modelcontextprotocol/servers v2.2.0 on GitHub

Security: Node.js runtime and CA certificate updates (October 2026)

On October 20, 2026, eMudhra disclosed that the private keys for eight of its intermediate CA certificates could be recovered from the public certificates. On October 21, Node.js shipped security releases that update its bundled CA certificates for the compromise and fix several unrelated high-severity runtime CVEs. On October 23, Python's certifi 2026.10.23 removed the eMudhra roots emSign Root CA - C1 and emSign ECC Root CA - C3.

How these servers stand

The TypeScript servers rely on the Node.js runtime for certificate checks. They ship no CA certificates of their own. Only server-everything makes outbound HTTPS requests (gzip-file-as-resource), and the Node.js it runs on verifies them. server-filesystem, server-memory and server-sequential-thinking make no network connections.
mcp-server-fetch verifies HTTPS against the certifi bundle, through httpx. Installing from PyPI (uvx mcp-server-fetch, pip install mcp-server-fetch) resolves the current certifi, 2026.10.23 or later. The repository's fetch Dockerfile installs from its lockfile, which this release moves to certifi 2026.10.23 (#5341).
mcp-server-git and mcp-server-time make no network connections.

If you run a TypeScript server from npm (npx or a global install)

It runs on your Node.js, which we can't update for you. Please run Node.js 24.22.1 or 26.12.1, or later, and check with node --version. The packages' engines field accepts any Node.js 24, so npm won't warn you about an older, unpatched runtime.

If you run mcp-server-fetch from an existing environment

An environment created before October 23 keeps its older certifi. Refresh it with uvx --refresh mcp-server-fetch, or pip install -U certifi.

Packages

Package	Version	Registry	In this release
`@modelcontextprotocol/server-everything`	`2.1.0`	npm	published
`@modelcontextprotocol/server-filesystem`	`2.1.0`	npm	published
`@modelcontextprotocol/server-memory`	`2.0.1`	npm	published
`@modelcontextprotocol/server-sequential-thinking`	`2.0.0`	npm	unchanged
`mcp-server-fetch`	`2026.10.28`	PyPI	published
`mcp-server-git`	`2026.10.28`	PyPI	published
`mcp-server-time`	`2026.10.28`	PyPI	published

Release ledger: v2/chore/5330-release-v2.2.0

@modelcontextprotocol/server-everything 2.1.0

What's Changed

fix(everything): trigger-elicitation-request summarizes the form's own fields by @cliffhall in #5289
fix(everything): fail gzip-file-as-resource on an HTTP error response by @cliffhall in #5290
fix(everything): get-env masks credential-like values by default by @cliffhall in #5293
fix(everything): gzip-file-as-resource refuses non-public addresses on every hop by @cliffhall in #5295
fix(everything): drop the corrupt iCCP chunk from get-tiny-image's PNG by @cliffhall in #5298
chore(everything): fix misleading names in get-resource-links and two JSDoc headers by @cliffhall in #5297
chore: version packages by @github-actions[bot] in #5296
Release v2.2.0: merge v2/main into main by @cliffhall in #5338

@modelcontextprotocol/server-filesystem 2.1.0

What's Changed

fix(filesystem): accept a case-only respelling of an allowed directory where the file system confirms it by @cliffhall in #5319
fix(filesystem): tail no longer counts a final newline as a line by @cliffhall in #5316
feat(filesystem): report the hard-link count in get_file_info and document hard links (#5226) by @cliffhall in #5315
fix(filesystem): bound realpath/readdir waits and recursive walks (#4162) by @cliffhall in #5326
fix(filesystem): compare overwrite identity as BigInt stats, with a Windows no-device fallback by @cliffhall in #5325
fix(filesystem): retry a failed realpath once before losing a root by @cliffhall in #5318
fix(filesystem): head returns CRLF lines normalized to LF, like tail by @cliffhall in #5324
fix(filesystem): allow a client Root in its advertised form as well as its realpath by @cliffhall in #5317
fix(filesystem): move a file across filesystems by copying it on EXDEV by @cliffhall in #5322
test(filesystem): explicit timeout on the 100000-entry walk tests by @cliffhall in #5331
chore: version packages by @github-actions[bot] in #5296
Release v2.2.0: merge v2/main into main by @cliffhall in #5338

@modelcontextprotocol/server-memory 2.0.1

What's Changed

fix(memory): keep unmodelled fields on stored records across writes by @cliffhall in #5292
fix(memory): stop startup when the memory.json migration fails by @cliffhall in #5291
chore: version packages by @github-actions[bot] in #5296
Release v2.2.0: merge v2/main into main by @cliffhall in #5338

mcp-server-fetch 2026.10.28

What's Changed

fix(fetch): refuse an autonomous fetch when robots.txt answers 5xx by @cliffhall in #5299
fix(fetch): refuse IPv4-compatible IPv6 addresses (::/96) by @cliffhall in #5301
fix(fetch): report an empty-tree page as unsimplifiable under beautifulsoup4 4.13 by @cliffhall in #5304
fix(fetch): treat a header-less response as HTML only when its body is by @cliffhall in #5300
feat(fetch): add --no-readability-js to keep extraction off Node.js by @cliffhall in #5307
fix(fetch): decode a page by the charset its HTML declares by @cliffhall in #5302
fix(fetch): require readabilipy 0.3.0 so HTML extraction works on non-cp1252 pages on Windows by @cliffhall in #5311
fix(fetch): recover server-rendered content hidden until hydration by @cliffhall in #5308
fix(fetch): declare beautifulsoup4 and name a missing Content-Type in the raw prefix by @cliffhall in #5323
chore: stamp Python CalVer versions for 2026.10.28 by @github-actions[bot] in #5336
Release v2.2.0: merge v2/main into main by @cliffhall in #5338
chore(fetch): bump certifi to 2026.10.23 in uv.lock (eMudhra roots removed) by @cliffhall in #5341
Release v2.2.0: merge v2/main into main (certifi lock) by @cliffhall in #5342

mcp-server-git 2026.10.28

What's Changed

docs(git): state that without --repository every reachable repository is in scope by @cliffhall in #5305
fix(git): create a branch on a detached HEAD, and from a commit-ish base by @cliffhall in #5309
fix(git): print non-ASCII paths as written and replace undecodable diff bytes by @cliffhall in #5312
fix(git): GHSA-w766-5x43-whvw by @cliffhall in #5333
chore: stamp Python CalVer versions for 2026.10.28 by @github-actions[bot] in #5336
Release v2.2.0: merge v2/main into main by @cliffhall in #5338

mcp-server-time 2026.10.28

What's Changed

fix(time): expand LOCAL_TIMEZONE in the Docker image at run time by @cliffhall in #5294
chore: stamp Python CalVer versions for 2026.10.28 by @github-actions[bot] in #5336
Release v2.2.0: merge v2/main into main by @cliffhall in #5338

Repository

What's Changed

docs: explain stdio vs Streamable HTTP in the root README by @cliffhall in #5276
fix(ci): a superseded dispatched run posts no pending status (typescript.yml, python.yml) by @cliffhall in #5281
docs(readme): use only active servers in the client config example by @cliffhall in #5280
fix(ci): start the Claude workflow only for trusted authors by @cliffhall in #5282
release:notes: credit advisory reporters and by-hand contributors in the Thanks section by @cliffhall in #5283
docs(skills): close the advisory fork's PR before publishing; keep follow-up write-ups on the card by @cliffhall in #5284
chore(scripts): clear the four CodeQL alerts in the release scripts by @cliffhall in #5287
feat(ci): alert sweep tracks advisories with no patched release by @cliffhall in #5286
fix(sdk-watch): refresh an open issue's rows and scope labels for the same target by @cliffhall in #5285
docs(client-smoke): drive the Inspector web UI with Playwright by @cliffhall in #5288

Full Changelog: v2.1.0...v2.2.0

Thanks for helping us improve

This release addresses issues and vulnerabilities reported by these community members. Thank you for taking the time to report them:

And to these contributors, whose pull requests prototyped changes that ship in this release. Under the repository's issues, not pull requests policy their PRs were closed and the changes rebuilt by the maintainers, crediting them on the issue:

@1060996408, the elicitation summary's field names, for #5209
@AbhiPra24, a fallback for streaming SSR content, for #3878
@adityachaudhary99, case-insensitive Windows allowed-path matching, for #470
@beejak, the get-env secrets warning, for #3986
@BlueX888, non-UTF-8 diff output and the tiny image's iCCP chunk, for #5193 and #5208
@Christian-Sidak, the fallback when Readability strips hidden SSR content, for #3878
@ElliotJLT, refusing autonomous fetches on a 5xx robots.txt, for #5197
@Excelius-Wang, cross-device moves, for #5188
@FOWEPJF255, the archived-servers warning, for #5211
@go165, keeping fetch off the Node readability backend and the active-servers config example, for #4199 and #5211
@he-yufeng, a Python-only readability fallback, for #4199
@isheng-eqi, 5xx handling in the robots.txt check, for #5197
@Jim1874, the Readability content fallback and restricting get-env, for #3878 and #3986
@jstar0, ignoring a final newline in tail, for #5187
@JonoGitty, timeouts and a visited-entry cap for lazy provider paths, for #4162
@Joosboy, the resource link ID mapping, for #5210
@kabishou11, branching from a detached HEAD and rejecting HTTP error responses in gzip-file-as-resource, for #5192 and #5207
@krishhgg, the pure-Python HTML simplifier and readability fallback, for #4199
@krot4u, tolerating a Windows realpath ENOENT, for #5185
@ks72, expanding LOCAL_TIMEZONE in the Docker entrypoint, for #5182
@Lubrsy706, limiting get-env to one key, for #3986
@MustafaKemal0146, redacting sensitive variables in get-env, for #3986
@nnish16, preserving root aliases from MCP roots, for #5183
@olegsa, charset detection for non-UTF-8 pages, for #5199
@simpleqt, the copy-pasted comments and JSDoc tool names, for #5210
@TanishkaMarrott, explaining how servers launch over stdio, for #521
@teddiesloco, the tail off-by-one after a final newline, for #5187
@tsurutanmen, unescaped non-ASCII paths in git_status and git_diff, for #5129
@wishhyt, the memory migration and elicitation-summary fixes, for #5203 and #5209
@yyzquwu, keeping a root's original path after realpath, for #5183
@ZhangJing-gugugaga, case-insensitive Windows path containment and the SSR content fallback, for #470 and #3878
@zuhabul, clarifying stdio server behavior, for #521