papers / mcp-safety

MCP Safety: Measuring Useful Action across Tool Trust Boundaries

Pooria Arab · orcid 0009-0005-9964-6841 · 2026-10-29 · Published on Zenodo

abstract

MCP tools expose descriptions, returned content, and actions across trust boundaries. MCP Safety measures whether an agent completes a requested lookup without forbidden calls or literal canary disclosure. Its 40 synthetic tasks form 20 benign/malicious pairs across 6 attack categories. Deterministic replay scores safety and usefulness separately, then requires both for success. In 560 local scripted episodes, the privileged good control achieves 100.0 [83.9, 100.0] percent joint success in each stratum (95% Wilson intervals). The bad control completes the work but achieves 0.0 [0.0, 16.1] percent joint success. An additional 16000-episode simulated population sweep separates argument filtering from task-aware action filtering. At maximal simulated attack following, combining both filters preserves all requested work; either filter alone leaves failures. Blanket filtering loses legitimate work. These are diagnostic controls and a stipulated simulation, not learned-model results or evidence of deployment security.

benchmark: benchmark-mcp-safety. submitted to: none recorded.

citation

Arab, Pooria (2026). MCP Safety: Measuring Useful Action across Tool Trust Boundaries. https://doi.org/10.5281/zenodo.23752413

bibtex

@misc{mcp-safety,
  author = {Arab, Pooria},
  title = {MCP Safety: Measuring Useful Action across Tool Trust Boundaries},
  year = {2026},
  doi = {10.5281/zenodo.23752413},
  url = {https://pooriaarab.com/papers/mcp-safety},
}

venues, counts and the software records live on papers.