Break your scanner before attackers do.

1,312 attack patterns

Three paradigms from MCPTox: direct injection, semantic blending, and cross-tool poisoning. Ready to fire out of the box.

LLM-guided fuzzing

Deterministic mutations plus LLM-guided evasion discovery. Find the payloads your scanner misses.

Multi-tool chains

Data exfiltration, privilege escalation, and persistence chains that test detection across coordinated attacks.

CLI

# Stress test your scanner
mcp-stress stress run \
  --phases baseline,mutation,temporal

# Compare detection before/after
mcp-stress scan compare \
  -t read_file -s obfuscation

# Execute attack chains
mcp-stress chain execute \
  -c data_exfil_chain

Python API

from mcp_stress_test import PatternLibrary
from mcp_stress_test.generator import SchemaMutator
from mcp_stress_test.chains import ChainExecutor

library = PatternLibrary()
library.load()

mutator = SchemaMutator()
for case in library.iter_test_cases():
    result = mutator.mutate(
        case.target_tool,
        case.poison_profile.payloads[0]
    )

MCPTox benchmark

1,312 patterns across 3 attack paradigms — the largest public MCP poisoning dataset, from arxiv 2508.14925.

Palo Alto Unit42

Sampling loop exploits and tool-shadowing attacks from production MCP deployment research.

CyberArk

Full-schema poisoning where no output field is safe — descriptions, error messages, return values.