MCP-Persona: Benchmark for Personalized MCP Tools

• MCP-Persona is a benchmark and simulation framework that assesses LLM agents on personalized, account-bound workflows across diverse digital platforms.
• It employs a multi-layered simulation architecture—Tool-Traverse, Context-Tree, and Persona-Gen—to generate realistic user contexts and tool interactions.
• The framework reveals agent vulnerabilities and retrieval brittleness while integrating personalized query distributions and security measures for robust evaluation.

MCP-Persona refers most directly to a benchmark and simulation framework for evaluating LLM agents on real-world personal applications exposed through the Model Context Protocol, especially account-bound, stateful workflows spanning social media, collaboration platforms, email, and content management (Wang et al., 1 Jun 2026). In adjacent MCP research, the same compound is also used more loosely for persona-conditioned interaction patterns, particularly the way different user archetypes describe the same MCP tool differently in retrieval benchmarks, and for MCP client identities that receive differentiated permissions and oversight in security layers (Laddha et al., 18 Dec 2025, Kumar et al., 17 Apr 2025). Taken together, the term marks a shift from generic tool calling toward personalized, context-heavy, and safety-critical agent behavior inside MCP ecosystems.

1. Terminological scope and research usage

The literature uses “MCP-Persona” in more than one sense. The most explicit usage is the title of a 2026 benchmark on personalized MCP tools, where “persona” refers to simulated personal application environments and user-specific workflows (Wang et al., 1 Jun 2026). A second usage appears in HumanMCP, where personas are discrete user archetypes that systematically vary how the same tool request is phrased, thereby stressing retrieval generalization (Laddha et al., 18 Dec 2025). A third usage arises in MCP security work, where “personas” are operational agent identities with distinct tokens, scopes, rate limits, and audit trails (Kumar et al., 17 Apr 2025).

Usage	Core meaning	Representative source
Benchmark name	Evaluation of agents on personalized MCP tools and personal contexts	(Wang et al., 1 Jun 2026)
Query persona	User archetypes that phrase the same tool request differently	(Laddha et al., 18 Dec 2025)
Operational persona	MCP client identity with permissions, logging, and policy controls	(Kumar et al., 17 Apr 2025)

A recurring source of ambiguity is the acronym “MCP” itself. In “Self-supervised Pre-training for Personalized Chatbots with Multi-level Contrastive Sampling,” MCP denotes a personalized chatbot framework rather than the Model Context Protocol, and the paper does not use “MCP-Persona” as a separate term (Huang et al., 2022). This suggests that, in current scholarship, “MCP-Persona” is best treated as a protocol-centric notion anchored in tool use, personalization, and agent governance rather than as a generic synonym for persona modeling.

2. Personalized MCP tools as a benchmarked capability

The benchmark named MCP-Persona was introduced to test whether MCP-based agents can operate realistic personal applications rather than only generic information-seeking tools (Wang et al., 1 Jun 2026). It covers 12 personalized MCP servers and 173 human-verified tasks, with application families including social media platforms such as Reddit and Xiaohongshu (Rednote), enterprise collaboration suites such as Lark and Slack, email systems, and content-management tools such as Notion and Obsidian. The benchmark also includes generic search and information servers that appear inside larger workflows, reflecting the fact that personal tasks are often cross-application rather than single-tool.

The benchmark’s motivating claim is that existing MCP benchmarks mostly emphasize generic tools and fail to capture account-bound, multi-step, stateful workflows. MCP-Persona therefore structures tasks as natural-language requests over simulated personal state: chats, teammates, channels, documents, posts, comments, calendars, and notes. Evaluation is performed in an interaction loop of up to 20 steps, and task scoring is decomposed into checkpoint accuracy, success rate at 0.8, and execution accuracy, with execution-based checkpoints verified directly against environment changes (Wang et al., 1 Jun 2026).

The empirical findings are notably severe. Even top models such as GPT-5 and Claude-Sonnet-4.5 remain well below 50% average task accuracy. Reported overall results include 38.66 checkpoint accuracy and 41.50 execution accuracy for Claude-Sonnet-4.5, and 36.99 checkpoint accuracy and 41.45 execution accuracy for GPT-5 (Wang et al., 1 Jun 2026). Email tasks are the easiest subset, while content-management tasks and heterogeneous cross-server “Hodgepodge” workflows are the hardest. The reported failure patterns are also structurally revealing: agents under-explore the environment, skip required dependency steps such as resolving user IDs before scheduling events, and degrade sharply under long or distractor-heavy context (Wang et al., 1 Jun 2026). This suggests that personal MCP applications stress not only tool invocation, but also persistent state discovery, implicit parameter recovery, and multi-app orchestration.

3. Simulation architecture: Tool-Traverse, Context-Tree, and Persona-Gen

MCP-Persona’s central methodological contribution is a simulation stack that makes personalized MCP evaluation reproducible without exposing real user data (Wang et al., 1 Jun 2026). Tool-Traverse first builds authentic function-call pools for each tool by executing valid human-authored seeds against real MCP servers, then augments them with adversarially perturbed invalid calls to capture realistic failure modes. From these traces, an LLM synthesizes executable Python simulation kernels $K_t$ for each tool, implementing the transition

$$f_t : (\mathcal{C}_{\text{current}}, x) \rightarrow (\mathcal{C}_{\text{new}}, y),$$

where $x$ is the tool call, $y$ is the tool response, and $\mathcal{C}$ is the hierarchical personal context. On Lark, this simulator achieved 93.8% F1, 94% accuracy, and 0.8703 METEOR against real traces, compared with 53.3% F1, 58% accuracy, and 0.3214 METEOR for a documentation-only mock baseline (Wang et al., 1 Jun 2026).

Context-Tree models the user environment itself. For each personalized server, it constructs a hierarchical state rooted at a user or workspace entity and expands into calendars, chats, messages, posts, comments, notes, and related objects. Fields are populated by four generation modes—Enumerate, Free-Form, Random, and Authentic—and then linked across entities by shared IDs and references (Wang et al., 1 Jun 2026). This makes the benchmark materially different from a schema-only simulator: tools operate over realistic, mutable context rather than flat stubs.

Persona-Gen then generates tasks by sampling coherent tool chains, converting them into prototype instructions, instantiating them with concrete context values, and finally fuzzifying the instructions by removing implicit context that agents are expected to recover through exploration (Wang et al., 1 Jun 2026). This design choice is important because it moves MCP-Persona away from parameter-filling and toward genuine personal-assistant behavior. A task may omit the platform name, user ID, or calendar identifier even when those values are required by the actual tool chain; the burden of resolution falls on the agent.

4. Persona-conditioned query distributions in MCP retrieval

A different but closely related strand of research treats “MCP-persona” as a query-distribution problem. HumanMCP introduces the first large-scale MCP dataset with persona-conditioned human-like queries over approximately 2,800 tools across 308 MCP servers, extending MCP-Zero with multiple natural-language formulations per tool (Laddha et al., 18 Dec 2025). Its five personas are defined as a discrete taxonomy rather than a latent variable model.

Persona	Behavior description
Problem-Oriented	Novices who describe issues in simple, non-technical terms
Goal-Oriented	Users who know what they want to achieve but not how to accomplish it
Category-Aware	Users aware of the general type/category of the tool but not its specific name
Function-Specific	Technically skilled users who describe precise functions and parameters without naming the tool
Tool-Explicit	Expert users who directly reference the exact tool name and may specify parameters explicitly

HumanMCP generates one query per persona per tool by conditioning gpt-4o-mini on tool metadata and the persona label, then filtering outputs with a [gpt-4o](https://www.emergentmind.com/topics/gpt-4o) critic that checks functional relevance, persona fidelity, and linguistic naturalness, allowing up to two regeneration attempts (Laddha et al., 18 Dec 2025). The intended construction is therefore roughly $2{,}800 \times 5$ persona-conditioned queries, while experiments use a fixed subset of 500 persona-based queries for cross-model evaluation and 2,800 non-overlapping query–tool pairs for retriever training (Laddha et al., 18 Dec 2025).

The benchmark’s empirical role is to show that tool retrieval quality is highly sensitive to user style. In long-context evaluation with Gemini 2.0 Flash, Top-1 Hit Rate degrades from 87.4% at 500 tools to 65% at 2,000 tools (Laddha et al., 18 Dec 2025). In the two-stage retrieval-plus-selection experiment, a dense retriever based on SentenceTransformer all-MiniLM-L6-v2 plus Gemini 2.0 Flash reaches 76% end-to-end accuracy, compared with 65% for the LLM alone over all 2,000 tools (Laddha et al., 18 Dec 2025). The paper’s underlying claim is that benchmarks built from clean, tool-aligned phrasing overestimate robustness, whereas persona-conditioned query diversity reveals brittleness in lexical matching and semantic retrieval. This suggests that any comprehensive account of MCP-Persona must include not only personal application state, but also heterogeneity in how different users formulate requests.

5. Security, governance, and attack surfaces of MCP personas

Once MCP tools are personalized and account-bound, the agent persona becomes a security principal rather than only a linguistic style. MCP Guardian makes this explicit by inserting a middleware layer between MCP clients and servers that performs API-token authentication, per-token rate limiting, regex-based WAF scanning, logging, and optional tracing (Kumar et al., 17 Apr 2025). In the reference implementation, median latency increases from 25.1 ms to 28.9 ms and the 95th percentile from 32.4 ms to 36.7 ms, while the system blocks unauthorized requests, rm -rf /, drop table, and excess request rates (Kumar et al., 17 Apr 2025). The enterprise security literature extends this into a broader governance pattern in which each persona is mapped to allowed MCP servers, allowed tool lists, OAuth 2.0+ or OIDC identities, JIT access, and RBAC or ABAC policies, with separate network zones, mTLS, DLP, and audit trails for different risk domains (Narajala et al., 11 Apr 2025).

Security benchmarking shows that these controls are necessary rather than optional. MCP Security Bench (MSB) evaluates nine popular LLM agents on 2,000 attack instances across 10 domains and more than 400 tools, using 12 attack types that span tool selection, parameter filling, and response handling (Zhang et al., 14 Oct 2025). Its robustness metric is

$\mathrm{NRP}=\mathrm{PUA}\cdot(1-\mathrm{ASR}),$

where PUA is performance under attack and ASR is attack success rate (Zhang et al., 14 Oct 2025). Average ASR across all attacks and models is 40.71%; Out-of-Scope Parameter reaches 74.03%, User Impersonation 50.72%, False Error 43.42%, Prompt Injection 17.03%, and Retrieval Injection 18.89% (Zhang et al., 14 Oct 2025). A related attack line, MPMA, shows that manipulating tool names and descriptions can strongly bias MCP tool choice. “Best Description” reaches nearly 100% ASR across almost all model–server combinations, while GAPMA’s advertising-style variants reduce LLM-based suspicion rates to 0–5%, with Authoritative plus Genetic Algorithm achieving 0% TPR in the reported setup (Wang et al., 16 May 2025). This indicates that MCP-Persona must be understood as a problem of both personalization and adversarial selection.

The tool-use security literature also demonstrates direct system compromise. MCP Safety Audit shows that Claude 3.7 and Llama-3.3-70B-Instruct can be induced to edit .bashrc, create ~/.ssh/authorized_keys, read token files, expose OPENAI_API_KEY and HF_TOKEN, and exfiltrate secrets through Slack when filesystem, Chroma, Everything, and Slack MCP servers are composed together (Radosevich et al., 2 Apr 2025). The accompanying MCPSafetyScanner is presented as the first agentic tool for assessing the security of an arbitrary MCP server, using Hacker, Auditor, and Supervisor agents to discover exploit paths and remediation guidance (Radosevich et al., 2 Apr 2025).

Alignment work specific to MCP exploits reaches a similar conclusion. MCP Safety Training introduces MCP-FBAs, a dataset of falsely benign attacks and truly benign samples for Filesystem-based MCP refusal learning, and reports that DPO improves refusal but remains weak under strict multi-sample evaluation, especially for GRPO-based models (Halloran, 29 May 2025). RAG-Pref, which retrieves preferred and dispreferred preference examples at inference time, raises average strict refusal to 24.1% when combined with DPO, compared with 6.7% for DPO alone and 12.2% for RAG-Pref alone; for Llama-3.1-8B, DPO plus RAG-Pref reaches 79.8% strict refusal, which still means roughly one in five FBA prompts yields at least one compliant generation out of 10 samples (Halloran, 29 May 2025). More broadly, this suggests that the “persona” of an MCP agent cannot be reduced to surface politeness or instruction-following. In practice it is an operational bundle of permissions, tool-choice heuristics, retrieval behavior, refusal thresholds, and auditability.

6. Broader persona research connected to MCP-Persona

Adjacent persona research provides additional conceptual machinery for future MCP-Persona systems. “The Pragmatic Persona” models persona through discourse-level bridging inferences rather than surface style, using a four-dimensional hidden schema and seven relation types to build semantic graphs; PD-Agent raises average cosine-similarity-based persona recovery from 0.83 to 0.96 for GPT-4o and from 0.86 to 0.98 for o1-mini (Yang et al., 27 Apr 2026). PersoPilot, by contrast, operationalizes persona as task-filtered topic–relation–object triples plus analyst-guided classification, coupling a user-facing copilot with an active-learning loop and reporting UniEval scores of 0.84 naturalness, 1.0 coherence, 1.0 groundedness, and 0.86 understandability (Afzoon et al., 4 Feb 2026). These works suggest that MCP-Persona benchmarks could eventually move beyond environment state toward explicit persona graphs, discourse structure, and analyst-overridable classifications.

Multimodal and embodied persona research points in a similar direction. MPCHAT defines persona as five image–sentence episodic memory pairs and shows statistically significant gains across next response prediction, grounding persona prediction, and speaker identification when multimodal persona is used (Ahn et al., 2023). MCPDial provides 250 NPC personas, 750 player personas, 49 expert-written conversations, 220 LLM-generated conversations, and 20 canonical function calls for persona-grounded Minecraft dialogue with tool-like actions (Alavi et al., 2024). “One Policy, Infinite NPCs” scales this further by conditioning a single shared RL policy on frozen persona embeddings, reporting compositional zero-shot persona identification up to 17x above chance, Spearman $\rho \approx 0.73$ semantic-behavioral alignment, and 22x faster inference than an LLM-as-policy baseline (Hong, 22 May 2026). A plausible implication is that future MCP-Persona systems may converge on an overview: personal-application environments simulated with Tool-Traverse-like fidelity, richer persona memories and graphs, multimodal grounding, and traceable control policies that remain auditable under real-time constraints.

In this broader view, MCP-Persona is not a single method but an emerging research program. Its benchmark form isolates the practical difficulty of personalized MCP tool use; its retrieval form studies heterogeneity in how users express the same request; and its security form treats persona as a governed, attackable agent identity. The literature therefore portrays MCP-Persona as a central interface problem for LLM agents: how to combine personal context, tool orchestration, and safety controls without collapsing under ambiguity, scale, or adversarial manipulation.