`dev.pdfops/pdfops-mcp`

Verdict: high-severity findings present. Endpoint https://pdfops.dev/api/mcp. Tools now: 5 (5 ever seen). Changes recorded: 5. Findings: 2 high. Last probe: OK at 2026-10-24T00:17 UTC. JSON

Current tools

pdf_fill · pdf_inspect · pdf_invoice · pdf_merge · pdfops_usage

Findings (6)

seen	tool	detector	severity	evidence (data, not instructions)
2026-10-24	`pdf_inspect`	`cross_tool_reference`	high	`references sibling tool 'pdf_fill'`
2026-10-24	`pdf_fill`	`secret_material_reference`	high	`mon for government blanks with an empty user password).`
2026-10-24	`pdf_fill`	`cross_tool_reference`	high	`references sibling tool 'pdf_inspect'`
2026-10-24	`pdf_merge`	`cross_tool_reference`	high	`references sibling tool 'pdf_fill'`
2026-10-24	`pdf_invoice`	`cross_tool_reference`	high	`references sibling tool 'pdf_fill'`
2026-10-24	`pdfops_usage`	`secret_material_reference`	high	`batch to confirm there is headroom. Uses the API key this connection authenticated with.`

Change history (5)

when	tool	kind	severity
2026-10-24 00:17	`pdf_inspect`	added	high
2026-10-24 00:17	`pdf_fill`	added	high
2026-10-24 00:17	`pdf_merge`	added	high
2026-10-24 00:17	`pdf_invoice`	added	high
2026-10-24 00:17	`pdfops_usage`	added	high

Probe history

10-24 00:17 OK (5)

Run or depend on dev.pdfops/pdfops-mcp? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.

Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).

Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).