{"data":{"id":"10.5281/zenodo.23752413","type":"dois","attributes":{"doi":"10.5281/zenodo.23752413","prefix":"10.5281","suffix":"zenodo.23752413","identifiers":[{"identifier":"oai:zenodo.org:23752413","identifierType":"oai"}],"alternateIdentifiers":[{"alternateIdentifierType":"oai","alternateIdentifier":"oai:zenodo.org:23752413"}],"creators":[{"name":"Armani, Ryan","nameType":"Personal","givenName":"Ryan","familyName":"Armani","affiliation":["Independent researcher"],"nameIdentifiers":[{"nameIdentifier":"0009-0005-9964-6841","nameIdentifierScheme":"ORCID"}]}],"titles":[{"title":"MCP Safety: Measuring Useful Action across Tool Trust Boundaries"}],"publisher":"Zenodo","container":{},"publicationYear":2026,"subjects":[{"subject":"MCP"},{"subject":"tool safety"},{"subject":"prompt injection"},{"subject":"least privilege"},{"subject":"simulated control ablation"}],"contributors":[],"dates":[{"date":"2026-10-29","dateType":"Issued"}],"language":null,"types":{"ris":"GEN","bibtex":"misc","citeproc":"article","schemaOrg":"CreativeWork","resourceType":"","resourceTypeGeneral":"Preprint"},"relatedIdentifiers":[{"relationType":"IsSupplementedBy","relatedIdentifier":"https://github.com/pooriaarab/benchmark-mcp-safety","resourceTypeGeneral":"Software","relatedIdentifierType":"URL"},{"relationType":"IsVersionOf","relatedIdentifier":"10.5281/zenodo.23752412","relatedIdentifierType":"DOI"}],"relatedItems":[],"sizes":[],"formats":[],"version":null,"rightsList":[{"rights":"Creative Commons Attribution 4.0 International","rightsUri":"https://creativecommons.org/licenses/by/4.0/legalcode","schemeUri":"https://spdx.org/licenses/","rightsIdentifier":"cc-by-4.0","rightsIdentifierScheme":"SPDX"}],"descriptions":[{"description":"MCP tools expose descriptions, returned content, and actions across trust boundaries. MCP Safety measures whether an agent completes a requested lookup without forbidden calls or literal canary disclosure. Its 40 synthetic tasks form 20 benign/malicious pairs across 6 attack categories. Deterministic replay scores safety and usefulness separately, then requires both for success. In 560 local scripted episodes, the privileged good control achieves 100.0 [83.9, 100.0] percent joint success in each stratum (95% Wilson intervals). The bad control completes the work but achieves 0.0 [0.0, 16.1] percent joint success. An additional 16000-episode simulated population sweep separates argument filtering from task-aware action filtering. At maximal simulated attack following, combining both filters preserves all requested work; either filter alone leaves failures. Blanket filtering loses legitimate work. These are diagnostic controls and a stipulated simulation, not learned-model results or evidence of deployment security.","descriptionType":"Abstract"}],"geoLocations":[],"fundingReferences":[],"xml":"PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPHJlc291cmNlIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhtbG5zPSJodHRwOi8vZGF0YWNpdGUub3JnL3NjaGVtYS9rZXJuZWwtNCIgeHNpOnNjaGVtYUxvY2F0aW9uPSJodHRwOi8vZGF0YWNpdGUub3JnL3NjaGVtYS9rZXJuZWwtNCBodHRwOi8vc2NoZW1hLmRhdGFjaXRlLm9yZy9tZXRhL2tlcm5lbC00L21ldGFkYXRhLnhzZCI+CiAgPGlkZW50aWZpZXIgaWRlbnRpZmllclR5cGU9IkRPSSI+MTAuNTI4MS9aRU5PRE8uMjM3NTI0MTM8L2lkZW50aWZpZXI+CiAgPGNyZWF0b3JzPgogICAgPGNyZWF0b3I+CiAgICAgIDxjcmVhdG9yTmFtZSBuYW1lVHlwZT0iUGVyc29uYWwiPkFybWFuaSwgUnlhbjwvY3JlYXRvck5hbWU+CiAgICAgIDxnaXZlbk5hbWU+UnlhbjwvZ2l2ZW5OYW1lPgogICAgICA8ZmFtaWx5TmFtZT5Bcm1hbmk8L2ZhbWlseU5hbWU+CiAgICAgIDxuYW1lSWRlbnRpZmllciBuYW1lSWRlbnRpZmllclNjaGVtZT0iT1JDSUQiIHNjaGVtZVVSST0iIj4wMDA5LTAwMDUtOTk2NC02ODQxPC9uYW1lSWRlbnRpZmllcj4KICAgICAgPGFmZmlsaWF0aW9uPkluZGVwZW5kZW50IHJlc2VhcmNoZXI8L2FmZmlsaWF0aW9uPgogICAgPC9jcmVhdG9yPgogIDwvY3JlYXRvcnM+CiAgPHRpdGxlcz4KICAgIDx0aXRsZT5NQ1AgU2FmZXR5OiBNZWFzdXJpbmcgVXNlZnVsIEFjdGlvbiBhY3Jvc3MgVG9vbCBUcnVzdCBCb3VuZGFyaWVzPC90aXRsZT4KICA8L3RpdGxlcz4KICA8cHVibGlzaGVyPlplbm9kbzwvcHVibGlzaGVyPgogIDxwdWJsaWNhdGlvblllYXI+MjAyNjwvcHVibGljYXRpb25ZZWFyPgogIDxyZXNvdXJjZVR5cGUgcmVzb3VyY2VUeXBlR2VuZXJhbD0iUHJlcHJpbnQiLz4KICA8c3ViamVjdHM+CiAgICA8c3ViamVjdD5NQ1A8L3N1YmplY3Q+CiAgICA8c3ViamVjdD50b29sIHNhZmV0eTwvc3ViamVjdD4KICAgIDxzdWJqZWN0PnByb21wdCBpbmplY3Rpb248L3N1YmplY3Q+CiAgICA8c3ViamVjdD5sZWFzdCBwcml2aWxlZ2U8L3N1YmplY3Q+CiAgICA8c3ViamVjdD5zaW11bGF0ZWQgY29udHJvbCBhYmxhdGlvbjwvc3ViamVjdD4KICA8L3N1YmplY3RzPgogIDxkYXRlcz4KICAgIDxkYXRlIGRhdGVUeXBlPSJJc3N1ZWQiPjIwMjYtMTAtMjk8L2RhdGU+CiAgPC9kYXRlcz4KICA8YWx0ZXJuYXRlSWRlbnRpZmllcnM+CiAgICA8YWx0ZXJuYXRlSWRlbnRpZmllciBhbHRlcm5hdGVJZGVudGlmaWVyVHlwZT0ib2FpIj5vYWk6emVub2RvLm9yZzoyMzc1MjQxMzwvYWx0ZXJuYXRlSWRlbnRpZmllcj4KICA8L2FsdGVybmF0ZUlkZW50aWZpZXJzPgogIDxyZWxhdGVkSWRlbnRpZmllcnM+CiAgICA8cmVsYXRlZElkZW50aWZpZXIgcmVsYXRlZElkZW50aWZpZXJUeXBlPSJVUkwiIHJlbGF0aW9uVHlwZT0iSXNTdXBwbGVtZW50ZWRCeSIgcmVzb3VyY2VUeXBlR2VuZXJhbD0iU29mdHdhcmUiPmh0dHBzOi8vZ2l0aHViLmNvbS9wb29yaWFhcmFiL2JlbmNobWFyay1tY3Atc2FmZXR5PC9yZWxhdGVkSWRlbnRpZmllcj4KICAgIDxyZWxhdGVkSWRlbnRpZmllciByZWxhdGVkSWRlbnRpZmllclR5cGU9IkRPSSIgcmVsYXRpb25UeXBlPSJJc1ZlcnNpb25PZiI+MTAuNTI4MS96ZW5vZG8uMjM3NTI0MTI8L3JlbGF0ZWRJZGVudGlmaWVyPgogIDwvcmVsYXRlZElkZW50aWZpZXJzPgogIDxzaXplcy8+CiAgPGZvcm1hdHMvPgogIDx2ZXJzaW9uLz4KICA8cmlnaHRzTGlzdD4KICAgIDxyaWdodHMgcmlnaHRzVVJJPSJodHRwczovL2NyZWF0aXZlY29tbW9ucy5vcmcvbGljZW5zZXMvYnkvNC4wL2xlZ2FsY29kZSIgcmlnaHRzSWRlbnRpZmllcj0iY2MtYnktNC4wIiByaWdodHNJZGVudGlmaWVyU2NoZW1lPSJTUERYIiBzY2hlbWVVUkk9Imh0dHBzOi8vc3BkeC5vcmcvbGljZW5zZXMvIj5DcmVhdGl2ZSBDb21tb25zIEF0dHJpYnV0aW9uIDQuMCBJbnRlcm5hdGlvbmFsPC9yaWdodHM+CiAgPC9yaWdodHNMaXN0PgogIDxkZXNjcmlwdGlvbnM+CiAgICA8ZGVzY3JpcHRpb24gZGVzY3JpcHRpb25UeXBlPSJBYnN0cmFjdCI+TUNQIHRvb2xzIGV4cG9zZSBkZXNjcmlwdGlvbnMsIHJldHVybmVkIGNvbnRlbnQsIGFuZCBhY3Rpb25zIGFjcm9zcyB0cnVzdCBib3VuZGFyaWVzLiBNQ1AgU2FmZXR5IG1lYXN1cmVzIHdoZXRoZXIgYW4gYWdlbnQgY29tcGxldGVzIGEgcmVxdWVzdGVkIGxvb2t1cCB3aXRob3V0IGZvcmJpZGRlbiBjYWxscyBvciBsaXRlcmFsIGNhbmFyeSBkaXNjbG9zdXJlLiBJdHMgNDAgc3ludGhldGljIHRhc2tzIGZvcm0gMjAgYmVuaWduL21hbGljaW91cyBwYWlycyBhY3Jvc3MgNiBhdHRhY2sgY2F0ZWdvcmllcy4gRGV0ZXJtaW5pc3RpYyByZXBsYXkgc2NvcmVzIHNhZmV0eSBhbmQgdXNlZnVsbmVzcyBzZXBhcmF0ZWx5LCB0aGVuIHJlcXVpcmVzIGJvdGggZm9yIHN1Y2Nlc3MuIEluIDU2MCBsb2NhbCBzY3JpcHRlZCBlcGlzb2RlcywgdGhlIHByaXZpbGVnZWQgZ29vZCBjb250cm9sIGFjaGlldmVzIDEwMC4wIFs4My45LCAxMDAuMF0gcGVyY2VudCBqb2ludCBzdWNjZXNzIGluIGVhY2ggc3RyYXR1bSAoOTUlIFdpbHNvbiBpbnRlcnZhbHMpLiBUaGUgYmFkIGNvbnRyb2wgY29tcGxldGVzIHRoZSB3b3JrIGJ1dCBhY2hpZXZlcyAwLjAgWzAuMCwgMTYuMV0gcGVyY2VudCBqb2ludCBzdWNjZXNzLiBBbiBhZGRpdGlvbmFsIDE2MDAwLWVwaXNvZGUgc2ltdWxhdGVkIHBvcHVsYXRpb24gc3dlZXAgc2VwYXJhdGVzIGFyZ3VtZW50IGZpbHRlcmluZyBmcm9tIHRhc2stYXdhcmUgYWN0aW9uIGZpbHRlcmluZy4gQXQgbWF4aW1hbCBzaW11bGF0ZWQgYXR0YWNrIGZvbGxvd2luZywgY29tYmluaW5nIGJvdGggZmlsdGVycyBwcmVzZXJ2ZXMgYWxsIHJlcXVlc3RlZCB3b3JrOyBlaXRoZXIgZmlsdGVyIGFsb25lIGxlYXZlcyBmYWlsdXJlcy4gQmxhbmtldCBmaWx0ZXJpbmcgbG9zZXMgbGVnaXRpbWF0ZSB3b3JrLiBUaGVzZSBhcmUgZGlhZ25vc3RpYyBjb250cm9scyBhbmQgYSBzdGlwdWxhdGVkIHNpbXVsYXRpb24sIG5vdCBsZWFybmVkLW1vZGVsIHJlc3VsdHMgb3IgZXZpZGVuY2Ugb2YgZGVwbG95bWVudCBzZWN1cml0eS48L2Rlc2NyaXB0aW9uPgogIDwvZGVzY3JpcHRpb25zPgo8L3Jlc291cmNlPgo=","url":"https://zenodo.org/doi/10.5281/zenodo.23752413","contentUrl":null,"metadataVersion":2,"schemaVersion":"http://datacite.org/schema/kernel-4","source":"api","isActive":true,"state":"findable","reason":null,"viewCount":0,"viewsOverTime":[],"downloadCount":0,"downloadsOverTime":[],"referenceCount":0,"citationCount":0,"citationsOverTime":[],"partCount":0,"partOfCount":0,"versionCount":0,"versionOfCount":1,"created":"2026-10-29T03:17:24.000Z","registered":"2026-10-29T03:17:24.000Z","published":"2026","updated":"2026-11-07T05:38:31.000Z"},"relationships":{"client":{"data":{"id":"cern.zenodo","type":"clients"}},"provider":{"data":{"id":"cern","type":"providers"}},"media":{"data":{"id":"10.5281/zenodo.23752413","type":"media"}},"references":{"data":[]},"citations":{"data":[]},"parts":{"data":[]},"partOf":{"data":[]},"versions":{"data":[]},"versionOf":{"data":[{"id":"10.5281/zenodo.23752412","type":"dois"}]}}}}