Source: github.com/modelcontextprotocol/servers/releases/tag/v2.2.0
The release updates several packages: @modelcontextprotocol/server-everything 2.1.0, server-filesystem 2.1.0, server-memory 2.0.1 and server-sequential-thinking 2.0.0 on npm, plus mcp-server-fetch, mcp-server-git and mcp-server-time at 2026.10.28 on PyPI. The filesystem server now reports hard-link counts in get_file_info and copies files instead of failing when a move crosses devices. The fetch server adds a --no-readability-js flag and refuses autonomous fetches when robots.txt returns a 5xx error.
Other fixes include masking credential-like values in get-env by default and refusing non-public addresses on every hop in gzip-file-as-resource. The memory server now keeps unmodelled fields on stored records across writes.
The maintainers also address a certificate issue: eMudhra disclosed on October 20 that private keys for eight intermediate CA certificates could be recovered, and Node.js shipped security releases on October 21 that update its bundled CA certificates. Python's certifi 2026.10.23 removed two eMudhra roots, and this release moves the fetch Dockerfile's lockfile to that version. Users running TypeScript servers from npm should run Node.js 24.22.1 or 26.12.1 or later, since the packages cannot update Node.js for them.
Why it matters if you build agents
Developers who launch these servers through npx or uvx should check their Node.js version and refresh existing Python environments, because older certifi bundles stay in place until they are updated. Agents that fetch pages with mcp-server-fetch will now get refusals for robots.txt 5xx responses and IPv4-compatible IPv6 addresses, so retry logic may need review. Filesystem tools now handle cross-device moves, which removes a common failure in agent-driven file operations.
Get stories like this every weekday
One short email with the day's agent tooling news.