allowedDirectories only works if the path you checked is still the path you write.
On 25 October 2026, the Model Context Protocol reference servers released v2.1.0 with eight advisories across filesystem, everything, and fetch. The interesting operational detail sits one layer below the GHSA list: TypeScript servers that still carry CalVer tags will never climb to the patched 2.0.1 on a casual npm update.
Eight GHSAs across filesystem, everything and fetch
@modelcontextprotocol/server-filesystem 2.0.1 closes four path-boundary bugs. GHSA-53mr-w429-c597 is a classic TOCTOU: between the access check and the write, a parent directory can become a symlink that redirects write_file, edit_file, create_directory, or a move_file destination outside the allowed tree. Linux and macOS receive a full fix; Windows remains only partly closed, and the advisory spells out the residual exposure.
GHSA-7rgq-gccq-qphx stops the checker from stripping a trailing quote or whitespace that the later file operation still keeps, which had opened a sibling directory named after an allowed path plus that suffix. GHSA-4gxg-m5jx-9j57 restores a case-variant symlink check that had regressed in the 2026.8.31 date build on case-insensitive volumes such as default macOS. GHSA-hhwq-wxfx-cj7g makes list_directory_with_sizes inspect each entry before reading size and mtime, so a symlink inside an allowed directory no longer leaks metadata for a target outside it.
@modelcontextprotocol/server-everything 2.0.1 addresses GHSA-mvf5-2qqv-rg3c. HTTP and SSE transports now enforce Origin and drop Access-Control-Allow-Origin: *, so a page the user visits can no longer call tools such as get-env and read the results.
mcp-server-fetch 2026.10.24 ships three guards. GHSA-v38p-wf49-hx2j aligns the address check with the hostname the connection actually uses for IDNA names. GHSA-66qx-2266-pmj6 refuses NAT64 addresses in 64:ff9b::/96 that wrap private, loopback or link-local IPv4. GHSA-3jqg-r5pp-rmp2 re-checks robots.txt after every redirect, rather than only on the first URL.
Agent tool boundaries finally match the threat model operators assumed
MCP filesystem and fetch servers sit on the hottest path in coding and computer-use agents: they turn a model plan into real disk and network I/O under a short allowlist. Teams that treated allowedDirectories as a hard sandbox were already wrong on TOCTOU and check/use mismatches; the October disclosures make that concrete with named GHSAs and patched packages. The everything-server origin fix matters for anyone who left the kitchen-sink demo listening where a browser tab can reach it. Fetch's IDNA and NAT64 work closes the same class of SSRF-adjacent pivots that keep recurring in agent HTTP tools.
This release also lands in the same week as framework advisories on Strands, LangGraph, FastMCP and MLflow. The shared theme is trust placed in defaults at the agent-tool edge. Reference servers are where many fleets copy their first MCP integration, so a quiet miss on the upgrade path leaves the example code itself vulnerable.
MIT reference code; maturity is pin-and-verify, especially on Windows
The servers repository remains the public MCP reference under the project's usual open terms. Activity: tagged v2.1.0 on 25 October 2026 with coordinated package publishes on npm and PyPI. Affected filesystem and everything ranges include 1.0.0 through 2.0.0 plus date versions through 2026.8.31; fetch was affected through 2026.10.19. Maturity reading for this news: usable as a patched baseline once you are on 2.0.1 / 2026.10.24 and have re-read the Windows residual notes. Production-shaped only after you confirm your install pins those versions by string and that your Windows hosts follow the advisory's remaining mitigations.
Install 2.0.1 by name if you still carry a 2025.x or 2026.x tag
If your lockfile shows @modelcontextprotocol/server-filesystem or server-everything on any date version, run an explicit install of 2.0.1. Package managers rank semantic 2.0.1 below every 2025.x and 2026.x release, so they will keep offering the older CalVer line as "newer." Fetch users should move to mcp-server-fetch==2026.10.24. After the bump, re-run your agent harness against a fixture that tries parent-symlink swaps, trailing-quote siblings, and case-folded symlinks on macOS volumes. Windows fleets should treat the TOCTOU advisory as still live and apply the configuration workarounds the GHSA describes until a full platform fix lands.
Teams that vendor a fork of the reference servers need to cherry-pick the October hardening PRs rather than assume a tag bump of their own fork inherited them.
CalVer ranking, partial Windows closure, and demo everything-servers left open
The upgrade trap is the failure mode most likely to survive a security review that only greps for "2.0." A green CI that runs npm outdated will still prefer date tags. A second failure mode is declaring the filesystem server "done" on Windows after 2.0.1 while the advisory still lists residual TOCTOU exposure. A third is leaving everything-server's HTTP transport reachable from browser origins for local demos; the Origin check only helps once you actually upgrade. Fetch fleets that disable robots handling or pin an older certifi set for other reasons can re-open redirect and TLS edges the release tried to close.
Treat the reference servers as production dependencies
Pin the three patched package versions in every agent image that still ships the upstream filesystem, everything or fetch servers, and schedule a lockfile audit for CalVer MCP packages the same week you read the GHSAs. The open Monday question is how many coding-agent images will still resolve a 2026.8.x filesystem server two weeks after v2.1.0 because the package manager called it newer than 2.0.1.