Mahal Systems MCPSecBench
Fits teams shipping an MCP host or client, not just a model. Borrow the 17 attack types over four surfaces (client, protocol, server, host) and the success/refusal/execution-error outcome split.
What it asks the agent to do
- handle a request while a malicious MCP server tries tool poisoning
- withstand protocol-level attacks such as man-in-the-middle and DNS rebinding
- avoid a server whose name squats on a trusted one
- finish a benign MCP request without a specification violation
What to borrow from it
taxonomysandbox design
Caveats
No published case count; it is a playground tied to Claude Desktop, OpenAI and Cursor as hosts, so runs are partly manual; results in the repo cover OpenAI only.
Details
| Workloads | safety, security, tool calling |
|---|---|
| Interaction | single turn |
| Environment | mixed |
| End state checked | No |
| Tools | custom benign and malicious MCP servers, an MCP client, attack scripts, a GUI test harness |
| Grading | llm judge, programmatic check |
| Size | Not published |
| Data | synthetic |
| Personal data | none |
| License | MIT |
| Harness | own repo |
| Status | active |