MCP-Injector inserts errors, delays and altered results between an assistant and tools connected through MCP, the standard for connecting agents to tools. It tests reliability when connected programs behave badly.
The authors cross gpt-oss-20B and gpt-oss-120B with three assistant frameworks, three proxy conditions, 25 tasks and three seeds. The resulting 1,350 runs share a 16,000-token context limit.
- Graded task-completion quality falls from 8.08 to 3.23 out of ten under injected faults, about 60%. Failed runs receive zero.
- Among runs that finish in both conditions, quality still falls about 57%. A completed run can conceal a poor answer.
- The larger model shows no detectable advantage in retaining its own fault-free quality. The uncertainty interval remains wide, and both models belong to one family.
- Framework comparisons are suggestive: the systems differ in error handling, iteration budgets and the number of faults they encounter.
The fault profile comes from public reports across 1,774 repositories and 57,240 threads. It weights permanent failures at 91.3%. The supplement reports that 99.5% of actual fired events are permanent, partly because permanent draws repeat across calls.
Caveat: This is a permanent-failure stress test, not a production outage estimate. The implemented intermittent schedule also differs from its design equation, limiting claims about temporary failures.
Tool bypass predates injection: some assistants already produce plausible answers without consulting the designated programs. Quality grading should therefore check evidence and honest abstention separately.
The public artifact supplies code, profiles and results. These remain author-reported findings, not an independent reproduction.