argocd-mcp 0.8.0 binds HTTP transport to all interfaces and allows unauthenticated MCP session creation when ARGOCD_API_TOKEN (or ARGOCD_TOKEN_REGISTRY_PATH) is set; request token can be omitted. Remote callers can invoke tools (e.g., create_application, sync_application) using the operator’s stored Argo CD token to modify resources/deploy attacker manifests. Patch to 0.9.0; restrict network exposure and set MCP_READ_ONLY=true.