Runtime safety evaluation framework for tool-using LLM agents (MCP-style). Quantifies severity-weighted ASR, FPR, task success, latency/cost overhead, and approval burden across composable defenses and thresholds, producing risk–utility–cost frontier curves.