GitHub (modelcontextprotocol/servers) · Oct 25, 2026 · 2:15 PM

Official MCP filesystem, fetch and everything servers patch eight vulnerabilities in v2.1.0

Released Oct 25, the fixes stop symlink and path tricks that let the filesystem server write or peek outside allowed directories (Windows only partly fixed), block other web origins from calling the everything server over HTTP, and close SSRF gaps in fetch via IDNA host names and NAT64 addresses. Package managers rank 2.0.1 below old date versions, so install it explicitly, e.g. npm install @modelcontextprotocol/[email protected], and update mcp-server-fetch to 2026.10.24.

Read at github.com

More news

View all

Major US banks start blocking third-party AI agents that log in to customer accounts

Axios reports Morgan Stanley has begun blocking third party agents, and JPMorgan, Bank of America and Citi are restricting them, after banks found agents using customers' own credentials and sometimes acting beyond user instructions. Most banks are moving toward read only access, so if your agent touches finances, plan on open banking APIs rather than a user's login…

Axios 13 minutes ago

Showboard lets Claude Code, Codex or Cursor answer data questions with dashboards from read-only SQL

The MIT licensed MCP server takes your agent's SQL and a short layout, runs each query read only against Postgres, SQLite, Excel or CSV, and draws charts, tables and headline numbers in a browser or a pane beside your terminal, with every number showing its query. Version 0.4.1 (Oct 22) adds a Claude desktop extension; install in Claude Code with /plugin install showboard marketplace rohanbeingsocial/showboard , and treat the author's 2.7x cost saving as a single dataset test (benchmark breakdown)…

GitHub (rohanbeingsocial/showboard) 2 hours ago

stalemap tells your coding agent which dependencies changed after its training cutoff

The MIT licensed tool diffs .d.ts files and changelogs for JS/TS deps newer than your model's cutoff, writes ranked notes into AGENTS.md or CLAUDE.md , type checks after each edit, and exposes a search changes MCP tool for Claude Code, Cursor, Codex or OpenCode. It's early and maintained by one person; try it with npx stalemap (benchmark)…

GitHub (Umair/stalemap) 3 hours ago

KRAFTON releases Raon-1 mini preview, an Apache-2.0 30B-A4B MoE model for agentic tasks

The PUBG maker's AI team trained the 30B total, 4B active mixture of experts model from scratch for Korean and English chat and tool calling agents, and ships NVFP4 (vLLM, single GPU), MLX and GGUF builds alongside the main weights. It's a gated preview with automatic approval, so specs and results may change before the final release, and the hosted API and playground fall under separate terms…

Hugging Face (KRAFTON) 4 hours ago

LangGraph SDK 0.4.9 lets you set per-thread run priority and fairness groups (beta)

Released Oct 23, a new Priority class lets you register an assign function in langgraph.json that gives each thread a priority and a fairness group (say, premium users first, grouped by org); the server calls it on a thread's first run and keeps the result for later runs. It's a beta API and needs LangGraph CLI 0.4.38+ (reference)…

GitHub (langchain-ai/langgraph) 5 hours ago

Spotted something we missed? Start a thread.