent configurations and 120 scenarios spanning 12 fault types, it reveals that silent data-quality failures (stale, contradictory, or irrelevant tool responses that carry no error code) are the dominant agent weakness, not crashes or security exploits.

Problem

Existing agent benchmarks (GAIA, SWE-bench, ToolBench, MCPEval) assume tools behave correctly; they measure task competence under ideal conditions but give no signal about agent behavior when tools time out, return stale data, or have their descriptions poisoned. Diagnosis tools (LangSmith, AGDebugger) observe or hand-steer traces but cannot inject a controlled fault and automatically verify that a fix resolves it. There is no closed-loop, developer-facing instrument that covers reproduce → intervene → confirm.

Method

AgentCheck sits as a proxy between a tool-using LLM agent and its MCP server. For a given task \(q\), it runs the agent three times sharing a single cache \(K : (\text{tool}, \text{args}, i) \mapsto r\):

  1. Clean run — records every real tool response into \(K\).
  2. Faulted run — replays \(K\) but substitutes fault injector \(g\) at injection point \(p\) (the specific tool call index); all earlier calls return cached clean responses; all later calls go live once the trajectory diverges.
  3. Mitigated run (optional) — wraps the agent with mitigation \(m\), re-runs against the same \((p, g)\), and computes \(\text{fix\_confirmed} = \bigwedge_{c \in F} c(\tau_{\text{mit}}) = \text{pass}\) where \(F\) is the set of failed primary checks.

The fault library covers 12 types in 3 categories (A: tool execution — timeout, API error, permission denied, schema drift; B: data quality — stale data, contradiction, wrong answer, silent empty; C: security — prompt injection, description poisoning, false claim, data exfiltration), instantiated in 120 scenarios across 5 domains. Scoring uses deterministic pass/fail checks as the primary verdict plus an LLM judge (Claude 4.5 Haiku) as a secondary diagnostic signal, with the LLM judge validated against human annotations (inter-annotator Cohen's \(\kappa\) of 0.78/0.87/0.69 across three dimensions).

Key Contributions

  • Reproduce–Intervene–Confirm loop: a controlled comparison that holds all tool responses constant except one, making fault attribution unambiguous and fix verification deterministic.
  • 12-type fault taxonomy and 120-scenario library: 56 scenarios adapted from ToolMisuseBench and MCPTox, 64 newly authored, each with precomputed clean/faulted demonstrations and auto-validated schema.
  • Live MCP integration: developers can plug in their own MCP endpoint and target agent, not just a bundled demo server.
  • Two-tier scoring: deterministic checks (primary, repeatable) + LLM judge (interpretive, secondary), with inter-annotator alignment reported; LLM propagation rate treated as an upper bound.
  • Empirical profiling of five agent configurations under fixed, identical tool responses, enabling model-level comparison free of environment noise.

Results

  • DeepSeek achieves the highest score at 105/120; Llama the lowest at 77/120 — a 28-point spread invisible to task-success benchmarks where all agents "succeed" because tools behave.
  • Category B (data-quality) is the weakest band for every agent: DeepSeek scores 29/40, Llama 13/40; mean pass rate across all agents is 5.0/10 (B1), 5.2/10 (B2), 4.6/10 (B3), 4.2/10 (B4).
  • Category A (tool execution) and C (security) are stronger: mean pass rates 8.6 (A1), 9.4 (A2), 8.8 (A3), 10.0 (A4); 10.0 (C1), 9.2 (C2), 9.8 (C3), 7.8 (C4).
  • On Llama, a retry mitigation raises success on timeout/API-error faults (A1/A2/A3) from ~30% to 100%.
  • Stale-data faults (B1) remain near 3–4/10 regardless of the mitigation tested; output-layer wrappers do not supply the temporal reasoning or cross-call memory needed.
  • Fault injection succeeds in all 120 scenarios; re-running a 36-scenario subset under cached responses yields identical pass/fail outcomes (perfect repeatability).

Limitations

  • Single-fault injection only: compound or cascading failures were not evaluated.
  • Library coverage: 12 fault types do not cover all longer-horizon or policy-specific failure modes; Category-B scenarios are hand-authored, so findings should be treated as hypotheses.
  • LLM judge reliability: diagnostic labels are non-deterministic and may over-fire; propagation rate is explicitly an upper bound, not ground truth.
  • Mitigation scope: tested mitigations (retry, schema validation, injection filter, output verifier) are generic wrappers; none specifically addresses data-exfiltration (C4) or semantic staleness (B1–B3), leaving these fault families largely unmitigated by current tooling.

Relevance to Agentic AI / LLM Agents

AgentCheck addresses a critical blind spot in agent evaluation: the gap between benchmark competence (tools behave) and deployment robustness (tools don't). Its reproduce–intervene–confirm loop is directly actionable for anyone building or deploying tool-using agents over MCP, providing a pre-deployment qualification step that existing trace monitors and offline benchmarks cannot supply. The finding that silent data-quality faults dominate over crashes or security failures challenges the common assumption that alignment and safety hardening are the primary robustness concerns — temporal reasoning and cross-call consistency emerge as equally important. The MCP-native architecture connects directly to the growing ecosystem of MCP-integrated agents and reinforces work on MCP security (MCPTox, MCPSecBench) by showing what happens when preventive defenses fail to block a fault.