Pin the injector before you trust a green MCP harness. Iannillo and co-authors posted MCP-Injector with a fault model mined from tens of thousands of real MCP repository threads, then ran 1,350 experimental cells that cut mean task-completion from 8.08 to 3.23 out of 10 under a permanent-heavy stress profile.
MCP-Injector sits on the tool-call path
MCP-Injector is protocol-aware middleware that interposes on the Model Context Protocol tool-call path. Operators drop it in without rewriting each tool server. Persistence classes cover permanent, transient, and intermittent faults. Schedules are seedable, so a failing run can be replayed with the same injection timeline.
The fault model itself is empirical. The authors mined 57,240 issue and pull-request threads across 1,774 open-source MCP repositories and calibrated failure-mode and persistence mixes to that observed incident distribution. The paper frames the shipped profile as a lower-bound stress relative to September 2025 open-source MCP patterns, and the evaluation harness forks MCP-Bench so task definitions stay comparable while the tool path becomes hostile.
For platform teams, the useful object is the middleware plus the calibrated schedule: a controlled way to ask whether plan-and-execute loops, SDK agents, or LangChain graphs keep completing work when tools time out, return errors, or flap.
Permanent-heavy MCP faults cut scores by sixty percent
Tool-calling agents now ride MCP as a shared bus. Most public agent benches still assume tools answer correctly and on time. That gap matters once production MCP servers hit rate limits, partial outages, and flaky auth the same way any other integration surface does.
arXiv:2610.32555 (posted about 23 October 2026; accepted as a NeurIPS 2026 poster) reports a 1,350-cell crossed design: gpt-oss 20B versus 120B, three stacks (a custom multi-round plan-and-execute agent, the OpenAI Agents SDK, and LangChain), and three fault-injection conditions. Under the permanent-heavy stress profile drawn from the calibrated model, mean task-completion score fell about 60%, from 8.08 to 3.23 out of 10.
Scale on the tested gpt-oss pair did not buy a larger retained share of fault-free score. The resilience-ratio model returned p=0.96. Completion rate under faults was 91.1% for 120B versus 95.6% for 20B, a 4.4-point difference with 95% CI [-0.2, 9.3]. Stacks differed in how they absorbed faults. The authors read that as evidence that framework-level error handling shaped resilience more than parameter count on this backbone pair.
Apache-2.0 middleware with a September 2025 calibration floor
The published code is Apache-2.0. The paper and artifact sit on arXiv:2610.32555, with the repository at gitlab.com/uniluxembourg/snt/sedan/papers/mcp-injector and a Zenodo archive at doi:10.5281/zenodo.23573764. The evaluation path is described as a fork of MCP-Bench.
Teams that already run MCP tool servers in CI can pin seedable fault schedules next to their agent harness and treat the injector as a usable stress tool. Reading only the abstract heatmap remains a demo glance until you measure your own fleet. The profile becomes production-shaped only after you re-run it against your own tool inventory, latency budgets, and retry policies. The calibrated mix is a lower-bound stress for open-source MCP patterns as of September 2025. Your internal MCP estate may be quieter or noisier.
Run injector stress before you trust a stack on MCP
MCP-Injector fits operators who need protocol-faithful faults on the MCP tool-call path, seedable schedules for regression, and a published calibration story rooted in public MCP repository incidents. Stack-native chaos (SDK retries, LangChain error handlers, custom plan-and-execute catch blocks) still answers framework-specific questions when you only need coarse failure injection. Application-level mocks remain enough while you are still shaping tool schemas and have no live MCP transport to interpose on.
A larger gpt-oss checkpoint should not be treated as automatically more fault-tolerant on MCP until your own resilience-ratio measurement says so. On the paper's pair, the 120B retained no larger share of its fault-free score under the permanent-heavy profile.
Teams comparing agent SDKs can also use the same seed across two frameworks on one shared MCP server set. That isolates whether your absorption gains come from retries, planner rewrites, or human-handoff policies rather than from a silent change in the fault schedule.
Calibration lower bounds and backbone-pair limits
The September 2025 open-source incident mix is a lower bound for a 2026 private MCP fleet. Internal servers, vendor-hosted MCP, and auth proxies can fail differently, so a green run against the published profile can still miss the faults that matter in your estate.
The 60% score drop is also not a universal constant across every model family. The crossed design uses gpt-oss 20B and 120B; other backbones remain unsettled until measured. Completion rate and task-completion score are separate: a run can finish while quality collapses. LangChain, the OpenAI Agents SDK, and custom plan-and-execute did not absorb faults equally; stack choice moved absorption more than scale on the reported cells. Shipping the injector without pinning seeds leaves intermittent schedules hard to bisect when CI fails.
Monday: pin a schedule and measure resilience ratio
Clone the GitLab artifact, pin an Apache-2.0 commit, and attach MCP-Injector to one staging MCP path you already monitor. Replay the paper's permanent-heavy profile with a fixed seed against your default agent stack and one alternate framework. Record fault-free versus under-fault task-completion and the resilience ratio before you promote a larger backbone as the reliability fix.
Whether your production MCP latency and auth failures match the open-source calibration remains unsettled until you measure them on your servers.