MBeanServer.queryNames returns a Set<ObjectName>. However, it calls getMBeanInfo on every MBean whose name is included in that Set, in order to discover the MBean's classname. This is currently necessary when there is a SecurityManager, because the returned names must be filtered against those that the caller has the permission to see, and the permission check includes the classname. But when there is no SecurityManager, there is no need to get the classname, so no need to call getMBeanInfo.