modelcontextprotocol/servers v2.1.0

on GitHub

Security fixes

v2.1.0 fixes eight vulnerabilities in three servers. Upgrade
@modelcontextprotocol/server-filesystem and @modelcontextprotocol/server-everything
to 2.0.1, and mcp-server-fetch to 2026.10.24.

@modelcontextprotocol/server-filesystem 2.0.1

• Writes stay inside the directory that was checked (Linux and macOS). A parent directory swapped for a symlink between the access check and the write can no longer redirect write_file, edit_file, create_directory or the move_file destination outside the allowed directories. On Windows this is only partly fixed; the advisory says what is still exposed and how to configure around it (GHSA-53mr-w429-c597)
• Paths are checked exactly as they are used. The access check no longer strips a trailing quote or whitespace that the file operation keeps, so a sibling directory named after an allowed one with that suffix is no longer reachable (GHSA-7rgq-gccq-qphx)
• A symlink spelled in a different letter case no longer passes the symlink check for a new path on a case-insensitive volume, such as macOS's default. This was a regression in 2026.8.31 (GHSA-4gxg-m5jx-9j57)
• list_directory_with_sizes checks each entry before reading its size, so a symlink inside an allowed directory no longer reveals the size and modification time of a file outside it (GHSA-hhwq-wxfx-cj7g)

@modelcontextprotocol/server-everything 2.0.1

• The HTTP and SSE transports refuse requests from other web origins. They now check the Origin header and no longer send Access-Control-Allow-Origin: *, so a web page the user visits can no longer call the server's tools (such as get-env) or read their results (GHSA-mvf5-2qqv-rg3c)

mcp-server-fetch 2026.10.24

• The address check and the connection use the same host name. For an internationalized (IDNA) host name, the server used to check one form of the name and connect to another, which could reach an internal address (GHSA-v38p-wf49-hx2j)
• NAT64 addresses are judged by the IPv4 address they carry. An address in 64:ff9b::/96 that wraps a private, loopback or link-local IPv4 address is now refused, as an IPv4-mapped one already was (GHSA-66qx-2266-pmj6)
• robots.txt is checked again after every redirect, not only for the URL first requested (GHSA-3jqg-r5pp-rmp2)

Upgrading from a date-versioned npm release

The TypeScript servers moved from date versions (2025.x, 2026.x) to semantic versions in 1.0.0. Package managers rank 2.0.1 below every 2025.x and 2026.x version, so they won't offer it as an upgrade. If you are on a date version, install 2.0.1 explicitly, for example npm install @modelcontextprotocol/server-filesystem@2.0.1.

Packages

Release ledger: v2/chore/5243-release-v2.1.0

@modelcontextprotocol/server-everything 2.0.1

What's Changed

• fix(everything): harden HTTP transport request handling by @cliffhall in #5241
• chore(deps): v2.1.0 release audit fixes by @cliffhall in #5247
• chore: version packages by @github-actions[bot] in #5242
• Release v2.1.0: merge v2/main into main by @cliffhall in #5249

@modelcontextprotocol/server-filesystem 2.0.1

What's Changed

• fix(filesystem): harden path handling for new paths by @cliffhall in #5236
• fix(filesystem): harden path handling in write operations by @cliffhall in #5237
• fix(filesystem): harden path handling in directory listings by @cliffhall in #5234
• fix(filesystem): harden path handling by @cliffhall in #5235
• chore(deps): v2.1.0 release audit fixes by @cliffhall in #5247
• chore: version packages by @github-actions[bot] in #5242
• Release v2.1.0: merge v2/main into main by @cliffhall in #5249

mcp-server-fetch 2026.10.24

What's Changed

• fix(fetch): harden address classification by @cliffhall in #5238
• fix(fetch): harden robots.txt handling by @cliffhall in #5239
• fix(fetch): check the host name the connection uses by @cliffhall in #5240
• chore(fetch): bump certifi to 2026.10.19 in uv.lock (GHSA-6q48-6c7w-9gw2) by @cliffhall in #5244
• chore: stamp Python CalVer versions for 2026.10.24 by @github-actions[bot] in #5248
• Release v2.1.0: merge v2/main into main by @cliffhall in #5249

Repository

What's Changed

• docs: all work in a fresh worktree, with the session started inside it by @cliffhall in #5219
• docs(skills): keep argument placeholders out of skill bodies by @cliffhall in #5220
• ci: dispatch DCO and the Everything diff on version PRs opened by automation by @cliffhall in #5222
• docs: link the Version Packages PR to its release issue, not only by comment by @cliffhall in #5221
• docs(skills): add the advisory follow-up draft card convention by @cliffhall in #5233
• chore(deps): upgrade the MCP TypeScript SDK to 2.4.0 and the Node.js adapter to 2.1.2 by @cliffhall in #5245
• test(memory): accept either EISDIR message form, whatever the platform by @cliffhall in #5246

Full Changelog: v2.0.0...v2.1.0

Thanks for helping us improve

This release addresses vulnerabilities reported by these community members. Thank you for taking the time to report them:

• @0xCoDSnet (GHSA-4gxg-m5jx-9j57, GHSA-3jqg-r5pp-rmp2)
• @cybercraftsolutionsllc (GHSA-hhwq-wxfx-cj7g)
• @dizconnectz (GHSA-v38p-wf49-hx2j)
• @ehudmelzer (GHSA-mvf5-2qqv-rg3c)
• @golang-not-rust (GHSA-53mr-w429-c597)
• @HunterX461 (GHSA-7rgq-gccq-qphx)
• @LeonMAG (GHSA-66qx-2266-pmj6)
• @pacocartones (GHSA-66qx-2266-pmj6)

And to this contributor, whose prototyped fix ships in this release:

• @ace-ify, the platform-independent EISDIR assertion for #5162, shipped as #5246