Intel / repo

servers v2.1.0

Source: github.com
Author: cliffhall
Date: Published Oct 25, 2026

From the Daily Brief

The Model Context Protocol project shipped servers v2.1.0, a security release that patches eight vulnerabilities across three of its reference servers: filesystem, everything, and fetch. The most serious class is a symlink race. The server checked that a path sat inside an allowed directory, then wrote to a path that a swapped symlink had redirected, so writes escaped the directories the operator had permitted. A related set of bugs came from path checks that validated one path while the server used a different one. The fixed versions are 2.0.1 for the filesystem and everything servers and 2026.10.24 for fetch. The release notes say Windows is only partly fixed, so the directory boundary still cannot be fully relied on there. For anyone who hands an agent a filesystem server with a restricted set of folders, the restriction was the safety property, and these bugs broke it. Upgrading closes the known paths on Linux and macOS. On Windows, the honest reading of the release is that the boundary is weaker than the configuration suggests.

Read the 2026-10-25 Brief →

Key takeaways · AI-distilled

Users on date-versioned npm releases must upgrade by hand: the TypeScript servers switched to semantic versions in 1.0.0, so package managers rank 2.0.1 below every 2025.x and 2026.x version and will not offer it. The notes say to install @2.0.1 explicitly.
Before 2.0.1, server-everything's HTTP and SSE transports sent Access-Control-Allow-Origin: * without checking the Origin header, so any web page the user visited could call its tools, such as get-env, and read the results. It now checks Origin.
-server-fetch checked one form of an internationalized (IDNA) host name but connected to another, which could reach an internal address. It now also refuses NAT64 addresses wrapping private, loopback or link-local IPv4, and rechecks robots.txt after every redirect.
server-filesystem's access check stripped a trailing quote or whitespace that the file operation kept, so a sibling directory named after an allowed one plus that suffix was reachable. 2.0.1 checks paths exactly as they are used.
In server-filesystem, list_directory_with_sizes now checks each entry before reading its size, so a symlink inside an allowed directory no longer reveals the size and modification time of a file outside it.

Terms in this piece · Glossary

MCP — The Model Context Protocol — an open standard that lets any AI assistant plug into any tool or data source without custom integration code.

Read the source github.com