servers v2.3.0

Release v2.3.0 of the Model Context Protocol reference servers gives operators new ways to limit what two of them can touch. MCP is a protocol for giving language models controlled access to tools and data sources through servers. The repository README describes its servers as reference implementations maintained by the MCP steering group, meant as educational examples rather than production-ready solutions. The release notes publish new versions of seven packages, including the filesystem, fetch, git, memory and time servers.

The filesystem server, which gives a model access to directories the operator names, gains a `--read-only` flag. Its README says the server then registers only tools annotated as read-only, so write tools such as `write_file` and `edit_file` are never listed and calls to them fail, whatever the client allows. A second flag, `--confine-roots`, covers older 2025-era clients that support Roots, an MCP feature where the client tells the server which directories it wants to work in. Normally those Roots replace the directories given on the command line; with the flag, they can only narrow them.

The fetch server, which retrieves web content for a model, adds `--allowed-hosts`. Its README says the list is checked before every request, including robots.txt checks and each redirect hop, and a request to any other host is refused before it is sent. Read-only mode covers every allowed directory, so protecting only some of them means running two servers, and the filesystem README recommends operating-system permissions as well where that matters. The release also adds tools such as `append_file`, `copy_file` and `git_merge`.