A new auditing method found nearly all the prompt injection holes in Model Context Protocol servers without ever running their code.
Researchers built a prototype called MCPSEC that reads only the tool metadata a server publishes at registration, the plain-English description of what a tool does rather than its actual code, in what they call 'no-box' analysis: no system access, no chance to interact with the running server. They tested it on 20 widely deployed MCP servers covering 177 tools, the connectors that let AI agents call outside functions like file readers or web fetchers, of which human reviewers had independently confirmed 95 tools carried real indirect prompt injection vulnerabilities. MCPSEC flagged 143 tools as vulnerable overall, and correctly caught 94 of those 95 confirmed flaws, a 98.9% recall rate, compared with 84.2% for an LLM baseline that found 80.
MCP servers are multiplying faster than security teams can audit them, and plenty sit behind closed-source or commercially gated APIs where outside researchers can't run test payloads. That's the same blind spot software bill-of-materials scanners hit with supply-chain risk: you get the label, not the code. A method that infers real bugs from public tool descriptions alone gives auditors, and platforms deciding which servers to trust, a cheap first pass before anyone touches actual access.
MCPSEC still over-flagged, naming 143 tools when only 95 were confirmed bad, so treat its output as a shortlist worth checking, not a final verdict.