MCP Security Bench: leaderboard
A tool-calling agent serves 65 user tasks through 25 MCP servers while malicious tools attack it at planning (name collision, preference manipulation, injected tool descriptions), invocation (out-of-scope parameters) or response time (user impersonation, false errors, retrieval injection); the number is the mean share of attack instances carried out over 12 attack types. Unlike MCP-SafetyBench it isolates each attack type, including mixed ones, on simulated servers.
Metric: Attack success rate (%, mean of 12 MCP attack types, lower is better). Source: arxiv.org. 10 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Llama 3.1 8B Instruct | 19.74 | #4246 |
| 2 | Llama 3.1 70B Instruct | 23.37 | #1546 |
| 3 | Qwen 3 30B A3B 2507 Instruct | 27.14 | #1089 |
| 4 | Gemini 2.5 Flash | 30.26 | #453 |
| 5 | GPT-5 | 37.17 | #167 |
| 6 | Llama 3.3 70B Instruct | 46.61 | #1357 |
| 7 | Qwen 3 8B | 47.23 | #1830 |
| 8 | Claude Sonnet 4 | 52.51 | #400 |
| 9 | GPT-4o Mini | 58.56 | #1623 |
| 10 | DeepSeek V3.1 (Non-reasoning) | 60.94 | #497 (DeepSeek V3.1) |
Interactive version: theaggregate.ai/benchmark?slug=mcp-security-bench · How It Works · Data refreshed daily, snapshot 2026-11-13.