github modelcontextprotocol/servers v2.4.0
on GitHub

47 minutes ago

Security fixes

v2.4.0 fixes six vulnerabilities in three servers. Upgrade @modelcontextprotocol/server-filesystem to 2.3.0,
and mcp-server-git and mcp-server-fetch to 2026.11.11.

Package Affected Fixed in
@modelcontextprotocol/server-filesystem all versions before 2.3.0, and date versions 2025.1.14 through 2026.8.31 2.3.0
mcp-server-git through 2026.11.4 2026.11.11
mcp-server-fetch through 2026.11.4 2026.11.11

@modelcontextprotocol/server-filesystem 2.3.0

  • Reads stay with the file that was checked (Linux and macOS). The read tools and file resources now open a file relative to the directory that was checked, as writes already did, so a directory swapped for a symlink between the access check and the read can no longer return a file from outside the allowed directories. A FIFO, socket or device is refused rather than read. On Windows this narrows the race without closing it, as for writes (#5260) (GHSA-p9cv-8g75-4xcg)
  • move_file moves only the source it checked. A move within one device first takes the source out of its own checked directory under a fresh name, so a source directory swapped for a symlink can no longer bring an outside file into the allowed directories, where it would become readable (GHSA-7m4x-rv66-mxhh)

mcp-server-git 2026.11.11

  • A repository's own Git configuration can no longer make the server run a program. A read-only call such as git_status on an untrusted repository used to run a command named in its .git/config (core.fsmonitor, diff.external, hooks, filter and merge drivers, signing) with the server's privileges. Every Git command now overrides those settings, and a Git older than 2.31, which would ignore the overrides, is refused (GHSA-6hqx-gqrx-c5r2)
  • --repository confinement covers alternate object stores, linked worktrees and links in the Git directory. A repository inside the allowed one could read another repository's objects through objects/info/alternates, or pass a linked worktree's Git directory off as the allowed repository's. Both are refused, as is a symlink in a Git directory that leads outside the allowed repository. On Windows a directory junction is not yet covered (#5520) (GHSA-q74p-4wrc-q7w6)

mcp-server-fetch 2026.11.11

  • IPv6 site-local addresses are private. The private-address guard read fec0::/10 as public. It is now refused, and so is any IPv6 address outside global unicast (2000::/3) that does not carry an IPv4 address (GHSA-3rxj-6jhw-qfv7)
  • robots.txt is matched against the path the site will resolve, as well as the path as written, so //private or /x/../private can no longer get past Disallow: /private (GHSA-f9hh-cmx9-2f23)

Upgrading from a date-versioned npm release

The TypeScript servers moved from date versions (2025.x, 2026.x) to semantic versions in 1.0.0. Package managers rank 2.3.0 below every 2025.x and 2026.x version, so they won't offer it as an upgrade. If you are on a date version of @modelcontextprotocol/server-filesystem, install 2.3.0 explicitly: npm install @modelcontextprotocol/server-filesystem@2.3.0.

Packages

Package Version Registry In this release
@modelcontextprotocol/server-everything 2.3.0 npm published
@modelcontextprotocol/server-filesystem 2.3.0 npm published
@modelcontextprotocol/server-memory 2.1.1 npm published
@modelcontextprotocol/server-sequential-thinking 2.1.1 npm unchanged
mcp-server-fetch 2026.11.11 PyPI published
mcp-server-git 2026.11.11 PyPI published
mcp-server-time 2026.11.11 PyPI published

Release ledger: v2/chore/5509-release-v2.4.0

@modelcontextprotocol/server-everything 2.3.0

What's Changed

  • fix(everything): count tasks/update answers in UTF-8 bytes by @cliffhall in #5449
  • everything: bind the HTTP transports to loopback by default, with HOST to widen by @cliffhall in #5452
  • feat: describe every tool input property (#3669) by @cliffhall in #5475
  • chore(deps): monthly dependency refresh (November 2026) by @cliffhall in #5476
  • fix(docker): run every server image as its non-root user by @cliffhall in #5473
  • chore(everything): drop the unused jszip dependency by @cliffhall in #5478
  • chore: version packages by @github-actions[bot] in #5470
  • Release v2.4.0: merge v2/main into main by @cliffhall in #5518

@modelcontextprotocol/server-filesystem 2.3.0

What's Changed

  • chore(docker): build filesystem, memory and sequentialthinking from the workspace lockfile by @cliffhall in #5469
  • feat: describe every tool input property (#3669) by @cliffhall in #5475
  • feat(filesystem, memory): say when to use each list and delete tool by @cliffhall in #5460
  • fix(docker): run every server image as its non-root user by @cliffhall in #5473
  • fix(filesystem): read search_files excludePatterns like directory_tree by @cliffhall in #5446
  • fix(filesystem): an excludePatterns glob ending in "/**" prunes the directory it names by @cliffhall in #5456
  • fix(filesystem): match edit_file oldText that ends with a newline by @cliffhall in #5447
  • fix(filesystem): report a missing parent directory, not a raw chdir error by @cliffhall in #5448
  • feat(filesystem): refuse NTFS alternate-data-stream paths on Windows by @cliffhall in #5450
  • feat(filesystem): refuse Windows device names and trailing dots/spaces in paths by @cliffhall in #5458
  • filesystem: per-directory read-only access with --read-only-dir by @cliffhall in #5451
  • fix(filesystem): GHSA-p9cv-8g75-4xcg by @cliffhall in #5516
  • chore: version packages by @github-actions[bot] in #5470
  • Release v2.4.0: merge v2/main into main by @cliffhall in #5518

@modelcontextprotocol/server-memory 2.1.1

What's Changed

  • chore(docker): build filesystem, memory and sequentialthinking from the workspace lockfile by @cliffhall in #5469
  • feat: describe every tool input property (#3669) by @cliffhall in #5475
  • feat(filesystem, memory): say when to use each list and delete tool by @cliffhall in #5460
  • fix(memory): stop the lock heartbeat refreshing a lock it no longer owns by @cliffhall in #5462
  • docs(memory): give Docker upgrade steps that keep the container working by @cliffhall in #5474
  • fix(docker): run every server image as its non-root user by @cliffhall in #5473
  • chore: version packages by @github-actions[bot] in #5470
  • Release v2.4.0: merge v2/main into main by @cliffhall in #5518

mcp-server-fetch 2026.11.11

What's Changed

mcp-server-git 2026.11.11

What's Changed

mcp-server-time 2026.11.11

What's Changed

  • docs(git, time): make the Zed configuration snippets valid JSON by @cliffhall in #5464
  • chore(deps): monthly dependency refresh (November 2026) by @cliffhall in #5476
  • fix(docker): run every server image as its non-root user by @cliffhall in #5473
  • chore(python): adopt ruff 0.17 and clear its new lint findings by @cliffhall in #5479
  • chore: stamp Python CalVer versions for 2026.11.11 by @github-actions[bot] in #5510
  • Release v2.4.0: merge v2/main into main by @cliffhall in #5518

Repository

What's Changed

  • docs: fix alt text and dead links in README and ADDITIONAL.md by @cliffhall in #5467
  • chore(ci): diff each changed server's MCP interface, for every server by @cliffhall in #5459
  • chore(deps): override minimatch to ^11.0.1 for the lint tooling by @cliffhall in #5507

Full Changelog: v2.3.0...v2.4.0

Thanks for helping us improve

This release addresses issues and vulnerabilities reported by these community members. Thank you for taking the time to report them:

And to these contributors, whose pull requests prototyped changes that ship in this release. Under the repository's issues, not pull requests policy their PRs were closed and the changes rebuilt by the maintainers, crediting them on the issue:

Check out latest releases or
releases around modelcontextprotocol/servers v2.4.0

Don't miss a new servers release

NewReleases is sending notifications on new releases.

Get notifications