Redis

• v2.4.0 Latest Nov 11, 2026

  ## Security fixes
  
  v2.4.0 fixes six vulnerabilities in three servers. Upgrade `@modelcontextprotocol/server-filesystem` to 2.3.0,
  and `mcp-server-git` and `mcp-server-fetch` to 2026.11.11.
  
  | Package | Affected | Fixed in |
  | --- | --- | --- |
  | `@modelcontextprotocol/server-filesystem` | all versions before 2.3.0, and date versions 2025.1.14 through 2026.8.31 | 2.3.0 |
  | `mcp-server-git` | through 2026.11.4 | 2026.11.11 |
  | `mcp-server-fetch` | through 2026.11.4 | 2026.11.11 |
  
  ### `@modelcontextprotocol/server-filesystem` 2.3.0
  
  * **Reads stay with the file that was checked** (Linux and macOS). The read tools and file resources now open a file relative to the directory that was checked, as writes already did, so a directory swapped for a symlink between the access check and the read can no longer return a file from outside the allowed directories. A FIFO, socket or device is refused rather than read. **On Windows this narrows the race without closing it**, as for writes (#5260) ([GHSA-p9cv-8g75-4xcg](https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-p9cv-8g75-4xcg))
  * **`move_file` moves only the source it checked.** A move within one device first takes the source out of its own checked directory under a fresh name, so a source directory swapped for a symlink can no longer bring an outside file into the allowed directories, where it would become readable ([GHSA-7m4x-rv66-mxhh](https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-7m4x-rv66-mxhh))
  
  ### `mcp-server-git` 2026.11.11
  
  * **A repository's own Git configuration can no longer make the server run a program.** A read-only call such as `git_status` on an untrusted repository used to run a command named in its `.git/config` (`core.fsmonitor`, `diff.external`, hooks, filter and merge drivers, signing) with the server's privileges. Every Git command now overrides those settings, and a Git older than 2.31, which would ignore the overrides, is refused ([GHSA-6hqx-gqrx-c5r2](https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-6hqx-gqrx-c5r2))
  * **`--repository` confinement covers alternate object stores, linked worktrees and links in the Git directory.** A repository inside the allowed one could read another repository's objects through `objects/info/alternates`, or pass a linked worktree's Git directory off as the allowed repository's. Both are refused, as is a symlink in a Git directory that leads outside the allowed repository. **On Windows a directory junction is not yet covered** (#5520) ([GHSA-q74p-4wrc-q7w6](https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-q74p-4wrc-q7w6))
  
  ### `mcp-server-fetch` 2026.11.11
  
  * **IPv6 site-local addresses are private.** The private-address guard read `fec0::/10` as public. It is now refused, and so is any IPv6 address outside global unicast (`2000::/3`) that does not carry an IPv4 address ([GHSA-3rxj-6jhw-qfv7](https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-3rxj-6jhw-qfv7))
  * **robots.txt is matched against the path the site will resolve**, as well as the path as written, so `//private` or `/x/../private` can no longer get past `Disallow: /private` ([GHSA-f9hh-cmx9-2f23](https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-f9hh-cmx9-2f23))
  
  ### Upgrading from a date-versioned npm release
  
  The TypeScript servers moved from date versions (2025.x, 2026.x) to semantic versions in 1.0.0. Package managers rank 2.3.0 below every 2025.x and 2026.x version, so they won't offer it as an upgrade. If you are on a date version of `@modelcontextprotocol/server-filesystem`, install 2.3.0 explicitly: `npm install @modelcontextprotocol/[email protected]`.
  
  ## Packages
  
  | Package | Version | Registry | In this release |
  | --- | --- | --- | --- |
  | `@modelcontextprotocol/server-everything` | `2.3.0` | npm | **published** |
  | `@modelcontextprotocol/server-filesystem` | `2.3.0` | npm | **published** |
  | `@modelcont

  View on GitHub ↗
• v2.3.0 Nov 4, 2026

  ## Packages
  
  | Package | Version | Registry | In this release |
  | --- | --- | --- | --- |
  | `@modelcontextprotocol/server-everything` | `2.2.1` | npm | **published** |
  | `@modelcontextprotocol/server-filesystem` | `2.2.0` | npm | **published** |
  | `@modelcontextprotocol/server-memory` | `2.1.0` | npm | **published** |
  | `@modelcontextprotocol/server-sequential-thinking` | `2.1.1` | npm | **published** |
  | `mcp-server-fetch` | `2026.11.4` | PyPI | **published** |
  | `mcp-server-git` | `2026.11.4` | PyPI | **published** |
  | `mcp-server-time` | `2026.11.4` | PyPI | **published** |
  
  Release ledger: [v2/chore/5425-release-v2.3.0](https://claude.ai/artifact/TqFXVNLvtAszdLJ1xE77ew)
  
  ## @modelcontextprotocol/server-everything 2.2.1
  
  ### What's Changed
  
  * test(everything): check every registered tool carries all four annotation hints by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5347
  * fix(everything): name resource-prompt's allowed argument values by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5350
  * everything: build the Docker image from the workspace lockfile, with a Streamable HTTP mode by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5382
  * feat(everything): add a resource collection example by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5365
  * fix(everything): stop a cancelled long-running operation by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5396
  * feat(everything): light and dark themed icons on every primitive by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5389
  * chore: version packages by @github-actions[bot] in https://github.com/modelcontextprotocol/servers/pull/5401
  * fix(everything): give gzip-file-as-resource's resource the resource icons by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5436
  * chore: version packages by @github-actions[bot] in https://github.com/modelcontextprotocol/servers/pull/5437
  * Release v2.3.0: merge v2/main into main by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5430
  
  ## @modelcontextprotocol/server-filesystem 2.2.0
  
  ### What's Changed
  
  * test(filesystem): give the real HFS+ volume test an explicit timeout by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5344
  * chore(filesystem): remove the unused glob dependency by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5351
  * feat(filesystem): set idempotentHint and destructiveHint on the read-only tools by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5353
  * fix(filesystem): return no lines for read_text_file head/tail 0 by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5377
  * fix(filesystem): show an unstattable entry's size as unknown in list_directory_with_sizes by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5378
  * fix(filesystem): name the subdirectories search_files could not read by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5355
  * fix(filesystem): say search_files matches names, not contents by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5367
  * fix(filesystem): report a dangling symlink as broken, not as a missing parent by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5380
  * fix(filesystem): do not trim an allowed directory's name after realpath by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5383
  * fix(filesystem): expand ~\ to the home directory on Windows by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5384
  * feat(filesystem): add an append_file tool by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5376
  * feat(filesystem): add a copy_file tool by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5385
  * feat(filesystem): add an optional depth to directory_tree by @cl

  View on GitHub ↗
• v2.2.0 Oct 28, 2026

  ## Security: Node.js runtime and CA certificate updates (October 2026)
  
  On October 20, 2026, eMudhra disclosed that the private keys for eight of its intermediate CA certificates could be recovered from the public certificates. On October 21, Node.js shipped [security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) that update its bundled CA certificates for the compromise and fix several unrelated high-severity runtime CVEs. On October 23, Python's `certifi` 2026.10.23 removed the eMudhra roots `emSign Root CA - C1` and `emSign ECC Root CA - C3`.
  
  **How these servers stand**
  
  - **The TypeScript servers rely on the Node.js runtime for certificate checks.** They ship no CA certificates of their own. Only `server-everything` makes outbound HTTPS requests (`gzip-file-as-resource`), and the Node.js it runs on verifies them. `server-filesystem`, `server-memory` and `server-sequential-thinking` make no network connections.
  - **`mcp-server-fetch` verifies HTTPS against the `certifi` bundle**, through `httpx`. Installing from PyPI (`uvx mcp-server-fetch`, `pip install mcp-server-fetch`) resolves the current `certifi`, 2026.10.23 or later. The repository's `fetch` Dockerfile installs from its lockfile, which this release moves to `certifi` 2026.10.23 (#5341).
  - **`mcp-server-git` and `mcp-server-time` make no network connections.**
  
  **If you run a TypeScript server from npm (`npx` or a global install)**
  
  It runs on your Node.js, which we can't update for you. Please run Node.js **24.22.1 or 26.12.1, or later**, and check with `node --version`. The packages' `engines` field accepts any Node.js 24, so npm won't warn you about an older, unpatched runtime.
  
  **If you run `mcp-server-fetch` from an existing environment**
  
  An environment created before October 23 keeps its older `certifi`. Refresh it with `uvx --refresh mcp-server-fetch`, or `pip install -U certifi`.
  
  ## Packages
  
  | Package | Version | Registry | In this release |
  | --- | --- | --- | --- |
  | `@modelcontextprotocol/server-everything` | `2.1.0` | npm | **published** |
  | `@modelcontextprotocol/server-filesystem` | `2.1.0` | npm | **published** |
  | `@modelcontextprotocol/server-memory` | `2.0.1` | npm | **published** |
  | `@modelcontextprotocol/server-sequential-thinking` | `2.0.0` | npm | unchanged |
  | `mcp-server-fetch` | `2026.10.28` | PyPI | **published** |
  | `mcp-server-git` | `2026.10.28` | PyPI | **published** |
  | `mcp-server-time` | `2026.10.28` | PyPI | **published** |
  
  Release ledger: [v2/chore/5330-release-v2.2.0](https://claude.ai/artifact/4QBpF136w3oXcAMVDRJtbe)
  
  ## @modelcontextprotocol/server-everything 2.1.0
  
  ### What's Changed
  
  * fix(everything): trigger-elicitation-request summarizes the form's own fields by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5289
  * fix(everything): fail gzip-file-as-resource on an HTTP error response by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5290
  * fix(everything): get-env masks credential-like values by default by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5293
  * fix(everything): gzip-file-as-resource refuses non-public addresses on every hop by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5295
  * fix(everything): drop the corrupt iCCP chunk from get-tiny-image's PNG by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5298
  * chore(everything): fix misleading names in get-resource-links and two JSDoc headers by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5297
  * chore: version packages by @github-actions[bot] in https://github.com/modelcontextprotocol/servers/pull/5296
  * Release v2.2.0: merge v2/main into main by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5338
  
  ## @modelcontextprotocol/server-filesystem 2.1.0
  
  ### What's Changed
  
  * fix(filesystem): accept a case-only respelling of an allowed direc

  View on GitHub ↗
• v2.1.0 Oct 25, 2026

  ## Security fixes
  
  v2.1.0 fixes eight vulnerabilities in three servers. Upgrade
  `@modelcontextprotocol/server-filesystem` and `@modelcontextprotocol/server-everything`
  to 2.0.1, and `mcp-server-fetch` to 2026.10.24.
  
  | Package | Affected | Fixed in |
  | --- | --- | --- |
  | `@modelcontextprotocol/server-filesystem` | 1.0.0 through 2.0.0, and date versions through 2026.8.31 | 2.0.1 |
  | `@modelcontextprotocol/server-everything` | 1.0.0 through 2.0.0, and date versions 2025.9.24 through 2026.8.31 | 2.0.1 |
  | `mcp-server-fetch` | through 2026.10.19 | 2026.10.24 |
  
  ### `@modelcontextprotocol/server-filesystem` 2.0.1
  
  * **Writes stay inside the directory that was checked** (Linux and macOS). A parent directory swapped for a symlink between the access check and the write can no longer redirect `write_file`, `edit_file`, `create_directory` or the `move_file` destination outside the allowed directories. **On Windows this is only partly fixed**; the advisory says what is still exposed and how to configure around it ([GHSA-53mr-w429-c597](https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-53mr-w429-c597))
  * **Paths are checked exactly as they are used.** The access check no longer strips a trailing quote or whitespace that the file operation keeps, so a sibling directory named after an allowed one with that suffix is no longer reachable ([GHSA-7rgq-gccq-qphx](https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-7rgq-gccq-qphx))
  * **A symlink spelled in a different letter case no longer passes the symlink check** for a new path on a case-insensitive volume, such as macOS's default. This was a regression in 2026.8.31 ([GHSA-4gxg-m5jx-9j57](https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-4gxg-m5jx-9j57))
  * **`list_directory_with_sizes` checks each entry before reading its size**, so a symlink inside an allowed directory no longer reveals the size and modification time of a file outside it ([GHSA-hhwq-wxfx-cj7g](https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-hhwq-wxfx-cj7g))
  
  ### `@modelcontextprotocol/server-everything` 2.0.1
  
  * **The HTTP and SSE transports refuse requests from other web origins.** They now check the `Origin` header and no longer send `Access-Control-Allow-Origin: *`, so a web page the user visits can no longer call the server's tools (such as `get-env`) or read their results ([GHSA-mvf5-2qqv-rg3c](https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-mvf5-2qqv-rg3c))
  
  ### `mcp-server-fetch` 2026.10.24
  
  * **The address check and the connection use the same host name.** For an internationalized (IDNA) host name, the server used to check one form of the name and connect to another, which could reach an internal address ([GHSA-v38p-wf49-hx2j](https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-v38p-wf49-hx2j))
  * **NAT64 addresses are judged by the IPv4 address they carry.** An address in `64:ff9b::/96` that wraps a private, loopback or link-local IPv4 address is now refused, as an IPv4-mapped one already was ([GHSA-66qx-2266-pmj6](https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-66qx-2266-pmj6))
  * **robots.txt is checked again after every redirect**, not only for the URL first requested ([GHSA-3jqg-r5pp-rmp2](https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-3jqg-r5pp-rmp2))
  
  ### Upgrading from a date-versioned npm release
  
  The TypeScript servers moved from date versions (2025.x, 2026.x) to semantic versions in 1.0.0. Package managers rank 2.0.1 below every 2025.x and 2026.x version, so they won't offer it as an upgrade. If you are on a date version, install 2.0.1 explicitly, for example `npm install @modelcontextprotocol/[email protected]`.
  
  ## Packages
  
  | Package | Version | Registry | In this release |
  | --- | --- | --- | --- |
  | `@modelcontextprotocol/server-everything` | `2.0.1` | npm | **published** |
  

  View on GitHub ↗
• v2.0.0 Oct 19, 2026

  ## Servers refactored to modern era
  This release refactors all the servers to support the modern era spec, while still answering legacy era clients as expected.
  
  ## Packages
  
  | Package | Version | Registry | In this release |
  | --- | --- | --- | --- |
  | `@modelcontextprotocol/server-everything` | `2.0.0` | npm | **published** |
  | `@modelcontextprotocol/server-filesystem` | `2.0.0` | npm | **published** |
  | `@modelcontextprotocol/server-memory` | `2.0.0` | npm | **published** |
  | `@modelcontextprotocol/server-sequential-thinking` | `2.0.0` | npm | **published** |
  | `mcp-server-fetch` | `2026.10.19` | PyPI | **published** |
  | `mcp-server-git` | `2026.10.19` | PyPI | **published** |
  | `mcp-server-time` | `2026.10.19` | PyPI | **published** |
  
  Release ledger: [v2/chore/5159-release-v2.0.0](https://claude.ai/artifact/G5uY8rqMeKgbr5xmpzSCfi)
  
  ## @modelcontextprotocol/server-everything 2.0.0
  
  ### What's Changed
  
  * chore: migrate the TypeScript servers to TS SDK v2 (codemod) by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5063
  * chore: v1.0.0 release audit, dependency fixes by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5082
  * chore: fold pending changesets into a 1.0.0 CHANGELOG for each TypeScript server by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5083
  * Reconcile v2/main with the v1.0.0 release branch: changesets, changelogs, merge of v2/release/1.0.0 by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5118
  * feat: modern-era TypeScript servers (2026-07-28 + 2025) and the new features in everything by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5131
  * ci: validate the TypeScript servers on Node 22, 24 and 26 in parallel by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5147
  * chore: version packages by @github-actions[bot] in https://github.com/modelcontextprotocol/servers/pull/5100
  * fix: raise the TypeScript servers' Node floor to 24 by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5169
  * Release v2.0.0: merge v2/main into main by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5166
  
  ## @modelcontextprotocol/server-filesystem 2.0.0
  
  ### What's Changed
  
  * chore: migrate the TypeScript servers to TS SDK v2 (codemod) by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5063
  * chore: v1.0.0 release audit, dependency fixes by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5082
  * chore: fold pending changesets into a 1.0.0 CHANGELOG for each TypeScript server by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5083
  * fix(filesystem): revoke access when a roots update leaves no valid root by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5095
  * fix(filesystem): apply only the newest roots refresh's answer by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5098
  * fix(filesystem): hold tool calls while any roots refresh is pending by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5102
  * Reconcile v2/main with the v1.0.0 release branch: changesets, changelogs, merge of v2/release/1.0.0 by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5118
  * feat: modern-era TypeScript servers (2026-07-28 + 2025) and the new features in everything by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5131
  * ci: validate the TypeScript servers on Node 22, 24 and 26 in parallel by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5147
  * chore: version packages by @github-actions[bot] in https://github.com/modelcontextprotocol/servers/pull/5100
  * fix: raise the TypeScript servers' Node floor to 24 by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5169
  * Release v2.0.0: merge v2/main into main by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/

  View on GitHub ↗

No comments yet. Sign in to start the discussion.

More Data servers

• Filesystem

  Read, write, and search files on the local filesystem with configurable access boundaries.

• Postgres

  Read-only access to a Postgres database — list tables, run SELECTs, inspect schemas.

• SQLite

  Read + write access to a local SQLite database file — full CRUD, schema management.