mlsanityData to 14 Oct 2026

MCP-SafetyBench: A Benchmark for Safety Evaluation of Large Language Models with Real-World MCP Servers

arXiv 2512.15163 ↗First posted 17 Dec 2025cs.CL cs.AIcited by 34

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Large language models (LLMs) are evolving into agentic systems that reason, plan, and operate external tools. The Model Context Protocol (MCP) is a key enabler of this transition, offering a standardized interface for connecting LLMs with heterogeneous tools and services. Yet MCP's openness and multi-server workflows introduce new safety risks that existing benchmarks fail to capture, as they focus on isolated attacks or lack real-world coverage. We present MCP-SafetyBench, a comprehensive benchmark built on real MCP servers that supports realistic multi-turn evaluation across five domains: browser automation, financial analysis, location navigation, repository management, and web search. It incorporates a unified taxonomy of 20 MCP attack types spanning server, host, and user sides, and includes tasks requiring multi-step reasoning and cross-server coordination under uncertainty. Using MCP-SafetyBench, we systematically evaluate leading open- and closed-source LLMs, revealing that all models remain vulnerable to MCP attacks, with a notable safety-utility trade-off. Our results highlight the urgent need for stronger defenses and establish MCP-SafetyBench as a foundation for diagnosing and mitigating safety risks in real-world MCP deployments.

Key facts. Cited by 34 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 20 of its 37 references that are in the map. First posted on arXiv 17 Dec 2025.

Builds on

20 of 37 references.

Closest ancestors · 8

Same direction, newest first

  1. 2025MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers19 Aug
  2. 2025MCPXKIT: The Unified Toolkit for Analyzing Model Context Protocol Security18 Aug
  3. 2025MCPSecBench: A Systematic Security Benchmark and Playground for Testing Model Context Protocols17 Aug
  4. 2025SHADE-Arena: Evaluating Sabotage and Monitoring in LLM Agents17 Jun
  5. 2025We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systems16 Jun
  6. 2025MPMA: Preference Manipulation Attack Against Model Context Protocol16 May
  7. 2025MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits2 Apr
  8. 2024Breaking ReAct Agents: Foot-in-the-Door Attack Will Get You In22 Oct

Other references · 12

  1. 2020Language Models are Few-Shot Learnerscited by 32,419
  2. 2022Training language models to follow instructions with human feedbackcited by 15,971
  3. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
  4. 2025Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilitiescited by 3,796
  5. 2021Ethical and social risks of harm from Language Modelscited by 966
  6. 2025Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directionscited by 265
  7. 2024On Prompt-Driven Safeguarding for Large Language Modelscited by 116
  8. 2025MCP-Universe: Benchmarking Large Language Models with Real-World Model Context Protocol Serverscited by 96
  9. 2024Red-Teaming for Generative AI: Silver Bullet or Security Theater?cited by 83
  10. 2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 46
  11. 2025MCIP: Protecting MCP Safety via Model Contextual Integrity Protocolcited by 34
  12. 2025Trivial Trojans: How Minimal MCP Servers Enable Cross-Tool Exfiltration of Sensitive Datacited by 6

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 34.

34 papers.

Sort:

By area:

  1. 2026SkillLearnBench: Benchmarking Continual Learning Methods for Agent Skill Generation on Real-World Taskscited by 55
  2. 2026From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agentscited by 37
  3. 2026ClawsBench: Evaluating Capability and Safety of LLM Productivity Agents in Simulated Workspacescited by 33
  4. 2026Unsafer in Many Turns: Benchmarking and Defending Multi-Turn Safety Risks in Tool-Using Agentscited by 30
  5. 2026ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injectioncited by 27
  6. 2026Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agentscited by 18
  7. 2026Security Threat Modeling for Emerging AI-Agent Protocols: A Comparative Analysis of MCP, A2A, Agora, and ANPcited by 15
  8. 2026AIRGuard: Guarding Agent Actions with Runtime Authority Controlcited by 13
  9. 2026A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Frameworkcited by 11
  10. 2026Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoningcited by 10
  11. 2026LPS-Bench: Benchmarking Safety Awareness of Computer-Use Agents in Long-Horizon Planning under Benign and Adversarial Scenarioscited by 9
  12. 2026SkillHarm: Lifecycle-Aware Skill-Based Attacks via Automated Constructioncited by 6
22 more
  1. 2026Taxonomy and Consistency Analysis of Safety Benchmarks for AI Agentscited by 4
  2. 2026MCPShield: A Security Cognition Layer for Adaptive Trust Calibration in Model Context Protocol Agentscited by 3
  3. 2026From Tool Orchestration to Code Execution: A Study of MCP Design Choicescited by 3
  4. 2026PlanTwin: Privacy-Preserving Planning Abstractions for Cloud-Assisted LLM Agentscited by 3
  5. 2026A Formal Security Framework for MCP-Based AI Agents: Threat Taxonomy, Verification Models, and Defense Mechanismscited by 3
  6. 2026MCP-DPT: A Defense-Placement Taxonomy and Coverage Analysis for Model Context Protocol Securitycited by 2
  7. 2026Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedbackcited by 2
  8. 2026ShieldNet: Network-Level Guardrails against Emerging Supply-Chain Injections in Agentic Systemscited by 1
  9. 2026CASCADE: A Component Ablation and Corpus Audit of a Layered Local Defense for MCP-Based Systemscited by 1
  10. 2026MCPHunt: An Evaluation Framework for Cross-Boundary Data Propagation in Multi-Server MCP Agentscited by 1
  11. 2026ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systemscited by 1
  12. 2026ToolGuardian: Declarative Security for AI Agent-Tool Interactionscited by 1
  13. 2026Agentao: A Policy-Governed Runtime Harness for Embeddable Tool-Using LLM Agentscited by 1
  14. 2026Hidden in Plain Sight: Benchmarking Agent Safety Against Decomposition Attacks with DECOMPBENCHcited by 0
  15. 2026Labels Are Not Endpoints: Treatment Leakage and Construct Validity in MCP Agent Security Evaluationcited by 0
  16. 2026When Agents Act on Web3: An Attack-Surface Survey of MCP, Skills, and Tool Callingcited by 0
  17. 2026TrustShiftProbe: Characterizing, Benchmarking, and Defending Staged Trust Attacks on MCP Serverscited by 0
  18. 2026Beyond Predefined Sinks: Security-Aware Dependency Analysis for LLM Agentscited by 0
  19. 2026Securing Computer-Use Agents Against Branch Steering Attackscited by 0
  20. 2026COPEX: Benchmarking LLM Robustness to Adversarial Context Across Model Context Protocol Layerscited by 0
  21. 2026Agent-Canary-Mas: End-to-End Evaluation of Protocol Risk in Long-Horizon Multi-Agent Systemscited by 0
  22. 2026TRAP: Tool-result Replay Attack for Probing Misbinding in LLM Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025MCP Security Bench (MSB): Benchmarking Attacks Against Model Context Protocol in LLM Agents
  2. 2025Can LLM Infer Risk Information From MCP Server System Logs?
  3. 2025Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem
  4. 2024SALAD-Bench: A Hierarchical and Comprehensive Safety Benchmark for Large Language Models
  5. 2025A First Look at the Security Issues in the Model Context Protocol Ecosystem
  6. 2025MCPGuard : Automatically Detecting Vulnerabilities in MCP Servers
  7. 2026Breaking the Protocol: Security Analysis of the Model Context Protocol Specification and Prompt Injection Vulnerabilities in Tool-Integrated LLM Agents
  8. 2026Mitigating Taint-Style Vulnerabilities in MCP Servers via Security-Aware Tool Descriptions