The report
A service can report that an API key is configured without checking that key on each request. That is the defect described in the PDF Reader MCP advisory: the HTTP handler accepted tool requests even when MCP_API_KEY was set. A caller with network access to the endpoint could invoke the document-reading tools using the server process's filesystem permissions.
The affected range starts at version 2.2.0 and ends before 3.0.1. The reviewed advisory lists 3.0.1 as patched, with actual header validation, a loopback default and additional warnings about non-loopback exposure. This is an HTTP-transport failure, not proof that normal local stdio sessions leaked documents, and the report identifies no population of confirmed victims.
A configuration flag did not become an authorization decision
The security question is not whether a secret exists in the environment. It is whether the request-handler path compares the caller's credential and denies access before running a tool. Deployments that cannot upgrade can restrict binding and enforce identity in a separate proxy; filesystem allowlists further reduce what an authenticated or unauthenticated tool can reach. The Case keeps those defenses distinct, because restricting network exposure does not repair a missing authorization check.