Conventional vulnerability analysis relies on system access or runtime interaction, which is often unavailable when auditing closed‑source, remotely hosted, or commercial software. A new paradigm called no‑box vulnerability analysis is proposed, using only functionality metadata for security assessment. The metadata describes the system’s inputs, outputs and side effects, thereby constraining the space of all implementations consistent with that description. Analysts can hypothesize vulnerabilities that must exist across every possible implementation without observing or interacting with the target, and later validate them when access becomes possible.
A prototype named MCPSEC was built to audit Model Context Protocol (MCP) servers for indirect prompt injection flaws. MCPSEC relies solely on tool metadata exposed at server registration, generating a hypothesized vulnerability and exploitation technique for each tool.
The prototype was evaluated on 20 widely deployed MCP servers covering 177 tools. Human reviewers confirmed 95 tools as truly vulnerable. MCPSEC flagged 143 tools as vulnerable and provided concrete exploitation ideas for each. Using only metadata, MCPSEC correctly predicted 94 real vulnerabilities, achieving a recall of 98.9%, whereas an LLM baseline identified 80 vulnerabilities with an 84.2% recall.
These findings demonstrate that no‑box vulnerability analysis can perform effective security auditing even without direct system access, offering a practical approach for risk assessment in real‑world deployments.
Review: This work demonstrates the feasibility of inferring vulnerabilities from metadata alone, offering a novel direction for security auditing when direct access is unavailable.