modelcontextprotocol/servers
Watch
1
0
Fork
You've already forked servers
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
4,091 commits 1 branch 46 tags 29 MiB
Commit graph

4,091 commits

This branch
This branch
All branches
Author SHA1 Message Date
olaservo
3f40d6e731 chore(deps): npm audit fix for high/medium security alerts 
Bumps transitive npm dependencies via `npm audit fix` (no breaking changes):
- @hono/node-server 1.19.9 -> 1.19.14 (auth bypass via encoded slashes; serveStatic bypass)
- hono 4.11.7 -> 4.12.17 (multiple: serveStatic file access, cookie/SSE injection, IP matching, etc.)
- express-rate-limit 8.2.1 -> 8.5.0 (IPv4-mapped IPv6 bypass)
- path-to-regexp -> 8.4.2 (DoS via sequential optional groups / multi-wildcard ReDoS)
- rollup 4.52.5 -> 4.60.3 (arbitrary file write via path traversal)
- minimatch (3.x, 9.x, 10.x) -> patched (multiple ReDoS)
- brace-expansion -> patched (zero-step DoS)
- ajv 8.17.1 -> 8.20.0 (ReDoS in $data option)
- qs 6.14.1 -> 6.15.1 (arrayLimit bypass DoS)
- postcss 8.5.6 -> 8.5.14 (XSS in stringify output)

Build and tests pass across all TS workspaces. Remaining 7 moderate dev-only
alerts (vitest/vite/esbuild chain) require a major vitest 4.x bump and are
out of scope here.

Supersedes the contents of dependabot PR #3377 (minimatch 10.0.1 -> 10.2.1).
 2026-05-16 08:54:35 -07:00
Alex Akimov
916fa420ec
 		Merge pull request #4110 from olaservo/security/python-deps-2026-05 
chore(deps): bump python deps to address security alerts
 2026-05-16 17:21:16 +02:00
Cliff Hall
acedea0c24
 		Merge pull request #4136 from KKonstantinov/feature/upgrade-zod-v4 
upgrade everything-server to zod v4, latest MCP sdk
 2026-05-12 10:15:09 -04:00
Konstantin Konstantinov
ef51b062f6
 		bump packages to 1.29.0 SDK 2026-05-11 15:17:39 +03:00
Konstantin Konstantinov
af15c688e4
 		upgrade everything-server to zod v4, latest MCP sdk 2026-05-11 14:29:58 +03:00
olaservo
0db9a34071 chore(deps): bump python deps to address security alerts 
Bumps vulnerable Python deps via `uv lock --upgrade-package` across the
three Python workspaces (src/git, src/fetch, src/time):

High severity
- gitpython 3.1.45 -> 3.1.49 (src/git): command injection via Git options
  bypass and unsafe `multi_options` validation (GHSA-x9j5-25mq-w6vh,
  GHSA-2gv7-q9w6-xfwm)
- lxml 5.3.0 -> 6.1.0 (src/fetch): XXE in default iterparse() and
  ETCompatXMLParser() (GHSA-pjj9-h2g6-3v7q)
- pyjwt 2.10.1 -> 2.12.1 (all): accepts unknown `crit` header extensions
  (GHSA-75c5-xw7c-p5pm)

Medium / low
- cryptography 46.0.5 -> 48.0.0 (all): buffer overflow with non-contiguous
  buffers; incomplete DNS name constraint enforcement
- python-dotenv 1.0.1/1.2.1 -> 1.2.2 (all): symlink-following arbitrary
  file overwrite in set_key
- python-multipart 0.0.22 -> 0.0.27 (all): DoS via large preamble/epilogue
- pytest 8.3.x -> 9.0.3 (all): vulnerable tmpdir handling
- pygments 2.19.2 -> 2.20.0 (src/fetch): ReDoS in GUID matcher
- requests 2.32.4 -> 2.33.1 (src/fetch): insecure temp file reuse in
  extract_zipped_paths()

All three workspaces sync cleanly and `uv run pytest` passes:
- src/fetch: 20 passed
- src/time: 38 passed
- src/git: 41 passed (35 preexisting Windows-only fixture cleanup
  errors are reproducible on main and unrelated to this change)

Supersedes/extends dependabot PR #3748 (which only bumped requests and
cryptography to 46.0.6).
 2026-05-05 06:55:44 -07:00
Cliff Hall
4503e2d12b
 		Merge pull request #3659 from ShionEria/fix/issue-3460-windows-npx-docs 
docs: add Windows npx wrapper examples
 2026-04-17 18:59:54 -04:00
Cliff Hall
7e6b7807af
 		Merge pull request #3693 from nipunnegi2/patch-2 
Fix typo in usage instructions for VS Code
 2026-04-17 18:57:30 -04:00
Cliff Hall
c3448d71b5
 		Merge pull request #3694 from nipunnegi2/patch-3 
Fix formatting in README for Docker usage note
 2026-04-17 18:57:07 -04:00
Cliff Hall
74cdb4d867
 		Merge pull request #3695 from nipunnegi2/patch-4 
Fix formatting in README for docker usage note
 2026-04-17 18:56:41 -04:00
Cliff Hall
756db5b42a
 		Merge pull request #3733 from Zandereins/docs/add-claude-md 
docs: add root CLAUDE.md and fix AGENTS.md typo
 2026-04-17 18:50:57 -04:00
Cliff Hall
bb0a1893e7
 		Merge pull request #3877 from Chelebii/docs-3132-sequentialthinking-usage 
docs: clarify sequentialthinking usage and add examples
 2026-04-17 18:44:10 -04:00
Arif Celebi
5d146b379e
 		Merge branch 'main' into docs-3132-sequentialthinking-usage 2026-04-15 10:36:19 +01:00
Cliff Hall
d5bfe349af
 		Merge pull request #3950 from olaservo/retire-third-party-server-list 
Retire third-party server list in favor of MCP Registry
 2026-04-14 11:12:18 -04:00
olaservo
5914f61340 docs: retire third-party server list in favor of MCP Registry 
The Third-Party Servers section (Official Integrations + Community
Servers) has been superseded by the MCP Registry at
https://registry.modelcontextprotocol.io/. The README already carried a
deprecation note and CONTRIBUTING.md froze new additions. This removes
the list, updates CONTRIBUTING.md to describe the new state, and
refreshes the readme-pr-check workflow's bot comment.
 2026-04-14 08:05:23 -07:00
Arif Celebi
bae042b4f2 docs: clarify sequentialthinking usage and add examples 2026-04-08 23:49:45 +01:00
Zandereins
6e320090c0 docs: add root CLAUDE.md and fix AGENTS.md typo 
Add a root CLAUDE.md that covers the full monorepo:
- Monorepo structure (7 servers, 4 TS + 3 Python)
- Build, test, and lint commands for both stacks
- Code style conventions
- Contributing guidelines summary
- CI/CD pipeline overview
- MCP protocol reference pointers

Fix typo in src/everything/AGENTS.md:
- `start:stremableHttp` → `start:streamableHttp`

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-27 14:37:53 +01:00
Nipun Negi
c104a61f87
 		Fix formatting in README for docker usage note 2026-03-24 12:08:13 +05:30
Nipun Negi
7a8c25d393
 		Fix formatting in README for Docker usage note 2026-03-24 12:06:24 +05:30
Nipun Negi
5150a95309
 		Fix typo in usage instructions for VS Code 2026-03-24 12:03:31 +05:30
ShionElia
e21dbea731 docs: add Windows npx wrapper examples 2026-03-21 04:10:32 +00:00
Arif Celebi
f4244583a6
 		fix(fetch): refresh uv lockfile (#3598) 2026-03-17 07:21:11 -07:00
Arif Celebi
b60eca1b3b
 		fix(filesystem): ensure bare Windows drive letters normalize to root (#3434) 
fix(filesystem): ensure bare Windows drive letters normalize to root

Appends path.sep to bare drive letters (e.g. "C:") before calling path.normalize(), preventing them from normalizing to "C:." (current directory on drive) instead of "C:\" (drive root). Includes test coverage with platform mocking.

Fixes #3418
 2026-03-16 12:12:00 -07:00
Niels Kaspers
1cdf806d21
 		fix(sequential-thinking): use z.coerce for number and boolean params (#3533) 
fix(sequential-thinking): use z.coerce for number and safe preprocess for boolean params

Uses z.coerce.number() for number fields and a z.preprocess() helper for boolean fields to handle string-typed parameters from LLM clients. The preprocess approach correctly handles "false" → false, avoiding the z.coerce.boolean() footgun where Boolean("false") === true.

Fixes #3428
 2026-03-15 10:09:04 -07:00
Supun Geethanjana Jayasinghe
c7e0c7e730
 		add tools | 3573 (#3589) 
feat(git): add tool annotations

Adds MCP ToolAnnotations to all 12 git server tools, marking read-only operations (status, diff, log, show, branch) and distinguishing destructive (reset) from non-destructive write operations (add, commit, create_branch, checkout).

Fixes #3573
 2026-03-15 09:05:24 -07:00
Elliot
ae40ec239d
 		fix(git): add missing argument injection guards to git_show, git_create_branch, git_log, and git_branch (#3545) 
fix(git): add missing argument injection guards

Extends existing startswith("-") input validation to git_show, git_create_branch, git_log, and git_branch, preventing user-supplied values from being interpreted as CLI flags by GitPython's subprocess calls to git.
 2026-03-15 09:04:24 -07:00
Niels Kaspers
81f8301cd2
 		feat(time): add tool annotations to get_current_time and convert_time (#3574) (#3581) 
feat(time): add tool annotations

Adds MCP ToolAnnotations to both time server tools (get_current_time, convert_time). Both are read-only, non-destructive, idempotent, and closed-world.

Fixes #3574
 2026-03-15 08:51:02 -07:00
Niels Kaspers
c2ee97e792
 		feat(sequential-thinking): add tool annotations (#3534) 
feat(sequential-thinking): add tool annotations

Adds MCP ToolAnnotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to the sequential-thinking tool, bringing it in line with the annotation pattern established by the filesystem server.

Fixes #3403
 2026-03-15 08:50:08 -07:00
Anshul Garg
83b22050b8
 		fix(fetch): handle malformed input without crashing (#3515) 
fix(fetch): handle malformed input without crashing

Changes `raise_exceptions=True` to `raise_exceptions=False` in the fetch server's `Server.run()` call, preventing the server from crashing on malformed JSON-RPC input. This aligns with the SDK's intended default behavior and is consistent with other reference servers.

Fixes #3359
 2026-03-15 08:35:30 -07:00
Ola Hungerford
a97aba19eb
 		Merge pull request #3293 from thecaptain789/fix-httpx-proxy-arg 
fix(fetch): update to httpx 0.28+ proxy parameter
 2026-03-07 12:38:04 -07:00
Ola Hungerford
ad3e660cc1
 		Merge pull request #3252 from dotsetgreg/fix/session-resource-reregistration 
fix(everything): allow re-registration of session resources
 2026-03-07 12:32:28 -07:00
Ola Hungerford
6d977ddc62
 		Merge pull request #3297 from DukeDeSouth/fix/memory-open-nodes-relations 
fix(memory): return relations connected to requested nodes in openNodes/searchNodes
 2026-03-07 12:25:27 -07:00
Ola Hungerford
72efc42976
 		Merge pull request #3230 from nulone/fix/filesystem-move-file-destructive-hint 
fix(filesystem): mark move_file as destructive operation
 2026-02-28 14:17:21 -07:00
Ola Hungerford
04cce79b4c
 		Merge pull request #3398 from modelcontextprotocol/localden/servers 
Update README.md
 2026-02-24 18:38:19 -07:00
Den Delimarsky
599b170e9d
 		Update README.md 2026-02-24 17:32:52 -08:00
David Wong
0e06979028
 		add figma to official integrations list (#3363) 2026-02-24 17:35:23 +00:00
Ola Hungerford
a83b1451c5
 		Merge pull request #3254 from wingding12/fix/filesystem-macos-symlink-path-resolution 
fix(filesystem): resolve symlinked allowed directories to both forms
 2026-02-19 07:36:47 -07:00
Ellis Shang
1b96551ef0
 		fix(filesystem): use fileURLToPath for Windows absolute path parsing (#3205) 2026-02-19 05:52:11 -07:00
Ola Hungerford
6a914b9db8
 		Merge pull request #3350 from modelcontextprotocol/localden/sec-doc-update 
Update SECURITY.md to use GitHub Security Advisories
 2026-02-18 19:58:50 -07:00
Den Delimarsky
5e3735d081 Update SECURITY.md to use GitHub Security Advisories 2026-02-18 20:51:23 +00:00
Cliff Hall
618cf4867b
 		Merge pull request #2609 from modelcontextprotocol/claude/issue-2526-20250824-0240 
fix: resolve relative paths against allowed directories instead of process.cwd()
 2026-02-11 09:57:53 -05:00
Koichi ITO
173d991153
 		Merge pull request #3320 from modelcontextprotocol/dependabot/uv/src/fetch/uv-7997262317 
Bump the uv group across 3 directories with 1 update
 2026-02-11 16:59:41 +09:00
dependabot[bot]
e3ea3c8b7f
 		Bump the uv group across 3 directories with 1 update 
Bumps the uv group with 1 update in the /src/fetch directory: [cryptography](https://github.com/pyca/cryptography).
Bumps the uv group with 1 update in the /src/git directory: [cryptography](https://github.com/pyca/cryptography).
Bumps the uv group with 1 update in the /src/time directory: [cryptography](https://github.com/pyca/cryptography).


Updates `cryptography` from 46.0.3 to 46.0.5
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/46.0.3...46.0.5)

Updates `cryptography` from 46.0.3 to 46.0.5
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/46.0.3...46.0.5)

Updates `cryptography` from 46.0.3 to 46.0.5
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/46.0.3...46.0.5)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 46.0.5
  dependency-type: indirect
  dependency-group: uv
- dependency-name: cryptography
  dependency-version: 46.0.5
  dependency-type: indirect
  dependency-group: uv
- dependency-name: cryptography
  dependency-version: 46.0.5
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-02-11 02:51:37 +00:00
Ola Hungerford
70c549be69
 		Merge pull request #3306 from shuklaham/time_doc_update 
docs(time): add explicit uvx command to installation section
 2026-02-09 09:43:46 -07:00
Shubham Shukla
26c0d57d57 docs(time): add explicit uvx command to installation section 
The uv installation section mentioned using uvx but didn't show the
actual command, unlike the PIP section which shows both install and run
commands. This adds the missing `uvx mcp-server-time` command.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-02-08 22:23:30 -08:00
olaservo
87a996b548 fix(filesystem): run npm audit fix to resolve qs vulnerability 
Fixes high-severity qs DoS vulnerability (GHSA-6rw7-vpxm-498p).
Remaining moderate-severity issues are in dev dependencies
(esbuild/vite/vitest) and require a breaking vitest v2->v4 upgrade.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-02-07 18:52:47 -07:00
Cliff Hall
3921f5c041
 		Merge branch 'main' into claude/issue-2526-20250824-0240 2026-02-07 16:57:16 -05:00
Ola Hungerford
ccf675184e
 		Merge pull request #3236 from nielskaspers/add-everything-server-tests 
Add Vitest tests for Everything Server
 2026-02-07 10:14:57 -07:00
DukeDeSouth
ca7ea2253e fix(memory): return relations connected to requested nodes in openNodes/searchNodes 
Previously, `openNodes` and `searchNodes` only returned relations where
BOTH endpoints were in the result set (using `&&`). This silently
dropped all relations to/from nodes outside the set — making it
impossible to discover a node's connections without calling `read_graph`
and filtering the entire dataset client-side.

Changed the filter from `&&` to `||` so that any relation with at least
one endpoint in the result set is included. This matches the expected
graph-query semantics: when you open a node, you should see all its
edges, not just edges to other opened nodes.

Fixes #3137

Tests updated and new cases added covering:
- Outgoing relations to nodes not in the open set
- Incoming relations from nodes not in the open set
- Relations connected to a single opened node
- searchNodes returning outgoing relations to unmatched entities

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-02-06 20:14:27 -05:00
Niels Kaspers
cd20aee6b4
 		Add experimental.tasks mock for new task-based tools 
The upstream main added simulate-research-query and async tools that
use server.experimental.tasks.registerToolTask. Update mock servers
to include this API.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-02-06 23:21:49 +02:00