modelcontextprotocol/servers
Watch
1
0
Fork
You've already forked servers
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
4,108 commits 1 branch 46 tags 29 MiB
Commit graph

4,108 commits

This branch
This branch
All branches
Author SHA1 Message Date
GitHub Actions
0e5f1582b8 Automatic update of packages 2026.6.3 2026-06-04 01:19:41 +00:00
Yash Shah
64b1cb0208
 		feat(memory): add tool annotations to all knowledge graph tools (#3874) 
Add MCP ToolAnnotations to all 9 tools in the memory server, matching
the annotation coverage already present in server-filesystem, server-git,
server-time, and server-sequential-thinking.

- Read tools (read_graph, search_nodes, open_nodes): read-only, idempotent
- Write tools (create_entities, create_relations, add_observations): non-destructive
- Delete tools (delete_entities, delete_observations, delete_relations): destructive, idempotent
- All tools: openWorldHint=false (local JSONL file operations only)

Co-authored-by: Ola Hungerford <olahungerford@gmail.com>
 2026-05-30 11:35:20 -07:00
Alex Akimov
9bade64fce
 		Move a list of frameworks and resources to a separate md file to make README more readable and lightweight (#4255) 
* Moving frameworks and resources out of README

* Add a backlink to Additional from Readme
 2026-05-30 09:44:47 -07:00
Krish Garg
00ce9cf134
 		fix(filesystem): preserve literal dollar replacements (#4225) 
Co-authored-by: Ola Hungerford <olahungerford@gmail.com>
 2026-05-29 21:27:03 -07:00
Alex Akimov
ce3b44e21b
 		Merge pull request #4240 from adityasingh2400/fix-time-tool-description 
Fix grammar in time server get_current_time description
 2026-05-27 11:45:22 +02:00
Aditya Singh
6abf04eef1 Fix grammar in time server get_current_time tool description 2026-05-24 12:57:04 -07:00
Alex Akimov
b1e1eb1a55
 		Merge pull request #3246 from olaservo/fix/tool-annotations 
feat(everything): add tool-level annotations to get-annotated-message
 2026-05-17 19:59:27 +02:00
Alex Akimov
97ba6b3a65
 		Merge pull request #4109 from olaservo/security/npm-audit-fix-2026-05 
chore(deps): npm audit fix for high/medium security alerts
 2026-05-16 18:06:24 +02:00
olaservo
3f40d6e731 chore(deps): npm audit fix for high/medium security alerts 
Bumps transitive npm dependencies via `npm audit fix` (no breaking changes):
- @hono/node-server 1.19.9 -> 1.19.14 (auth bypass via encoded slashes; serveStatic bypass)
- hono 4.11.7 -> 4.12.17 (multiple: serveStatic file access, cookie/SSE injection, IP matching, etc.)
- express-rate-limit 8.2.1 -> 8.5.0 (IPv4-mapped IPv6 bypass)
- path-to-regexp -> 8.4.2 (DoS via sequential optional groups / multi-wildcard ReDoS)
- rollup 4.52.5 -> 4.60.3 (arbitrary file write via path traversal)
- minimatch (3.x, 9.x, 10.x) -> patched (multiple ReDoS)
- brace-expansion -> patched (zero-step DoS)
- ajv 8.17.1 -> 8.20.0 (ReDoS in $data option)
- qs 6.14.1 -> 6.15.1 (arrayLimit bypass DoS)
- postcss 8.5.6 -> 8.5.14 (XSS in stringify output)

Build and tests pass across all TS workspaces. Remaining 7 moderate dev-only
alerts (vitest/vite/esbuild chain) require a major vitest 4.x bump and are
out of scope here.

Supersedes the contents of dependabot PR #3377 (minimatch 10.0.1 -> 10.2.1).
 2026-05-16 08:54:35 -07:00
Alex Akimov
916fa420ec
 		Merge pull request #4110 from olaservo/security/python-deps-2026-05 
chore(deps): bump python deps to address security alerts
 2026-05-16 17:21:16 +02:00
Cliff Hall
acedea0c24
 		Merge pull request #4136 from KKonstantinov/feature/upgrade-zod-v4 
upgrade everything-server to zod v4, latest MCP sdk
 2026-05-12 10:15:09 -04:00
Konstantin Konstantinov
ef51b062f6
 		bump packages to 1.29.0 SDK 2026-05-11 15:17:39 +03:00
Konstantin Konstantinov
af15c688e4
 		upgrade everything-server to zod v4, latest MCP sdk 2026-05-11 14:29:58 +03:00
olaservo
0db9a34071 chore(deps): bump python deps to address security alerts 
Bumps vulnerable Python deps via `uv lock --upgrade-package` across the
three Python workspaces (src/git, src/fetch, src/time):

High severity
- gitpython 3.1.45 -> 3.1.49 (src/git): command injection via Git options
  bypass and unsafe `multi_options` validation (GHSA-x9j5-25mq-w6vh,
  GHSA-2gv7-q9w6-xfwm)
- lxml 5.3.0 -> 6.1.0 (src/fetch): XXE in default iterparse() and
  ETCompatXMLParser() (GHSA-pjj9-h2g6-3v7q)
- pyjwt 2.10.1 -> 2.12.1 (all): accepts unknown `crit` header extensions
  (GHSA-75c5-xw7c-p5pm)

Medium / low
- cryptography 46.0.5 -> 48.0.0 (all): buffer overflow with non-contiguous
  buffers; incomplete DNS name constraint enforcement
- python-dotenv 1.0.1/1.2.1 -> 1.2.2 (all): symlink-following arbitrary
  file overwrite in set_key
- python-multipart 0.0.22 -> 0.0.27 (all): DoS via large preamble/epilogue
- pytest 8.3.x -> 9.0.3 (all): vulnerable tmpdir handling
- pygments 2.19.2 -> 2.20.0 (src/fetch): ReDoS in GUID matcher
- requests 2.32.4 -> 2.33.1 (src/fetch): insecure temp file reuse in
  extract_zipped_paths()

All three workspaces sync cleanly and `uv run pytest` passes:
- src/fetch: 20 passed
- src/time: 38 passed
- src/git: 41 passed (35 preexisting Windows-only fixture cleanup
  errors are reproducible on main and unrelated to this change)

Supersedes/extends dependabot PR #3748 (which only bumped requests and
cryptography to 46.0.6).
 2026-05-05 06:55:44 -07:00
Cliff Hall
4503e2d12b
 		Merge pull request #3659 from ShionEria/fix/issue-3460-windows-npx-docs 
docs: add Windows npx wrapper examples
 2026-04-17 18:59:54 -04:00
Cliff Hall
7e6b7807af
 		Merge pull request #3693 from nipunnegi2/patch-2 
Fix typo in usage instructions for VS Code
 2026-04-17 18:57:30 -04:00
Cliff Hall
c3448d71b5
 		Merge pull request #3694 from nipunnegi2/patch-3 
Fix formatting in README for Docker usage note
 2026-04-17 18:57:07 -04:00
Cliff Hall
74cdb4d867
 		Merge pull request #3695 from nipunnegi2/patch-4 
Fix formatting in README for docker usage note
 2026-04-17 18:56:41 -04:00
Cliff Hall
756db5b42a
 		Merge pull request #3733 from Zandereins/docs/add-claude-md 
docs: add root CLAUDE.md and fix AGENTS.md typo
 2026-04-17 18:50:57 -04:00
Cliff Hall
bb0a1893e7
 		Merge pull request #3877 from Chelebii/docs-3132-sequentialthinking-usage 
docs: clarify sequentialthinking usage and add examples
 2026-04-17 18:44:10 -04:00
Arif Celebi
5d146b379e
 		Merge branch 'main' into docs-3132-sequentialthinking-usage 2026-04-15 10:36:19 +01:00
Cliff Hall
d5bfe349af
 		Merge pull request #3950 from olaservo/retire-third-party-server-list 
Retire third-party server list in favor of MCP Registry
 2026-04-14 11:12:18 -04:00
olaservo
5914f61340 docs: retire third-party server list in favor of MCP Registry 
The Third-Party Servers section (Official Integrations + Community
Servers) has been superseded by the MCP Registry at
https://registry.modelcontextprotocol.io/. The README already carried a
deprecation note and CONTRIBUTING.md froze new additions. This removes
the list, updates CONTRIBUTING.md to describe the new state, and
refreshes the readme-pr-check workflow's bot comment.
 2026-04-14 08:05:23 -07:00
Arif Celebi
bae042b4f2 docs: clarify sequentialthinking usage and add examples 2026-04-08 23:49:45 +01:00
Zandereins
6e320090c0 docs: add root CLAUDE.md and fix AGENTS.md typo 
Add a root CLAUDE.md that covers the full monorepo:
- Monorepo structure (7 servers, 4 TS + 3 Python)
- Build, test, and lint commands for both stacks
- Code style conventions
- Contributing guidelines summary
- CI/CD pipeline overview
- MCP protocol reference pointers

Fix typo in src/everything/AGENTS.md:
- `start:stremableHttp` → `start:streamableHttp`

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-27 14:37:53 +01:00
Nipun Negi
c104a61f87
 		Fix formatting in README for docker usage note 2026-03-24 12:08:13 +05:30
Nipun Negi
7a8c25d393
 		Fix formatting in README for Docker usage note 2026-03-24 12:06:24 +05:30
Nipun Negi
5150a95309
 		Fix typo in usage instructions for VS Code 2026-03-24 12:03:31 +05:30
ShionElia
e21dbea731 docs: add Windows npx wrapper examples 2026-03-21 04:10:32 +00:00
Arif Celebi
f4244583a6
 		fix(fetch): refresh uv lockfile (#3598) 2026-03-17 07:21:11 -07:00
Arif Celebi
b60eca1b3b
 		fix(filesystem): ensure bare Windows drive letters normalize to root (#3434) 
fix(filesystem): ensure bare Windows drive letters normalize to root

Appends path.sep to bare drive letters (e.g. "C:") before calling path.normalize(), preventing them from normalizing to "C:." (current directory on drive) instead of "C:\" (drive root). Includes test coverage with platform mocking.

Fixes #3418
 2026-03-16 12:12:00 -07:00
Niels Kaspers
1cdf806d21
 		fix(sequential-thinking): use z.coerce for number and boolean params (#3533) 
fix(sequential-thinking): use z.coerce for number and safe preprocess for boolean params

Uses z.coerce.number() for number fields and a z.preprocess() helper for boolean fields to handle string-typed parameters from LLM clients. The preprocess approach correctly handles "false" → false, avoiding the z.coerce.boolean() footgun where Boolean("false") === true.

Fixes #3428
 2026-03-15 10:09:04 -07:00
Supun Geethanjana Jayasinghe
c7e0c7e730
 		add tools | 3573 (#3589) 
feat(git): add tool annotations

Adds MCP ToolAnnotations to all 12 git server tools, marking read-only operations (status, diff, log, show, branch) and distinguishing destructive (reset) from non-destructive write operations (add, commit, create_branch, checkout).

Fixes #3573
 2026-03-15 09:05:24 -07:00
Elliot
ae40ec239d
 		fix(git): add missing argument injection guards to git_show, git_create_branch, git_log, and git_branch (#3545) 
fix(git): add missing argument injection guards

Extends existing startswith("-") input validation to git_show, git_create_branch, git_log, and git_branch, preventing user-supplied values from being interpreted as CLI flags by GitPython's subprocess calls to git.
 2026-03-15 09:04:24 -07:00
Niels Kaspers
81f8301cd2
 		feat(time): add tool annotations to get_current_time and convert_time (#3574) (#3581) 
feat(time): add tool annotations

Adds MCP ToolAnnotations to both time server tools (get_current_time, convert_time). Both are read-only, non-destructive, idempotent, and closed-world.

Fixes #3574
 2026-03-15 08:51:02 -07:00
Niels Kaspers
c2ee97e792
 		feat(sequential-thinking): add tool annotations (#3534) 
feat(sequential-thinking): add tool annotations

Adds MCP ToolAnnotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to the sequential-thinking tool, bringing it in line with the annotation pattern established by the filesystem server.

Fixes #3403
 2026-03-15 08:50:08 -07:00
Anshul Garg
83b22050b8
 		fix(fetch): handle malformed input without crashing (#3515) 
fix(fetch): handle malformed input without crashing

Changes `raise_exceptions=True` to `raise_exceptions=False` in the fetch server's `Server.run()` call, preventing the server from crashing on malformed JSON-RPC input. This aligns with the SDK's intended default behavior and is consistent with other reference servers.

Fixes #3359
 2026-03-15 08:35:30 -07:00
Ola Hungerford
a97aba19eb
 		Merge pull request #3293 from thecaptain789/fix-httpx-proxy-arg 
fix(fetch): update to httpx 0.28+ proxy parameter
 2026-03-07 12:38:04 -07:00
Ola Hungerford
ad3e660cc1
 		Merge pull request #3252 from dotsetgreg/fix/session-resource-reregistration 
fix(everything): allow re-registration of session resources
 2026-03-07 12:32:28 -07:00
Ola Hungerford
6d977ddc62
 		Merge pull request #3297 from DukeDeSouth/fix/memory-open-nodes-relations 
fix(memory): return relations connected to requested nodes in openNodes/searchNodes
 2026-03-07 12:25:27 -07:00
Ola Hungerford
72efc42976
 		Merge pull request #3230 from nulone/fix/filesystem-move-file-destructive-hint 
fix(filesystem): mark move_file as destructive operation
 2026-02-28 14:17:21 -07:00
Ola Hungerford
04cce79b4c
 		Merge pull request #3398 from modelcontextprotocol/localden/servers 
Update README.md
 2026-02-24 18:38:19 -07:00
Den Delimarsky
599b170e9d
 		Update README.md 2026-02-24 17:32:52 -08:00
David Wong
0e06979028
 		add figma to official integrations list (#3363) 2026-02-24 17:35:23 +00:00
Ola Hungerford
a83b1451c5
 		Merge pull request #3254 from wingding12/fix/filesystem-macos-symlink-path-resolution 
fix(filesystem): resolve symlinked allowed directories to both forms
 2026-02-19 07:36:47 -07:00
Ellis Shang
1b96551ef0
 		fix(filesystem): use fileURLToPath for Windows absolute path parsing (#3205) 2026-02-19 05:52:11 -07:00
Ola Hungerford
6a914b9db8
 		Merge pull request #3350 from modelcontextprotocol/localden/sec-doc-update 
Update SECURITY.md to use GitHub Security Advisories
 2026-02-18 19:58:50 -07:00
Den Delimarsky
5e3735d081 Update SECURITY.md to use GitHub Security Advisories 2026-02-18 20:51:23 +00:00
Ola Hungerford
8f8f5be91e
 		Merge branch 'main' into fix/tool-annotations 2026-02-12 19:11:23 -07:00
Cliff Hall
618cf4867b
 		Merge pull request #2609 from modelcontextprotocol/claude/issue-2526-20250824-0240 
fix: resolve relative paths against allowed directories instead of process.cwd()
 2026-02-11 09:57:53 -05:00