Skip to content

MCP-SafetyBench: A Benchmark for Safety Evaluation of Large Language Models with Real-World MCP Servers

🕒 Published (v1): 2026-01-01 · Source: ICLR · Venue: ICLR 2026 · link

Why this paper was selected

MCP safety benchmark with real-world servers; critical for production agentic safety

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

MCP-SafetyBench is a comprehensive safety benchmark for evaluating LLM agents against attacks on the Model Context Protocol (MCP), built on real-world MCP servers across five domains and covering 20 attack types. Evaluation of 13 leading models reveals universal vulnerability (ASR range: 29.80%–48.16%) and a statistically significant safety-utility trade-off (\(r = -0.572\), \(p = 0.041\)). Host-side attacks are most dangerous, averaging 81.94% ASR with Identity Injection achieving 100%.

Problem

Existing MCP safety benchmarks (SafeMCP, MCPTox, MCIP-Bench, MCP-AttackBench, MCPSecBench) either address only isolated attack types, lack real-world MCP server integration, or evaluate only single-turn tool use. None captures the multi-turn, multi-server reasoning dynamics that characterize real MCP deployments, leaving a critical gap in realistic safety evaluation for agentic LLM systems.

Method

MCP-SafetyBench is built in three stages atop MCP-Universe tasks: 1. Task Selection: 245 baseline tasks drawn from five domains (browser automation, financial analysis, location navigation, repository management, web search), each formalized as a tuple \((G, C, T_{\text{available}})\) with machine-checkable output schemas. 2. Attack Instantiation: Each task is paired with exactly one attack \(A\) from a unified 20-type taxonomy spanning MCP Server (11 types, e.g., Tool Poisoning variants, Rug Pull, Function Overlapping), MCP Host (4 types: Intent Injection, Data Tampering, Identity Spoofing, Replay Injection), and User (5 types: Malicious Code Execution, Credential Theft, Remote Access Control, Retrieval-Agent Deception, Excessive Privileges Misuse). Attack instances are generated via template synthesis and human review for plausibility. 3. Evaluation: Fully automated, execution-based dual-label evaluation producing Task Success Rate (TSR) and Attack Success Rate (ASR) from ReAct-agent traces; each task is run 3Ă— with max 20 ReAct iterations.

Key Contributions

  • Unified taxonomy of 20 MCP attack types spanning server, host, and user layers—the most comprehensive coverage among existing MCP safety benchmarks.
  • MCP-SafetyBench: 245 real-world, multi-step, multi-server test cases across five domains with deterministic, execution-based evaluation.
  • Systematic evaluation of 13 open- and closed-source LLMs (including GPT-5, Claude-4.0-Sonnet, Gemini-2.5-Pro, Grok-4, Qwen3-235B, DeepSeek-V3.1), exposing universal vulnerability and domain/attack-type breakdowns.

Results

  • Universal vulnerability: All 13 models are compromised; overall ASR ranges from 29.80% (Qwen3-235B) to 48.16% (o4-mini).
  • Safety-utility trade-off: Pearson \(r = -0.572\) (\(p = 0.041\)) between TSR and DSR (\(= 1 - \text{ASR}\)) across models; o4-mini has highest TSR (21.22%) but low DSR (51.84%); Qwen3-235B has lowest TSR (10.20%) but highest DSR (70.20%).
  • Domain vulnerability: Financial Analysis is most vulnerable (mean ASR 46.59%); Web Search least (mean ASR 30.33%); ANOVA: \(F = 6.68\), \(p = 0.000163\), \(\eta^2 = 0.308\).
  • Host-side attacks are most effective: Average ASR of 81.94%; Identity Injection achieves 100% ASR across all tested models.
  • Reasoning vs. non-reasoning models: No significant difference in ASR (\(p = 0.7778\) by t-test, \(|d| = 0.1648\)).
  • Open-source vs. proprietary: No systematic difference (\(p = 0.4008\), \(|d| = 0.5252\)).

Limitations

  • 245 test cases is relatively small; coverage is bounded by the five domains available in MCP-Universe.
  • Server-side attacks dominate the benchmark (74.69%), which may over-represent that threat vector relative to real deployment distributions.
  • Browser Automation has only 30 cases due to construction complexity, reducing statistical power for that domain.
  • No defense mechanisms are evaluated—the benchmark diagnoses vulnerabilities but does not propose mitigations.
  • Evaluation uses a fixed ReAct framework; results may not generalize to other agent architectures (e.g., plan-and-execute, tree-of-thought).
  • Attack templates are human-reviewed but synthetically generated, which may not capture the full diversity of adversarial creativity.

Relevance to Agentic AI / LLM Agents

MCP has become the de facto standard for connecting LLM agents to external tools, making its security properties directly load-bearing for the safety of agentic systems. The finding that stronger task-executing agents (higher TSR) are systematically more vulnerable (\(r = -0.572\)) is a fundamental tension for the field: optimizing for capability may structurally undermine safety, and reasoning ability alone does not confer robustness. The 100% ASR for Identity Injection and 81.94% average for host-side attacks expose that the planning/orchestration layer—where multi-step agent logic lives—is the weakest link, not the individual tool calls. This benchmark provides the first rigorous, multi-turn, real-server evaluation infrastructure that researchers building or deploying MCP-based agents can use to measure and compare defenses.