MCP ecosystem news

Thirty-three further MCP security records landed between September 3 and 15; here is each one

Between 2026-09-03 and 2026-09-15, thirty-three more MCP security records were published or entered a GitHub/NVD listing outside the AWS Labs, IBM ContextForge, Langflow, firecrawl-mcp-server, and CKAN MCP Server stories already covered this cycle. They range from a same-day critical authorization bypass in Casdoor's /api/mcp endpoint, unpatched as of this fetch, to a coordinated VulnCheck batch of path-traversal and injection findings against several single-purpose stdio servers published within about thirty minutes on 2026-09-04. A third Kotlin SDK advisory, a ninth MCPHub CVE, a fifth SiYuan record, and a second three-CVE PraisonAI batch extend stories already running. Severity below is stated exactly as each discloser framed it.

2026-09-15 · verified 2026-09-15

Go SDK 1.8.0 hardens transports against resource exhaustion and lets servers narrow protocol versions

The official Go SDK released v1.8.0 on 2026-09-14, equivalent to the v1.8.0-pre.2 pre-release that opened the cycle on 2026-09-04. The release adds no new protocol revision: per the release notes, "2026-07-28 remains the newest version the SDK negotiates." It bounds decoding paths that previously buffered input without limit, including JSON nesting depth, SSE event size, stdio frame length, and OAuth dynamic client registration responses, and adds ServerOptions.SupportedProtocolVersions and ServerOptions.SetCacheable.

2026-09-14 · verified 2026-09-15

Goose 1.50.1 rolls back the "prefer latest MCP version" change that 1.50.0 shipped six days earlier, after it broke stdio and streamable_http extension startup

Goose released v1.49.0 on 2026-09-03 with several MCP-relevant additions: sampling support for reasoning-first responses, pre-registered OAuth clients for streamable_http extensions, MCP conformance tests added to CI, Unicode tag sanitization in MCP prompts, and preserving extensions when adding MCP servers. v1.50.0, released 2026-09-08, shipped "Prefer latest MCP version" (PR #11827), which made the client attempt the 2026-07-28 protocol via server/discover before falling back to a legacy handshake. Two regressions followed: stdio extensions whose servers support only protocol versions up to 2025-11-25 failed to start, and streamable_http extensions against servers that keep their notification channel open but silent failed with an "empty sse stream" error. v1.50.1, released 2026-09-14, reverted the change under the heading "Roll back MCP default version selection update."

2026-09-14 · verified 2026-09-15

Playwright MCP 0.0.81 makes its file access check follow symlinks so a workspace symlink can no longer reach files outside the allowed roots

Microsoft released playwright-mcp v0.0.81 on 2026-09-14. Its release notes state that the file access check now follows symlinks, so a symlink inside the workspace can no longer be used to read or write files outside the allowed roots. The same release adds WebMCP tool support (browser_webmcp_list, browser_webmcp_call), a --profile-dir-name option for selecting a Chrome profile in extension mode, and an idle timeout that closes headless browsers after an hour without tool calls. No GitHub security advisory covers the symlink fix; it shipped as a release-notes bug fix.

2026-09-14 · verified 2026-09-15

IBM's ContextForge MCP Gateway draws six CVE records in ten days, one critical default-credentials bug already patched and one SSRF report closed by documentation alone

IBM's own CNA published five CVE records against ContextForge MCP Gateway between 2026-09-04 and 2026-09-10, and GitHub's CNA published a sixth against the same repository on 2026-09-14. The critical record, CVE-2026-78573, is a hardcoded "changeme" default across three password settings; IBM's support page names v1.0.10, not the v1.0.8 the CVE text's own truncated version range would imply, as the actual fix, released 2026-09-07. Four more IBM-track records cover SSRF and credential-handling bugs with shipped fixes, except CVE-2026-18489, which IBM's text says was closed by a documentation change with no code fix. GitHub's separate record covers a DNS TOCTOU SSRF bypass fixed three months before it was published.

2026-09-14 · verified 2026-09-15

Langflow discloses five CVEs against its MCP Tools component, including a critical unauthenticated code execution bug, all already fixed

IBM's CNA, which now issues security records for Langflow, published five CVE records between 2026-09-04 and 2026-09-14 against Langflow's MCP Tools component. The worst, CVE-2026-85025 (critical, 9.8), let an unauthenticated attacker execute code and tamper with chat sessions through publicly shared MCP project endpoints. Two high-severity records (8.8 each) cover separate paths to arbitrary command execution through an MCP Tools stdio subprocess configuration. All three were fixed in Langflow OSS v1.11.6, released 2026-09-01, before any of them were published. Two medium records, one narrower information-disclosure bug and one older header-spoofing bypass fixed a release earlier, round out the batch.

2026-09-14 · verified 2026-09-15

SEP-2640 merges as Final: Agent Skills get a spec-level home over MCP Resources, the first proposal accepted since the 2026-07-28 release

On 2026-09-13 the MCP maintainers merged SEP-2640, the Skills Extension, with status Final on the Extensions Track. It defines how a server exposes Agent Skills as MCP resources under a skill:// URI convention, two required methods, skills/list and skills/get, and an optional resources/directory/read, under the extension identifier io.modelcontextprotocol/skills. It is the first SEP merged since the 2026-07-28 release, and because it is an extension the draft changelog for the next dated revision stays empty. MCP Inspector had shipped support for it four days earlier, in 2.6.0.

2026-09-13 · verified 2026-09-15

Claude Managed Agents add an auto permission policy for agent and MCP tool calls, dated September 10, 2026

Claude's platform release notes, dated September 10, 2026, added an auto permission policy to Claude Managed Agents: the server evaluates each agent or MCP tool call and runs it, denies it, or pauses for approval. The agent.tool_use and agent.mcp_tool_use events now report that outcome in an evaluation field alongside evaluated_permission.

2026-09-10 · verified 2026-09-15

OpenAI releases the Agents API in public beta on September 10, 2026, with built-in MCP server connections

OpenAI's API changelog recorded the Agents API entering public beta on September 10, 2026, describing a managed Codex harness that lets a developer "connect your own tools and MCP servers." The Agents API overview confirms agents can operate in a sandbox that connects to MCP servers, and the linked MCP connections guide documents three ways to attach a server: over HTTP hosted by OpenAI, over HTTP from the developer's own environment, or over stdio inside that environment. This is a separate product surface from the Agents SDK, which OpenAI added MCP support to in March 2025.

2026-09-10 · verified 2026-09-15

rmcp 3.3.0 adds enterprise token exchanges and an initialize negotiation hook

The official Rust SDK released rmcp 3.3.0 on 2026-09-10, adding ServerHandler::negotiate_initialize and, under auth, enterprise refresh-token and ID-JAG token exchanges. The macros crate now rejects an empty tool_router, and a fix saturates SSE reconnect backoff to avoid an overflow panic.

2026-09-10 · verified 2026-09-15

AWS's own CNA publishes five CVE records against four awslabs MCP servers in a week, led by a critical, already-fixed command injection

Amazon's CNA (AMZN) published five CVE records between 2026-09-04 and 2026-09-10 against four servers in the awslabs MCP collection. The worst, CVE-2026-87911, is a critical OS command injection in postgres-mcp-server's read-only enforcement, fixed in 1.1.7 on 2026-06-25, eleven weeks before the record. A second postgres-mcp-server record, plus one each against dynamodb-mcp-server, mysql-mcp-server, and security-agent-mcp-server, round out the batch; all four packages had already shipped fixes before their respective CVE records published.

2026-09-10 · verified 2026-09-15

Chrome DevTools MCP 1.9.0 adds a --workspace option for filesystem roots and widens --no-javascript-evaluation to navigations and init scripts

ChromeDevTools/chrome-devtools-mcp released v1.9.0 on 2026-09-08 with several safety and configuration controls. The CLI now defaults --allow-unrestricted-paths to true rather than false, and that flag is deprecated in favor of a new --workspace option that lets a caller name one or more filesystem roots the server's file tools may access. A new --no-javascript-evaluation flag disables the evaluate_script tools and, by release time, was extended to also block the initScript parameter in navigate_page and navigation to javascript:, data:, and vbscript: URLs. A separate --no-source-maps flag disables DevTools source maps.

2026-09-08 · verified 2026-09-15

ext-apps 2.0.0 moves to the split TypeScript SDK 2.0 packages with breaking API changes

The official MCP Apps extension released ext-apps v2.0.0 on 2026-09-08, moving to the MCP TypeScript SDK 2.0 split packages while leaving the MCP Apps wire protocol unchanged. Peer dependencies replace the single SDK package with @modelcontextprotocol/client@^2.0.0, an optional @modelcontextprotocol/server@^2.0.0, and zod@^4.2.0 on Node.js 20+, dropping zod 3 support. Handler registration is re-keyed by method name, and remote and local errors now use separate ProtocolError and SdkError shapes.

2026-09-08 · verified 2026-09-15

GitHub MCP Server 1.12.1 advertises only default OAuth scopes in its protected-resource metadata, days after 1.12.0 added governance tools and MCP Server Card support

GitHub released github-mcp-server v1.12.0 on 2026-09-03 with new governance tools for repository rulesets and custom properties, MCP Server Card support (SEP-2127), an Agent Plugins 1.0 package, and merge-HEAD pinning for pull request merges. v1.12.1 followed on 2026-09-08, calling itself a bugfix release: its OAuth protected-resource metadata had been advertising the server's full step-up scope catalog rather than only the default scopes, which clients such as VS Code read as the initial authorization request. PR #3251 changed the metadata to advertise default scopes alone; non-default scopes such as delete_repo and workflow remain reachable through per-tool authorization challenges.

2026-09-08 · verified 2026-09-15

MCP charters a Filesystems Working Group, merged into the official docs on September 8, 2026

PR #3282, "Add proposal for filesystems working group," merged into modelcontextprotocol/modelcontextprotocol on September 8, 2026, though the charter file's own commit history and changelog table date its content to August 24, 2026. The charter commits the group to one Extensions Track SEP making MCP Resources bidirectional, so an agent can write a result back to the server it reads its inputs from, reconciling two open proposals and ruling out a parallel files/* primitive. Its three leads are Sambhav Kothari and Daniel Temesgen of Bloomberg and Ola Hungerford of Nordstrom, with Temesgen added to the leadership table in a September 3 edit.

2026-09-08 · verified 2026-09-15

Python SDK 2.2.0 and 1.30.0 restrict HTTP redirects and expire idle Streamable HTTP sessions

The official Python SDK released v2.2.0 (2.x line) and v1.30.0 (1.x line) on 2026-09-07, shipping matching behavior changes to both lines. In both, the HTTP client now follows a redirect only if it stays within the endpoint's origin, and a stateful Streamable HTTP session idle for 30 minutes is closed, with a server holding at most 10,000 sessions before returning 503 (session_idle_timeout, max_sessions). Both lines also make the OAuth client validate the authorization server's issuer and add AuthSettings.validate_token_resource. v2.2.0 additionally fixes $ref resolution scope in a tool's outputSchema, resolving references within the schema document only.

2026-09-07 · verified 2026-09-15

Ruby SDK 1.5.0 makes the client answer server pings with the required empty result

The official Ruby SDK released v1.5.0 on 2026-09-05, fixing the client's response to a server-initiated ping: earlier clients replied with Method not found over Streamable HTTP and stayed silent over stdio, dropping sessions a server checks for liveness. The release also adds authorization_request_validator, letting the embedding application refuse an authorization request, and scopes stored OAuth token refreshes to the authorization server that issued them. v1.5.1, released 2026-09-09, is a compatibility fix for Faraday and json 3.0. PR #3248 proposing the SDK's promotion to Tier 1 remained open as of 2026-09-15, with no activity since 2026-08-23.

2026-09-05 · verified 2026-09-15

Docusign announces its MCP Server will open to every AI agent on September 30, 2026

Docusign said on September 4, 2026, in a release datelined San Francisco and distributed via PR Newswire, that it will open its Model Context Protocol (MCP) Server to every AI agent on September 30, with agreement intelligence and governed action from AI engine Docusign Iris callable natively from Claude, ChatGPT, Gemini, Copilot, Slack, and any MCP client. A registry query run the same day this atom was written found no first-party Docusign namespace in the official MCP Registry, only a third-party implementation.

2026-09-04 · verified 2026-09-15

Firecrawl's MCP server discloses a high-severity local file read flaw, and the npm package has not shipped a confirmed fix

VulnCheck published CVE-2026-85606 on 2026-09-04 against Firecrawl's official MCP server: the firecrawl_parse tool accepted an unconstrained filePath argument with no directory containment check, letting a caller read credentials or environment files and have them uploaded into the model's context. The record lists version 3.24.0 and earlier as affected. A git tag, v3.24.1, exists in the repository, but its commit describes an unrelated change, the same unconfined path-resolution code is still present at that tag and on the main branch, the reporter's issue has sat open without a response since 2026-07-08, and the npm package firecrawl-mcp has not published a release past 3.24.0 as of this writing.

2026-09-04 · verified 2026-09-15

Kotlin SDK discloses two Streamable HTTP denial-of-service records, one unauthenticated, both fixed nine weeks earlier

The official Kotlin SDK published two advisories on 2026-09-03. CVE-2026-63658 (high, 7.5) is an unauthenticated remote DoS: a chunked-encoding request has no Content-Length, so it bypasses the pre-read size guard and the whole attacker-controlled body is buffered in memory. CVE-2026-63657 (medium, 6.5) is the client-side mirror, where a server that never terminates an SSE event grows the client's heap without bound. Both affect 0.13.0 and earlier and were fixed in 0.14.0 on 2026-06-30, nine weeks before the records. It is the fifth official SDK in a month to disclose an unbounded-read defect in its HTTP transport.

2026-09-03 · verified 2026-09-03

MCP Inspector 2.5.0 revokes OAuth tokens when you clear them, and stops retrying a subscription that was never acknowledged

Inspector 2.5.0, released 2026-09-02, adds RFC 7009 token revocation so clearing credentials tells the authorization server rather than only forgetting them locally, and accepts RFC 8414 authorization-server metadata served at the OIDC well-known path. Two transport fixes matter for interop: a Streamable HTTP call is now cancelled by closing its stream, and a subscriptions/listen stream that is never acknowledged reports why it ended instead of retrying eight times.

2026-09-02 · verified 2026-09-03

ssh-mcp discloses a critical bypass of the gate that enforces its read-only mode, and groups it with four earlier ones as the same defect

On 2026-09-02 the maintainer of ssh-mcp published GHSA-qvx5-rxrj-9vfh, rated critical at CVSS 9.9: the function that classifies an SSH command as safe, destructive or privileged can be made to read something different from what the remote shell executes, defeating both read-only profiles and the human approval gate. The advisory explicitly groups it with four earlier high-severity advisories as one underlying defect, saying that fixing carriers one at a time is what produced the history. Fixed in 2.6.0; the server is ranked 38th in the MCP 500.

2026-09-02 · verified 2026-09-03

industry

Microsoft moves MCP server certification to a new Partner Center offer type, dated September 2, 2026

Microsoft's Copilot Studio documentation, carrying an ms.date of September 2, 2026 and last updated the following day, instructs publishers to submit MCP servers for certification through a new Partner Center offer type, "Apps and Agents for M365 and Copilot," replacing a process that had run MCP servers through the Power Platform connector certification program. Already-certified servers do not need to resubmit solely for the change, the old path stays usable through the end of October 2026, and every new submission now requires a manifest file, a tool file, an intro.md file, and Azure Key Vault authentication configuration. Certified servers are now also expected to appear in Azure Foundry alongside Copilot Studio.

2026-09-02 · verified 2026-09-15

Ash AI patched a spoofable MCP origin check and published the CVE the same night, five hours from reservation to record

The Erlang Ecosystem Foundation published CVE-2026-81315 on 2026-08-31: the DNS-rebinding origin check in AshAi.Mcp.Server, the MCP surface of the Elixir Ash framework's AI package, trusted the X-Forwarded-Proto header when reconstructing the expected origin, so a malicious page could reach a user's local MCP server despite the protection. The whole disclosure ran inside one evening: id reserved 20:00 UTC on 2026-08-30, fix committed 22:21, v1.0.0 released 23:24, record published 00:57.

2026-08-31 · verified 2026-09-02

Eight CVE records land at once for MCPHub, and every one of them trails a shipped fix

GitHub's CNA published eight CVE records against MCPHub, the self-hosted MCP gateway, in one batch on 2026-08-31. The worst, CVE-2026-79748, let any authenticated non-admin user reach remote code execution through the server registration endpoint; it was fixed in v0.12.15 back on 2026-05-02. The other seven cover missing authorization, SSRF and cross-tenant access, all fixed between April and 2026-08-23. The repository carries ten further advisories that have no CVE ids at all, three of them rated critical.

2026-08-31 · verified 2026-09-02

Microsoft Advertising announces its MCP server, read-only in open flight, five weeks after the setup docs went live

Microsoft Advertising's August product-news post, dated 2026-08-31, announced the Microsoft Advertising MCP server: read-only access to live account data through an "open flight", used from Microsoft 365 Copilot, ChatGPT, Claude and other MCP clients. The announcement trails its own documentation: the Learn setup guide, which names the endpoint and adds Copilot Studio and GitHub Copilot in VS Code as documented clients, has carried a 2026-07-22 date since July.

2026-08-31 · verified 2026-09-02

rmcp 3.2.0 coordinates OAuth refreshes through credential stores and adds request-state key rotation

The official Rust SDK released rmcp 3.2.0 and rmcp-macros 3.2.0 on 2026-08-31. The additions continue its authentication hardening line: OAuth token refreshes now coordinate through credential stores, and the signing keys that protect multi round-trip request state can be rotated. Fixes keep initialize working on legacy protocol versions, fall back correctly after a sessionless HTTP discover rejection, and allow concurrent Streamable HTTP requests.

2026-08-31 · verified 2026-09-02

CVE-2026-82456: Argo CD's MCP server took sessions from anyone who could reach it, scored a flat 10.0; the fix beat the record by 18 days

VulnCheck published CVE-2026-82456 on 2026-08-29 against argocd-mcp, the Argo Project's MCP server for Argo CD. Version 0.8.0 bound its HTTP transport to every interface and accepted MCP sessions without caller credentials whenever ARGOCD_API_TOKEN was configured, handing any network peer the operator's stored token and the full tool surface. Both CVSS 4.0 and 3.1 score it 10.0. The fix shipped in v0.9.0 on 2026-08-11, the same day the repository advisory went out, 18 days before the CVE record.

2026-08-29 · verified 2026-09-02

MCP charters an Enterprise Interest Group, with Okta, Saxo Bank and Nordstrom practitioners among its first members

PR #2626, merged into the official MCP docs on 2026-08-29, adds the charter of the Enterprise Interest Group: a requirements-gathering body for enterprises deploying MCP in production, explicitly barred from writing SEPs and directed to feed problem statements to the Auth, Transport and Extensions Working Groups. Its membership table lists 13 people, with facilitators Raghu Chandra (Independent) and Yannj_Fr (MCPApps Builders) on six-month terms and participants from Saxo Bank, Nordstrom, Boomi, Okta, Blue Shield of California, Solo.io, EmpowerID and Archestra.

2026-08-29 · verified 2026-09-02

CVE-2026-82233: SiYuan's asset.upload MCP tool read arbitrary absolute paths; fourth MCP-tool record against the app in August

VulnCheck published CVE-2026-82233 on 2026-08-28: the asset.upload MCP tool in SiYuan before v3.8.1 accepted arbitrary absolute file paths without workspace boundary validation, letting an MCP client read files outside the workspace. The repository advisory went out 2026-08-13 and v3.8.1 shipped the fix on 2026-08-18, ten days before the record. It is the fourth CVE against SiYuan's MCP tool surface published in August 2026.

2026-08-28 · verified 2026-08-28

CVE record: Hermes Agent's bundled MCP catalog pointed at a mutable branch, making a third-party repo compromise an RCE path

VulnCheck published CVE-2026-82021 on 2026-08-28 against NousResearch's Hermes Agent, whose repository shows roughly 239,000 GitHub stars: its bundled MCP catalog referenced a third-party upstream repository by mutable branch rather than pinned commit SHA, so compromising that upstream meant arbitrary code execution for agent users. The fix shipped in v0.19.0 on 2026-07-20, five and a half weeks before the record. A separate VulDB record, CVE-2026-84289, published 2026-09-01, describes uncontrolled memory allocation in the MCP tool lister for 0.18.x and names no fixed version.

2026-08-28 · verified 2026-09-02

Ruby SDK 1.4.0 repairs the subscriptions/listen stream and lets buffering hosts decline it

The official Ruby SDK's v1.4.0, released 2026-08-28, fixes the ordering of the subscriptions/listen stream: no notification is delivered before the acknowledgement, and the graceful closing result is guaranteed to be the final message. It also adds serve_subscriptions_listen: false, so a host that buffers its responses, the SDK's documented Rails controller pattern among them, can decline the method instead of answering a streaming request with a body it cannot render.

2026-08-28 · verified 2026-09-02

VulnCheck publishes twelve CVEs against MCP HTTP transports in one batch, from mcp-go to Dropbox Dash

Twelve CVE records against MCP HTTP transports, all assigned by VulnCheck as CNA, were published within the same minute on 2026-08-27. The defect classes repeat across unrelated projects: missing or disabled Host-header validation enabling DNS rebinding (mark3labs/mcp-go before 0.56.0, Dropbox's Dash MCP server, three Timescale servers), unauthenticated listeners bound to every interface (Telnyx MCP server at 9.1, ByteDance's UI-TARS desktop at 10.0, mcp-router), server-side request forgery (mcp-use's inspector proxy, Apify's get-html-skeleton tool), and an unauthenticated Python sandbox escape (ToolUniverse).

2026-08-27 · verified 2026-08-28

CVE-2026-37006: gpt-researcher accepted MCP server configs over an unauthenticated WebSocket, spawning attacker-named commands

A CVE record published 2026-08-27 describes unauthenticated remote code execution in gpt-researcher, the 29,000-star research agent: its /ws WebSocket endpoint accepted mcp_configs whose command and args fields reached a subprocess spawn unvalidated. The researcher's disclosure names v0.14.8 as the fixed version, adding authentication, strict schema validation and an executable allowlist. The fixed version could not be reconciled against the project's artifacts: the PyPI 0.14.8 upload predates the reported discovery, and the repository tags use a different numbering.

2026-08-27 · verified 2026-09-02

MCP charters the Transports Working Group; its roadmap plans against a 2026-12-15 specification release

The Model Context Protocol project merged a formal charter for the Transports Working Group into its official documentation on 2026-08-26. The group, led by Kurtis Van Gent, owns transport bindings, scalability, and migration off the legacy initialization and transport-session models. Its own roadmap document, published 2026-08-25 in the working group repository, plans three priority tracks against the 2026-12-15 specification release. Neither the specification repository nor the project roadmap names a next-release date; the target appears only in the working group's document.

2026-08-26 · verified 2026-08-27

MCP Inspector 2.4.0 renders elicitation forms inside MCP Apps and adds a keychain-free secret store

MCP Inspector 2.4.0, released 2026-08-26, negotiates app-rendered form elicitations so an MCP App can present a server's elicitation form in its own UI, adds file-backed and in-memory SecretStore options with a cross-process lock for hosts without an OS keychain, makes the OAuth refresh_token grant opt-out per server, flags unportable tool schemas in all three clients, and allows complex JSON values in request _meta.

2026-08-26 · verified 2026-08-27

PHP SDK v0.8.0 ships 2026-07-28 support, including the stateless lifecycle and multi round-trip requests

The official PHP SDK released v0.8.0 on 2026-08-25 with support for the 2026-07-28 Model Context Protocol specification: the SEP-2575 stateless lifecycle, SEP-2243 standard request header validation, the SEP-2322 multi round-trip request flow, the SEP-2133 extensions framework, and the SEP-2577 deprecations of Roots, Sampling and Logging. Older spec revisions remain supported. The SDK listing carries PHP at Tier 3.

2026-08-25 · verified 2026-08-25

Cloudflare MCP server portals now bridge 2026-07-28 clients and legacy upstreams independently

Cloudflare's MCP server portals support the stateless 2026-07-28 revision as of a 2026-08-25 changelog entry. A portal's /mcp endpoint accepts both 2026-07-28 requests and earlier Streamable HTTP clients, and checks each upstream server for 2026-07-28 support, falling back to the 2025 handshake when needed. Client-side and upstream protocol selection are independent, so either side of a portal can upgrade without configuration changes. SSE connections stay on the legacy protocol.

2026-08-25 · verified 2026-08-27

CVE-2026-79786: Coroot's MCP OAuth registration accepts arbitrary redirect URIs; no fixed release at publication

VulnCheck published CVE-2026-79786 on 2026-08-25 against Coroot, the open-source observability platform. Coroot's MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without scheme or domain validation, letting an unauthenticated attacker register a client that redirects an authenticated user's authorization response to an attacker-controlled host. Versions 1.20.2 through 1.24.5 are affected, and 1.24.5 is the newest release as of 2026-08-27, so no fixed version exists. The reporter's public issue states a report sent through the vendor's contact form on 2026-05-25 received no response.

2026-08-25 · verified 2026-08-27

github-mcp-server 1.11.0 requests OAuth scopes per tool call instead of up front

GitHub released github-mcp-server 1.11.0 on 2026-08-25. The release adds per-call OAuth scope checks so each tool invocation requests only the permissions it needs, preserves CORS across the OAuth discovery routes for browser-based clients, adds an --authorization-server flag to override the authorization server URL, creates parent and sub-issues atomically, and adds ETag conditional requests to the REST transport. The runtime moves to Go 1.27.

2026-08-25 · verified 2026-08-27

CVE-2026-53965: official PHP SDK client buffered SSE responses without bound; fixed in 0.7.1 eleven days before the record

CVE-2026-53965 reached NVD on 2026-08-25 against the official Model Context Protocol PHP SDK (Composer package mcp/sdk). In versions 0.5.0 through 0.7.0 the client HTTP transport appended Server-Sent Events chunks to an in-memory buffer that only flushed on the event delimiter, so a malicious or compromised server that withholds the delimiter can exhaust the client's memory. The repository advisory and the fixed v0.7.1 release both shipped on 2026-08-14, thirty seconds apart.

2026-08-25 · verified 2026-08-27

Three CVEs against PraisonAI's MCP HTTP transport reach NVD ten weeks after the fix shipped

Three CVE records against PraisonAI, a multi-agent framework whose repository carries roughly 9,000 stars, were published on 2026-08-25: two origin-validation bypasses in its MCP HTTP Stream transport (CVE-2026-55532, 7.6 high, and CVE-2026-55529, 6.9 medium) and unbounded per-initialize session accumulation (CVE-2026-55531, 6.5 medium). All three were fixed in praisonai 4.6.58, released 2026-06-13, ten weeks before the records appeared.

2026-08-25 · verified 2026-08-27

Python SDK 2.1.0 and 1.29.1 extend the request body limit to SSE and OAuth endpoints and keep crash detail off the wire

The official Python SDK released v2.1.0 and maintenance-line v1.29.1 together on 2026-08-24. Both lines extend the existing 4 MiB request body limit to the SSE transport and the OAuth endpoints, and the SSE message endpoint now rejects non-POST requests with 405. In 2.1.0, unexpected handler exceptions are logged server-side while the client receives only a generic error message, and the 2026-07-28 HTTP entry now acknowledges POSTed notifications with 202 instead of rejecting them with 400.

2026-08-24 · verified 2026-08-25

mcp-memory-service fixes a critical OAuth bypass: open client registration handed out read-write tokens without the API key

The mcp-memory-service project published advisory GHSA-5p27-64mv-pr73 on 2026-08-23, rated critical at CVSS 9.1, and shipped the fix in v11.8.2 the same morning. When OAuth was enabled with Dynamic Client Registration left open, the default in that configuration, an unauthenticated caller could register a public client and replay its returned credentials against the token endpoint with grant_type=client_credentials, receiving a read-write bearer token that bypassed the owner API key entirely. OAuth is off by default, so default installs were not exposed. Versions v10.20.0 through v11.8.1 are affected; a CVE has been requested.

2026-08-23 · verified 2026-08-25

MCP publishes a new roadmap: five priority areas, named maintainers, and expedited review for SEPs that fit

The Model Context Protocol project published an updated roadmap on 2026-08-22, replacing the March 2026 edition. It names five priority areas for the next specification release: agentic messaging primitives, HTTP-native transport unification, agent identity and enterprise security, improved primitives, and SDK developer experience. Each area lists the responsible Core Maintainers and Working Groups, two of which are newly forming, and SEPs that fall inside a priority area now get expedited review.

2026-08-22 · verified 2026-08-25

Two more SiYuan MCP tool CVEs reach NVD: secret exfiltration via http_request and an incomplete file-tool blocklist

CVE-2026-59809 and CVE-2026-60083 were published to the National Vulnerability Database on 2026-08-22, both against the MCP tool surface of the SiYuan note-taking application and both fixed in v3.8.0, released 2026-08-12. The first covers secret placeholders being interpolated into the destination URL of the http_request MCP tool, letting an MCP client exfiltrate stored secrets to any host; the second covers an incomplete path blocklist in the MCP file tool that exposed publish-mode passwords and other protected workspace files. The underlying repository advisories were published 2026-08-08.

2026-08-22 · verified 2026-08-25

Rust SDK promoted to Tier 1, joining TypeScript, Python, C# and Go

The Model Context Protocol project merged the Rust SDK's promotion from Tier 2 to Tier 1 in the official SDK listing on 2026-08-21, citing independent re-verification with the conformance suite: 67/67 server checks and 50/50 client checks against the frozen 2025-11-25 and 2026-07-28 requirement sets. Tier 1 now comprises TypeScript, Python, C#, Go and Rust; Ruby's own promotion proposal remains open.

2026-08-21 · verified 2026-08-21

Spring AI discloses unbounded session retention in its MCP Streamable HTTP transport, fixed in 2.0.1

CVE-2026-59279, published 2026-08-21 at CVSS 7.5: Spring AI 2.0.0's MCP Streamable HTTP server transport, in both WebFlux and WebMvc variants, places no limit on retained sessions and requires no authentication by default, so a remote attacker can accumulate sessions until memory is exhausted. Fixed in Spring AI 2.0.1; Spring credits internal discovery. It is the third resource-exhaustion disclosure in the Java MCP ecosystem in three days, after the Java SDK's two unbounded-read advisories.

2026-08-21 · verified 2026-08-21

CVE record published for a CKAN MCP Server SSRF filter bypass fixed in May

CVE-2026-53509 reached NVD on 2026-08-21, twelve weeks after the fix. The CKAN MCP Server's SSRF filter, added to close CVE-2026-33060, validated caller-supplied server URLs by inspecting only the parsed hostname string, so /etc/hosts aliases like ip6-localhost passed the filter and resolved to loopback when the request was made. Fixed in 0.4.106 on 2026-05-31, the same morning the advisory published. CVSS 5.7, medium.

2026-08-21 · verified 2026-08-21

CVE records published for n8n's MCP node-schema RCE and a cross-project credential bypass, both fixed August 5

CVE-2026-77068 (high) and CVE-2026-77073 (medium) reached NVD on 2026-08-20, fifteen days after n8n published both advisories and shipped fixes in 2.33.4 and 2.34.1 on 2026-08-05. The first is code execution in the n8n main process: the MCP node-schema loader built a module path from the attacker-supplied node type string without checking for path traversal. The second let the MCP create_workflow_from_code tool persist cross-project credential references when a node's auth type was an expression.

2026-08-20 · verified 2026-08-21

rmcp 3.1.4 requires 32-byte signing keys for MRTR request state and stops Debug from printing OAuth secrets

Released 2026-08-20. The Rust SDK's RequestStateCodec, which HMAC-signs the opaque requestState values that carry Multi Round-Trip Requests, previously accepted keys of any length despite documenting a 32-byte minimum. try_new now enforces it, the legacy constructor is deprecated as of 3.1.4, key bytes are zeroized on drop, and the derived Debug on ClientCredentialsConfig no longer prints client secrets or private signing keys.

2026-08-20 · verified 2026-08-20

Contentful MCP Server advisory: two migration tools let a model redirect the server's access token to any host

GHSA-2xhg-73j7-rrgx (CVE-2026-53957), CVSS 7.7 high: the maintainer's repository advisory was published 2026-06-12 and GitHub's reviewed record followed on 2026-08-19. The export_space and import_space tools spread LLM-controlled arguments, host and proxy among them, into the options passed to contentful-export, so the Management API client built its base URL from an attacker-supplied host and attached the server's Personal Access Token as a bearer header. Fixed 2026-06-01, eleven days before the repository advisory and eleven weeks before the reviewed record.

2026-08-19 · verified 2026-09-15

GitHub MCP Server 1.10.0 gates repository deletion behind elicitation and hardens credentials, symlinks and request limits

Released 2026-08-19 and described by its own notes as a substantial security, reliability and compatibility release. Repository deletion now requires a confirmation form with protected multi-round-trip state, bearer credentials are restricted to configured GitHub authorities, symbolic-link writes need an explicit opt-in, and oversized HTTP request bodies are rejected early. Version 1.10.1 followed a day later for a schema regression.

2026-08-19 · verified 2026-08-20

Official Java SDK caps HTTP reads in both directions after two resource-exhaustion advisories

The MCP Java SDK published GHSA-4x8c-5vv7-973f (high) and GHSA-5q7x-232h-f834 (medium) on 2026-08-19, both CWE-770. Its three Servlet HTTP server transports buffered entire request bodies without a cap and never checked Content-Length, and its HTTP client transports accumulated SSE data lines into an unbounded buffer. Fixes landed the same afternoon across 2.0.1, 1.1.4 and 0.18.4.

2026-08-19 · verified 2026-08-20

CVE record published for a marimo flaw where a notebook's own MCP server entry ran as a subprocess on open

VulnCheck published CVE-2026-75149 on 2026-08-19 for a code injection in marimo below 0.23.15. A notebook could embed an MCP server entry whose command value marimo launched as a local subprocess when the notebook was opened in edit mode, before any cell executed and with no authentication. The fix shipped 2026-07-23 as part of a broader PEP 723 sanitization pass.

2026-08-19 · verified 2026-08-20

MCP Inspector 2.3.0 adds per-server OAuth overrides and clears eight dependency advisories

Released 2026-08-19. Inspector gains custom OAuth authorization-request parameters per server, Auth URL and Token URL overrides in Server Settings, and id_token decoding in Connection Info. The release also binds loopback by address for containers and finishes clearing eight dependency advisories, four of them high, across five lockfiles.

2026-08-19 · verified 2026-08-20

Three advisories published for the SearXNG MCP server, including basic-auth credentials leaking through MCP logs and JSON-RPC errors

Three records landed on ihor-sokoliuk/mcp-searxng within ten minutes on 2026-08-19. The one without a CVE is the most protocol-specific: SearXNG Basic Authentication credentials were exposed through MCP logs and JSON-RPC error responses, fixed in 1.12.0. The other two are SSRF in web_url_read with the internal-address guard off by default, and further hardened-mode bypasses, both fixed back in 1.2.1 on 2026-06-07.

2026-08-19 · verified 2026-08-20

Splunk discloses command execution in its MCP Server app through unchecked deserialization in credential management

Splunk published SVD-2026-0808 and CVE-2026-76404 on 2026-08-19, rated CVSS 9.1 critical. In Splunk MCP Server app versions below 1.2.1, the app's credential management component deserialized stored data without checking its type, letting a holder of the admin Splunk role run arbitrary commands on the host operating system. Fixed in 1.2.1.

2026-08-19 · verified 2026-08-20

CVE record published for an Apify MCP server flaw that could redirect a client's bearer token to a third-party host

CVE-2026-50143 was published on 2026-08-18, covering an authority-injection flaw in the Apify MCP server. A path value taken from an Actor definition was concatenated onto a trusted standby URL without checking the resulting origin, so a malicious Actor publisher could point the MCP client, and the victim's Apify API token, at a host of their choosing. Apify fixed it in 0.10.11 on 2026-05-28.

2026-08-18 · verified 2026-08-18

CVE record published for the Apache SkyWalking MCP SSRF and GraphQL injection fixed in April

CVE-2026-34884 reached the CVE list on 2026-08-18 for an SSRF through the set_skywalking_url tool and a GraphQL expression injection in Apache SkyWalking MCP 0.1.0. Version 0.2.0 fixed it on 2026-04-02 and Apache announced it to its mailing list on 2026-04-13 rating it "important". NVD scores the record 9.8 critical; the Apache record carries no CVSS at all.

2026-08-18 · verified 2026-08-20

Two CodeWhale CVEs record tools that declared themselves auto-approved and overrode the user's approval policy

CVE-2026-75857 and CVE-2026-75858, published 2026-08-18, describe two CodeWhale tools whose approval_requirement returned ApprovalRequirement::Auto, which the engine treats as never prompt. That overrode the default Required approval for code-executing tools and the user's configured --approval-policy, so model-supplied Python ran outright and LLM-controlled stdin reached an already-approved shell. One commit on 2026-06-21 fixed both.

2026-08-18 · verified 2026-08-20

CVE record published for the Context7 custom-rules prompt injection Upstash fixed in February

VulnCheck published CVE-2026-75130 on 2026-08-18 for the prompt injection Noma Security disclosed on 2026-03-05 as ContextCrush. Library owners could set "AI Instructions" on Context7 that its MCP server served verbatim to any agent querying that library, alongside the documentation and through the same trusted channel. Noma's timeline puts Upstash's production fix at 2026-02-23, five days after the report.

2026-08-18 · verified 2026-08-18

Advisory published for a roots boundary bypass in Google's Chrome DevTools MCP server, fixed three months earlier

The GitHub Advisory Database published GHSA-8qf9-62x2-82pp on 2026-08-17, covering CVE-2026-53766 in chrome-devtools-mcp. The server enforced client-declared workspace roots by comparing resolved path text, which does not follow symbolic links, so a symlink inside a root could reach files outside it for both reads and writes. Google fixed it on 2026-05-26 in v1.1.0 as an ordinary release bullet; the NVD record dates from 2026-06-24.

2026-08-17 · verified 2026-08-18

CVE record published for a critical cross-user OAuth token leak in Onyx's MCP server endpoints

CVE-2026-71424 was published on 2026-08-17, covering a cross-user OAuth token leak in Onyx, an open-source AI platform. Per-user MCP OAuth tokens were copied into a shared admin connection-config row, and two MCP listing endpoints returned that row's Authorization header to any user with basic access. The record carries CVSS 3.1 9.6, critical. Onyx fixed it in 3.1.10, 3.2.14 and 4.0.0, all released in May 2026, and published its own advisory on 2026-07-20.

2026-08-17 · verified 2026-08-18

JetBrains discloses code execution via unauthenticated Jupyter MCP tools in PyCharm before 2026.2.1

JetBrains published CVE-2026-75060 on 2026-08-17 as the CNA for its own products. The record states that in PyCharm before 2026.2.1, code execution was possible via unauthenticated Jupyter MCP tools, and rates it 8.4 high on CVSS 3.1 with no privileges and no user interaction required. JetBrains published no further technical detail beyond the one-line description and its fixed-issues page.

2026-08-17 · verified 2026-08-18

CVE record published for path traversal in SiYuan's database_clean MCP tool, a hardening gap the HTTP API had already closed

CVE-2026-74798 was published on 2026-08-17 by VulnCheck, covering a path traversal in the database_clean MCP tool of SiYuan, a note-taking application. The tool checked only that its id parameter was non-empty before joining it into a filesystem path, so an authenticated MCP client could copy an arbitrary readable file into SiYuan's history directory and then delete the original. The advisory notes the equivalent HTTP API handler had been hardened earlier and the MCP caller was missed.

2026-08-17 · verified 2026-08-18

Ruby SDK 1.2.0 completes the 2026-07-28 stateless lifecycle, and a Tier 1 promotion is proposed

The official MCP Ruby SDK released v1.2.0 on 2026-08-15, which its release notes describe as completing the SEP-2575 stateless lifecycle of the 2026-07-28 revision along with the SEP-2322, SEP-2549 and SEP-2243 features that revision builds on. Several changes are incompatible with 1.1.0 and ship in a minor release under the spec-conformance and security exceptions in the SDK's VERSIONING.md. A pull request filed the same week proposes promoting Ruby from Tier 2 to Tier 1 in the official SDK listing.

2026-08-15 · verified 2026-08-18

CVE record published for critical unauthenticated document API in mcp-memory-service, whose GitHub repository disappeared and has since returned

CVE-2026-50027 was published to the National Vulnerability Database on 2026-08-14 with a CVSS score of 9.8, covering mcp-memory-service versions before 10.67.1. All HTTP routes under /api/documents/* were served without authentication even when the server was configured with an API key or OAuth, letting an unauthenticated remote attacker write, read, and delete stored memory content. The underlying GitHub advisory was published 2026-07-02. The project's GitHub repository and maintainer account returned 404 when checked on 2026-08-14; both were live again by 2026-08-25, and the project's release notes now state that development moved to Codeberg at the end of May 2026 with the GitHub repository reinstated as a mirror.

2026-08-14 · verified 2026-08-25

Apache SkyWalking's MCP server moves to the official Go SDK and adds 2026-07-28 support on master

A pull request merged into apache/skywalking-mcp on 2026-08-14 replaced the server's MCP plumbing with the official modelcontextprotocol/go-sdk and, per the project's changelog, added support for the 2026-07-28 revision while keeping the legacy initialize handshake working on the same endpoint. The work sits under an untagged 0.3.0 heading; the newest release remains v0.2.0.

2026-08-14 · verified 2026-08-18

A third CKAN MCP Server record: an unanchored allowlist regex let two quality tools be pointed at any host

CVE-2026-73845, assigned by GitHub on 2026-08-14, covers a prefix-only regular expression in the CKAN MCP Server's isValidMqaServer check. The ckan_get_mqa_quality and ckan_get_mqa_quality_details tools were meant to accept only dati.gov.it, but an unanchored pattern also admits any host beginning with that string, and any URL using it as userinfo before an @, so a caller could point the tools at their own server and get a spoofed quality response back. Fixed in 0.4.112 on 2026-07-09, five weeks before the record. It is the third record against this server's URL validation.

2026-08-14 · verified 2026-09-03

GitHub disclosed a fourth and fifth CVE record against the CKAN MCP Server: a cache-key collision and a verbose-error leak, both fixed in the same release as the third

CVE-2026-73846 (6.5 medium) and CVE-2026-73844 (3.7 low), both published by GitHub's CNA on 2026-08-14, are the fourth and fifth CVE records against the CKAN MCP Server's tool surface. The first covers a cache-key collision in canonicalizeParams that let a caller prime the shared cache with a spoofed response for a victim's distinct query; the second covers error paths that reflected raw upstream response bodies and internal exception messages back to the caller. Both were fixed in the same v0.4.112 release, published 2026-07-09, the identical release that also fixed the server's third record. Both new records reached the GitHub Advisory Database listing on 2026-09-03, about three weeks after their CNA publication date.

2026-08-14 · verified 2026-09-15

C# SDK v2.2.0 adds hybrid HTTP serving so 2025-11-25 and 2026-07-28 clients share one endpoint

The official MCP C# SDK released v2.2.0 on 2026-08-13, adding an HttpServerSessionMode for hybrid stateful/stateless HTTP serving so clients on the 2025-11-25 and 2026-07-28 protocol revisions can share an endpoint, and fixing a header-decoding edge case in McpHeaderEncoder.DecodeValue.

2026-08-13 · verified 2026-08-13

CVE record published for Flowise remote code execution via the Custom MCP node

CVE-2026-73601 was published to the National Vulnerability Database on 2026-08-13, covering a remote code execution vulnerability in Flowise's Custom MCP node. When CUSTOM_MCP_PROTOCOL is set to stdio, authenticated users of Flowise versions before 3.1.3 can execute arbitrary commands by manipulating environment variables and command arguments. The underlying FlowiseAI advisory, GHSA-g98q-rm45-q9h8, was published 2026-07-29 and rates the flaw critical; the NVD record carries a CVSS score of 9.0.

2026-08-13 · verified 2026-08-13

industry

Cloudflare Gateway adds MCP traffic detection and an AI Security dashboard

Cloudflare's 2026-08-12 changelog announced that Gateway, part of Cloudflare One, now detects Model Context Protocol traffic by inspecting protocol-specific headers and payload characteristics. A new beta HTTP policy selector named Is MCP (experimental.is_mcp) lets administrators allow, block, or isolate MCP requests, and a new AI Security dashboard reports MCP request volume, unique users, and unique MCP servers observed. A same-day Traffic Source selector adds mcp_portal as a policy-targetable on-ramp.

2026-08-12 · verified 2026-08-14

Agent Plugins 1.0 reaches general availability in VS Code, Copilot CLI, and the Copilot app

GitHub's 2026-08-12 changelog made Agent Plugins 1.0 generally available in VS Code, Copilot CLI, the GitHub Copilot SDK, and the GitHub Copilot app, across all Copilot plans. Agent Plugins is the vendor-neutral package format announced 2026-08-06 that bundles agent skills with MCP server configurations, stored in mcp.json files inside the plugin. GitHub credits the 1.0.0 specification as an open standard co-developed with AWS, Anysphere, Microsoft, OpenAI, Vercel, and Google.

2026-08-12 · verified 2026-08-14

CVE record published for MCP Atlassian arbitrary file read fixed in 0.22.0

CVE-2026-73498 was published to the National Vulnerability Database on 2026-08-12, covering an arbitrary file read in MCP Atlassian, a widely used community MCP server for Confluence and Jira. Prior to 0.22.0, the confluence_upload_attachment tool passed its client-supplied file_path directly to open() without path validation, letting an authenticated MCP client read any file accessible to the server process and exfiltrate it to Confluence as an attachment. The underlying advisory, GHSA-g5r6-gv6m-f5jv, was published 2026-07-10 and rates the flaw high (CVSS 7.7).

2026-08-12 · verified 2026-08-13

MCP publishes the Apps Working Group charter covering the interactive UI extension

The MCP project merged the MCP Apps Working Group charter into its community documentation on 2026-08-12. The group owns the MCP Apps extension specification (SEP-1865) under the io.modelcontextprotocol/ui namespace, the @modelcontextprotocol/ext-apps SDK, the extension's security model, and conformance work, with leads from MCP-UI and Anthropic and a working-group member from OpenAI.

2026-08-12 · verified 2026-08-13

MCP Inspector 2.2.0 moves to TypeScript SDK 2.0.0 stable and adds a v1 to v2 migration guide

MCP Inspector released 2.2.0 on 2026-08-12, upgrading from TypeScript SDK 2.0.0-beta.5 to the stable 2.0.0 packages, adding a v1 to v2 migration guide, fixing the MCP Apps sandbox proxy so it ships its static assets, and forwarding the negotiated Mcp-Protocol-Version header through the remote proxy. The release also publishes a six-month roadmap running to February 2027.

2026-08-12 · verified 2026-08-13

Blender MCP maintainer's GitHub account hijacked, with access restored two days later

Siddharth Ahuja, maintainer of the 25k-star blender-mcp server, reported on 2026-08-09 that his GitHub account was hacked and his ownership rights stripped, naming Blender MCP and Ableton MCP among the repositories taken away. On 2026-08-11 he posted that GitHub had banned the hacker and restored his account, and that the MCP servers themselves were not compromised. As of 2026-08-13 the repositories resolve back to his account.

2026-08-11 · verified 2026-08-13

Grafana discloses critical SSRF in mcp-grafana after an earlier fix left request destinations unrestricted

Grafana published CVE-2026-19516 on 2026-08-11, a CVSS 9.1 server-side request forgery in the mcp-grafana server. A caller-supplied X-Grafana-URL header controls the destination of outbound requests, and the grafana_api_request tool also lets the caller choose the HTTP method, path, and body, so requests can be directed at internal, loopback, and link-local services including metadata endpoints. The fix for the earlier CVE-2026-15583 stopped token leakage but did not restrict destinations; v1.1.0 fixes the SSRF and adds optional bearer-token caller authentication.

2026-08-11 · verified 2026-08-13

GitHub MCP Server 1.9.0 makes issue search semantic by default and adds a gated duplicate finder

GitHub released github-mcp-server v1.9.0 on 2026-08-10. The release makes the search_issues tool semantic by default, adds a non-default find_duplicate tool gated by the duplicate_detection flag, returns closing pull requests from issue_read, and supports removing issue types and updating singular Project issue fields.

2026-08-10 · verified 2026-08-13

Microsoft UFO advisory: unauthenticated mobile MCP servers allowed remote control of connected Android devices

Microsoft's UFO automation framework published advisory GHSA-24fq-m9rr-g3mm on 2026-08-10 for CVE-2026-73296, rated critical (CVSS 9.4 on the NVD record). Prior to version 3.0.8, UFO's mobile MCP servers exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without authentication, letting an unauthenticated remote attacker invoke tools such as capture_screenshot, tap, and type_text against an ADB-connected Android device. Version 3.0.8, released 2026-08-10, fixes the issue.

2026-08-10 · verified 2026-08-13

Cloudflare Radar adds WebMCP support for browser-based agents

Cloudflare's Radar changelog for 2026-08-07 says Radar now supports WebMCP, letting browser-based AI agents navigate Radar, search its data, and call tools such as URL scanning and domain lookup. WebMCP is the Web Model Context Protocol, a browser API published as a Draft Community Group Report by the W3C Web Machine Learning Community Group. It is related to but distinct from MCP's client-server protocol.

2026-08-07 · verified 2026-08-07

Codex CLI 0.147.0 adds opt-in MCP 2026-07-28 support and Agent Plugins installation

OpenAI released Codex CLI 0.147.0, adding opt-in support for the 2026-07-28 revision covering paginated discovery, multi-round requests and non-blocking server startup. The same release adds installation of portable Agent Plugins and search across local, personal, workspace and remote plugin catalogs.

2026-08-07 · verified 2026-08-07

Context7 MCP 4.0.0 migrates to the 2026-07-28 revision and drops Redis-backed sessions

Upstash released @upstash/context7-mcp 4.0.0 on 2026-08-07, migrating the server to the v2 SDK packages and the 2026-07-28 protocol revision, with stateless HTTP serving for modern and legacy clients and Redis-backed sessions removed. A probe of the hosted endpoint at mcp.context7.com/mcp the same day answered server/discover with supportedVersions ["2026-07-28"].

2026-08-07 · verified 2026-08-07

industry

Agent Plugins 1.0.0 published as a vendor-neutral format that bundles MCP server configurations with agent skills

Agent Plugins 1.0.0 was published as an independently governed specification for packaging agent skills and MCP servers into portable plugins, declaring MCP servers in an mcp.json file at the plugin root. Its technical steering committee draws on Amazon, Cursor, Microsoft, OpenAI and Vercel, and Google announced it is joining as a core maintainer. The Agentic AI Foundation, which hosts MCP, stated the specification is not an AAIF project.

2026-08-06 · verified 2026-08-07

Cloudflare publishes an engineering post on the 2026-07-28 revision and says createMcpHandler has graduated into the official TypeScript SDK

Cloudflare published a post by Matt Carey setting out the 2026-07-28 revision's stateless design, its HTTP headers and its deprecation schedule, and restating Cloudflare's support position. It is the only vendor 2026-07-28 adoption post found outside the 2026-07-28 release-day cluster. Note the URL slug is mcp-v2 while the subject is the dated revision.

2026-08-06 · verified 2026-08-06

GitHub ships centrally managed MCP allowlists for Copilot clients

GitHub announced on 2026-08-06 that enterprise owners can centrally control which MCP servers GitHub Copilot clients are allowed to run, using new allowedMcpServers and deniedMcpServers keys in enterprise managed settings. Matchers cover remote server URLs with wildcard support, local stdio commands, and server names; malformed or unverifiable configurations fail closed. The capability is generally available and enforced in the GitHub Copilot app, Copilot CLI, and VS Code.

2026-08-06 · verified 2026-08-13

Two CVEs published for MissionSquad mcp-api, a command injection and an SSRF, each fixed in a point release

VulDB assigned two CVEs for MissionSquad's mcp-api, one a command injection in its NPM package version handler and one an SSRF in its dynamic client registration code. Both records state a fixed version. VulDB supplied scores across three CVSS versions, which disagree substantially.

2026-08-06 · verified 2026-08-06

Official MCP Registry v1.8.1 blocks github.io domains after an organization namespace takeover path

The official MCP Registry released v1.8.1, rejecting github.io domains in its DNS and HTTP token-exchange verification paths. Before the fix, anyone able to publish to an organization GitHub Pages site could obtain publish rights over that organization's entire registry namespace. The fix was committed, released and promoted to production inside about 65 minutes, and carries no CVE or GHSA record.

2026-08-06 · verified 2026-08-07

AWS Labs DocumentDB MCP Server read-only mode bypassed via write-capable aggregation stages

An advisory states that the DocumentDB MCP Server's aggregate tool did not validate pipeline stages for write operations, so an authenticated MCP client could use $out or $merge to write to the connected database while the server was in its default read-only mode. AWS published a security bulletin the same day. A fixed version exists.

2026-08-05 · verified 2026-08-06

C# SDK v2.1.0 adds a public subscriptions/listen server handler and HTTP transport fallback fixes

The C# SDK published v2.1.0, its first release since v2.0.0 on 2026-07-28. It adds a public server-side handler for the subscriptions/listen method introduced by SEP-2575, and makes a client fall back to initialize when server/discover fails at the HTTP layer.

2026-08-05 · verified 2026-08-06

Google engineering post details the stateless rework behind the 2026-07-28 revision

Google published an engineering post on 2026-08-05 describing the stateless redesign in the MCP 2026-07-28 revision. The authors write that "Google led the charge to decouple the protocol from stateful transport constraints" and that Google co-founded the MCP Transports Working Group with Hugging Face and other industry partners. The post walks through the header-based routing model (Mcp-Protocol-Version, Mcp-Method, Mcp-Name), serverless deployment on Cloud Run and Cloud Functions, and cites the GitHub MCP Server as a production server that removed Redis session storage after upgrading.

2026-08-05 · verified 2026-08-14

Five MCP-related IBM Langflow OSS CVEs published to NVD, including an authentication bypass in the MCP composer endpoint

IBM's bulletin covering Langflow OSS MCP features was published 2026-07-31 and modified 2026-08-01, outside this window, but five of its CVEs reached NVD with a publication date of 2026-08-05. IBM marks five of the bulletin's seven CVEs as MCP-related. All CVSS numbers below are IBM's own.

2026-08-05 · verified 2026-08-06

MCP publishes an Agents Working Group charter naming Tasks stabilization as its primary deliverable

The MCP project published a charter for an Agents Working Group whose stated mission is making interactions with agent-backed systems interoperable over MCP. Its central deliverable is stabilizing the io.modelcontextprotocol/tasks extension and promoting it into the core protocol. The group is led by maintainers from Amazon Web Services and Microsoft.

2026-08-05 · verified 2026-08-07

MCP moves core maintainer Nick Aldridge to emeritus status

The MCP project moved Nick Aldridge from its core maintainers list to the emeritus section in MAINTAINERS.md and the governance documentation. The pull request states he is stepping back from the core maintainer role.

2026-08-05 · verified 2026-08-07

MCP Inspector 2.1.0 mirrors SEP-2243 x-mcp-header arguments to Mcp-Param-* on tools/call

The reference MCP Inspector published 2.1.0. The one functional protocol change is a fix implementing SEP-2243 header mirroring; the rest is repository hygiene restoring files dropped in the project's v2 tree swap plus dependency work clearing two advisories.

2026-08-05 · verified 2026-08-06

MongoDB's mongodb-mcp-server 2.0.0 removes session state and requires explicit connection ids

MongoDB published mongodb-mcp-server v2.0.0, removing session state and requiring an explicit connection id on all database operations. The release also adds multi-region and customer-managed-key options to cluster creation and rejects unrecognized tool arguments. The notes name no spec revision.

2026-08-04 · verified 2026-08-04

agent-device advisory: repository config could redirect remote-daemon credentials

Callstack published GHSA-m7q5-6423-2mwq for agent-device on 2026-08-03: a repository-supplied agent-device.json could point the CLI's remote-daemon calls at an attacker-controlled URL, sending the user's or CI's AGENT_DEVICE_DAEMON_AUTH_TOKEN to that endpoint. Medium severity, CWE-200, affecting 0.8.0 through 0.20.3; patched in 0.20.4. The local stdio MCP transport is not affected.

2026-08-03 · verified 2026-08-07

Notion's MCP endpoint adds support for protocol version 2026-07-28

Notion's developer changelog states that its Streamable HTTP MCP endpoint now supports protocol version 2026-07-28. It is the first vendor adoption to land after the release-day cluster of 2026-07-28 announcements.

2026-08-03 · verified 2026-08-06

Tadas Antanavicius steps down as a Registry Working Group lead

A self-submitted pull request removed Tadas Antanavicius from the Registry Working Group leads list, merged on August 2. The stated reason is freeing time for two adjacent catalog projects, AI Catalog and Server Cards. The same maintainer authored the organization-namespace authorization fix in registry v1.8.0.

2026-08-02 · verified 2026-08-04

MCP Ruby SDK cuts its first stable release, adds 2026-07-28 support, and is promoted to Tier 2

The Ruby SDK reached v1.0.0 on July 24, declaring its public API stable, picked up the 2026-07-28 revision in v1.1.0 on August 1, and was promoted from Tier 3 to Tier 2 in the official SDK listing on August 2.

2026-08-02 · verified 2026-08-04

Cloudflare MCP server portals accept pre-registered OAuth credentials for upstreams without dynamic client registration

Cloudflare added support for static OAuth client credentials in its Access MCP server portals, so a portal can connect to upstream MCP servers that require pre-registered clients. Administrators supply a client ID and secret along with custom endpoints, scopes and a token endpoint authentication method.

2026-07-31 · verified 2026-08-07

Rust SDK rmcp 3.1.0 adds SEP-2260 request association and conformance work meeting Tier 1 requirements

The MCP Rust SDK released rmcp 3.1.0, adding strict stateless protocol metadata validation, authorization error classification, and stream-based enforcement of client receive-side request association per SEP-2260. The release also documents Tier 1 features and includes conformance improvements meeting Tier 1 requirements. A follow-up 3.1.1 shipped on 2026-08-05.

2026-07-31 · verified 2026-08-07

Vercel MCP serves the 2026-07-28 revision in production three days after release

Vercel's first-party MCP server at mcp.vercel.com now supports the stateless 2026-07-28 specification, serving newer clients the stateless request model while 2025-era clients keep working from the same endpoint, via MCP SDK v2 and mcp-handler 2.0.

2026-07-31 · verified 2026-08-04

Vercel's mcp-handler 2.0.0 adopts 2026-07-28, answers /sse with 410 Gone, and drops its Redis dependency

Vercel published mcp-handler 2.0.0, serving the stateless 2026-07-28 protocol natively while keeping a compatibility layer for 2025-era Streamable HTTP clients. The release removes the legacy HTTP+SSE transport outright and turns the Redis dependency and session options into deprecated no-ops. It is a different artifact from the Vercel MCP server.

2026-07-30 · verified 2026-08-04

MCP server connections for GitHub Copilot code review reach general availability, limited to read-only

GitHub moved MCP server connections and agent skills for Copilot code review from public preview to general availability across its paid Copilot tiers. Tool calls made during a review are constrained to read-only, and the GitHub and Playwright MCP servers are enabled by default.

2026-07-29 · verified 2026-08-04

HashiCorp discloses five vulnerabilities across its Terraform and Consul MCP servers, two rated CVSS 10.0 in advisory records

HashiCorp published two security bulletins one day apart covering its Terraform MCP Server and Consul MCP Server. In both products the stateless-mode issue is a cross-tenant credential reuse flaw that the GitHub advisory records score CVSS 10.0. HashiCorp's own bulletins state no CVSS scores or severity labels.

2026-07-29 · verified 2026-08-04