What happened
The PDF Reader MCP server added an opt-in HTTP server that is supposed to enforce an API key, but the validation logic is absent — the key is read and logged but not checked. Remote callers can therefore call the MCP endpoints unauthenticated.
Why it matters
MCP servers are the bridge between an AI agent and tools. A server that advertises an API-key gate but never enforces it exposes the agent's read/parse surface to anyone on the network, which in an agentic pipeline can be used to feed or exfiltrate content the agent then acts on.
Attack vector
When the HTTP transport is enabled, the server reads MCP_API_KEY and logs that X-API-Key authentication is enabled but never actually validates the presented key, so any remote client can invoke MCP tools without credentials.
Affected systems
@sylphx/pdf-reader-mcp (also surfaced as anymd) versions 2.2.0 and later prior to 3.0.1 when MCP_TRANSPORT=http.
Mitigation
Upgrade to @sylphx/pdf-reader-mcp 3.0.1 or later; if on an affected version, keep the HTTP transport off or place the server behind a separate authenticating proxy.