On Oct 25 (UTC) the official Model Context Protocol servers repo shipped v2.1.0, fixing eight vulnerabilities in three reference servers: symlink races, trailing quote/whitespace path bypasses and case-insensitive symlink bypasses in filesystem; cross-origin calls over HTTP/SSE in everything; and IDNA host-name and NAT64 internal-address reachability plus robots.txt not rechecked after redirects in fetch. The maintainers warn that npm users still on date versions (2025.x/2026.x) will not be offered the upgrade and must install 2.0.1 explicitly, and that the filesystem write issue is only partly fixed on Windows.
Key Takeaways
- ✓Eight vulnerabilities fixed across three servers (release notes)
- ✓filesystem, 4 fixes: symlink race on writes, trailing quote/whitespace bypass, case-insensitive symlink bypass, list_directory_with_sizes leaking metadata outside allowed dirs
- ✓everything, 1 fix: HTTP/SSE transports no longer send
Access-Control-Allow-Origin: *, so web pages can no longer call tools likeget-env - ✓fetch, 3 fixes: IDNA host-name check vs. connection mismatch, NAT64-wrapped private IPv4, robots.txt not rechecked after redirects
- ✓Date-versioned npm installs must run
npm install @modelcontextprotocol/server-filesystem@2.0.1explicitly; Windows is only partly fixed
Key Decision Metrics at a Glance
Turn your technical choice into a development budget
Compare 40 dev plans & simulate token costs vs $20/mo subscriptions
Project Links & Resources
Direct AccessIn-Depth Technical Analysis
Background and pain point
The filesystem, fetch and everything servers in the official MCP servers repo are often the first reference implementations people wire into Claude Code, Cursor and other clients, and many agents use them directly for file access and web fetching. Boundary bugs here let a web page or a crafted directory push an agent outside its allowed files or onto internal addresses.
What changed under the hood
v2.1.0 makes each check match what is actually used. filesystem stops a parent directory swapped for a symlink from redirecting writes, no longer strips a trailing quote or whitespace during the access check, and catches symlinks spelled in a different letter case. everything's HTTP/SSE transports now check the Origin header and drop wildcard CORS. fetch checks and connects with the same host name, judges NAT64 addresses by the IPv4 they carry, and rechecks robots.txt after every redirect.
Benchmarks
This is a security release with no performance numbers. The notes list eight GitHub security advisories but give no CVSS scores, and state that the filesystem write issue is only partly fixed on Windows.
How to upgrade
The TypeScript servers switched to semantic versions in 1.0.0, so package managers rank 2.0.1 below every 2025.x and 2026.x date version and will not offer it. Run npm install @modelcontextprotocol/server-filesystem@2.0.1 explicitly (same for everything), and upgrade Python fetch to mcp-server-fetch==2026.10.24. On Windows, follow the advisory's configuration guidance.
Benchmark side-by-side against alternatives, or calculate monthly token cost vs subscription break-even.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.