MCP-SafetyBench: leaderboard
A ReAct agent does multi-step tasks over real MCP servers (maps, GitHub, finance, browser, web search) while one of 20 server-, host- or user-side attacks (tool poisoning, rug pull, intent injection, identity spoofing...) is active; the number is the share of 245 tasks in which the attack's goal is reached. Unlike MCPTox, which poisons tool descriptions in single calls, it spans whole multi-server tasks and host-side tampering.
Metric: Attack success rate (%, all 245 tasks, lower is better). Source: arxiv.org. 11 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Claude Sonnet 4 | 31.43 | #400 |
| 2 | Claude 3.7 Sonnet | 33.06 | #458 |
| 3 | GPT-5 | 37.55 | #167 |
| 4 | Grok 4 | 40.41 | #307 |
| 5 | DeepSeek V3.1 | 40.82 | #497 |
| 6 | GPT-4o | 42.04 | #741 |
| 7 | GPT-4.1 | 42.45 | #495 |
| 8 | GLM-4.5 | 42.86 | #526 |
| 9 | Gemini 2.5 Flash | 45.31 | #453 |
| 10 | Gemini 2.5 Pro | 46.94 | #266 |
| 11 | O4 Mini | 48.16 | #353 |
Interactive version: theaggregate.ai/benchmark?slug=mcp-safetybench · How It Works · Data refreshed daily, snapshot 2026-11-13.