DPO/SafeDPO/OPAD training + eval for teaching tool-using LLMs to refuse falsely-benign MCP exploits
- Halloran, John. "MCP Safety Training: Learning to Refuse Falsely Benign MCP Exploits using Improved Preference Alignment." arXiv:2505.23634 (2025). - Halloran, John T. "Leveraging RAG for Training-Free Alignment of LLMs." arXiv:2605.11217 (2026).
DPO / SafeDPO training and evaluation code for aligning tool-using LLMs against falsely-benign MCP exploits (FBAs) — CVE-derived Model Context Protocol tool-use attacks phrased as ordinary, harmless-sounding requests.
No safety-tuned model (1B–14B params) refused more than 35% of FBAs out of the box. Standard DPO/SafeDPO alignment only pushed that to 48% at best. RAG-Pref, the training-free retrieval-based method proposed alongside this code, gets ~3x refusal-rate improvement alone and ~3.7x combined with DPO/SafeDPO — see arXiv:2505.23634 and arXiv:2605.11217 for full numbers.
Figure from arXiv:2605.11217. All bars shown are implemented in this repo: Base/DPO/SafeDPO via dpo.py/safedpo.py/mcptestcache.py, Vanilla RAG/RAG-Pref via makeragdbs.py/ragpref.py (see Safety Alignment Methods).
- [x] DPO / SafeDPO training + evaluation - [x] OPAD (on-the-fly, training-free principle-guided decoding) - [x] RAG-Pref (training-free retrieval-based alignment) - [x] Vanilla RAG baseline (ragpref.py --vanilla-rag)
File Purpose ------ dpo.py Standard DPO training entry point (TRL's DPOTrainer), 4-bit QLoRA. safedpo.py SafeDPO training entry point; swaps in SafeDPOTrainer for TRL's DPOTrainer. safedpotrainer.py SafeDPOTrainer, a DPOTrainer subclass adding a safety-penalty term for preference pairs flagged betterisunsafe/worseisunsafe, and a
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/johnhalloran321--mcp_safety_training.html)
Creative intelligence MCP — score your prompt before you spend the credit
vinodborole/okf-kitTurn any website into a portable, agent-ready Open Knowledge Format (OKF) bundle — no LLM required. Crawl, sync, chat offline, and serve docs to coding agents over MCP.
Azure-Samples/foundry-hosted-agents-workshopA hands-on, step-by-step workshop for building a Travel Assistant agent on Microsoft Foundry hosted agents with the Agent Framework - growing from a single agent to a multi-agent planner with function
hritvikgupta/nimbusTalk to your cloud — an open-source AI agent that reads your code, operates AWS & GCP, and opens PRs. Self-hostable.
vorobjewsen30-max/ansys-mcp-serverMCP server giving Claude Code CLI direct control over Ansys engineering simulations — CFD, FEA, meshing, and post-processing via PyAnsys. 24 tools. Multi-language docs.
MuhittinYilmazer/akanaSelf-hosted, local-first AI assistant server: swappable LLM providers, review-gated memory, an encrypted vault, and wake-word voice. No accounts, no telemetry.
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.