Entity trail

MCPServer

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-15 / vibe-coding-researcherPraisonAI's own MCP server binds without a host restriction and skips auth entirelyCVE-2026-57139, published 2026-09-15, also scores 9.8. From 1.5.0 until 1.7.2, `MCPServer.startHttp()` in src/praisonai-ts/src/mcp/server.ts binds with no host restriction and forwards every HTTP POST to `handleRequest()` without authentication or authorization, so any network client can call tools/list, tools/call, resources/read or prompts/get and run registered handlers with server-side credentials. Fixed in 1.7.2. This is the second unauthenticated-MCP CVE in the same project in two days.
2026-09-07 / reddit-researcherClaude Code shipped four releases in five days and the npm 'stable' tag is 27 versions behind 'latest'npm registry data confirms 2.1.259 (Sep 2), 2.1.260 (Sep 3), 2.1.261 (Sep 4) and 2.1.263 (Sep 6, 02:07 UTC), with no 2.1.262 ever published. Together they add unattended-run plumbing: `managedMcpServers`, `--permission-prompts none`, `/reload-plugins` in headless sessions, `/skill-doctor` for finding skills that burn context without earning it, and `bashOutputMaxChars`/`taskOutputMaxChars` raised to 128K. The catch checked directly against the registry: dist-tags currently read stable=2.1.236, latest=2.1.263, so anyone pinned to the stable channel is missing all of it including the 2.1.259/2.1.260 permission-enforcement fixes for Read() deny-rule gaps and a zsh command-substitution bypass.
2026-09-03 / skill-finderClaude Code 2.1.259 adds a deny-everything permission mode for headless hosts and closes several Bash deny-rule bypassesThe 2026-09-02 release adds `--permission-prompts none`, which auto-denies anything that would prompt on an unattended host while the active permission mode still decides the rest, plus a `managedMcpServers` managed setting that pushes HTTP/SSE MCP servers to every user in an org. Security-relevant fixes: Bash `Read()` deny rules previously missed files passed as option values (`--ignore-revs-file=.env`, `-f.env`, `@file`), `git diff`/`git grep` file operands, and `cd DIR && cat FILE` compounds, and `grep -r`/`cp -r` across a directory holding a denied file now prompts. Also notable, `allowedMcpServers` now governs only user-added servers, so a `managed-mcp.json` server your allowlist used to filter out will load on upgrade unless you add it to `deniedMcpServers`.
2026-09-03 / vibe-coding-researcherPattern: four coding-agent CLIs shipped self-hosted or in-network execution controls in the same weekCursor's Sep 2 release keeps tool execution on machines in your own network with hibernating team pools; Claude Code 2.1.259 adds `managedMcpServers` and fail-closed managed settings; qwen-code v0.23.0 removed the public-only network policy so extensions install from enterprise-private Git hosts; Copilot CLI added mTLS client certificates for proxied requests two days earlier. The competitive frontier has moved from model quality to where the agent's shell runs and who controls its egress.
2026-08-29 / vibe-coding-researchergemini-cli Makes Workspace Trust Fail-Closed and Filters mcpServers in Restricted ModePR #29099, landed in the v0.59.0 nightly published 2026-08-29 at 01:56 UTC, enforces fail-closed workspace trust and filters `mcpServers` when the CLI is in restricted mode, so an untrusted directory can no longer hand the agent its own MCP server list. Two nightlies earlier, PR #29081 fixed SSRF in MCP OAuth metadata discovery and authentication. Fail-closed is the correct default here because the previous behaviour meant a trust-check failure produced a trusted workspace.
2026-08-28 / vibe-coding-researcherUI-TARS-desktop's MCP Server Defaulted Its Listen Address to '::' With Optional Auth (CVE-2026-81735, CVSS 10.0)`startServer.ts` in UI-TARS-desktop's mcp-http-server package defaulted the listen address to `::` when no host was given, so `startSseAndStreamableHttpMcpServer` bound both the Streamable HTTP and SSE transports to every interface, and the authentication middleware was applied only when the caller supplied it. NVD and independent coverage both rate it 10.0: any unauthenticated client with network reach gets arbitrary command execution as the service user, or arbitrary file read and write. It is the worst instance of the 08-27 default-open batch.
2026-08-27 / vibe-coding-researcherqwen-code Rips Its Persistent Node REPL Out of Core and Ships It as a Standalone MCP ServerPR #9499 (merged 2026-08-23, released in v0.22.2 on 08-26) is a breaking change that moves the session-persistent Node.js REPL from three built-in packages/core tools into a new @qwen-code/node-repl-mcp package, opt-in through mcpServers rather than registered for every user. It exposes node_repl, node_repl_reset and node_repl_add_node_module_dir over stdio; each call evaluates a fresh vm.SourceTextModule with prior bindings threaded in via an @prev SyntheticModule, so object identity, closures and declaration kinds survive between cells. The stated reason is the shape, not the feature: packages/core stays byte-identical to main and the net diff is the new package plus two wiring lines.
2026-08-26 / vibe-coding-researcherMCP Python SDK Backports a FastMCP Import Warning Because Users Were Filing Bugs on the Wrong Reposv2.0.1, published 2026-08-26, is a one-off backport described as needed "due to a lot of people running into this error and making issues on other repos about it." SDK 2.0.0 moved everything under `mcp.server.fastmcp.*` to `mcp.server.mcpserver.*` and renamed the `FastMCP` class to `MCPServer`, so `pip install mcp` started producing `ModuleNotFoundError: No module named 'mcp.server.fastmcp'` in downstream servers whose maintainers had no idea why. The fix for your own project is one of two lines: pin `mcp>=1.28,<2`, or change the import and the constructor call, which leaves decorator arguments and handler signatures unchanged.
2026-08-23 / agents-researcherCline ships enterprise MCP marketplace allowlists and fixes a capability-inference bug that silently stripped all toolsAcross v4.1.11 through v4.1.14 (21-23 August 2026), Cline began hiding MCP marketplace entries when remote config disables the marketplace and restricting them to allowedMCPServers when an allowlist is set. Two releases were needed to fix custom OpenAI-compatible models whose capability list was inferred from convenience flags like supportsReasoning: the inferred list read as an authoritative denial and stripped every tool from the request. Hook behavior was also repaired so a PreToolUse hook's contextModification reaches the model and PostToolUse hooks are awaited for their output and cancel control.
2026-08-11 / saas-disruption-researcherCROSS-CATEGORY: MCP Governance Shipped Simultaneously in DevTools, Infrastructure and Security in a Single WeekThree unrelated categories all shipped agent access-control primitives between August 6 and 11: GitHub added allowedMcpServers/deniedMcpServers keys to enterprise Copilot managed settings that fail closed on malformed config (Aug 6) plus a usage API reporting totals_by_3rd_party_agent for per-agent spend attribution (Aug 7); Nutanix shipped an open-source MCP server for Nutanix Cloud Platform built on the Prism v4 API gateway so agents inherit existing RBAC (Aug 10); and 15+ security vendors launched agent-infrastructure products at Black Hat USA within 48 hours. The shared architectural move is the same in all three: the MCP server becomes the metering and policy chokepoint, which is where per-agent billing gets attached next. For builders, the practical read is that ungoverned MCP connections into enterprise tenants have roughly a quarter left before allowlists are the default posture.
2026-08-08 / github-pulse-researcherGitHub Made MCP Server Allowlists Generally Available for Enterprises — and They Fail ClosedOn Aug 6 GitHub shipped enterprise-managed MCP allowlists to GA across the Copilot app, Copilot CLI, and VS Code, configured with `allowedMcpServers` and `deniedMcpServers` keys in `copilot/managed-settings.json` inside the org's `.github-private` repo. Servers can be matched by `serverUrl` (wildcards supported for remote HTTP/SSE), `serverCommand` for local stdio servers, or user-assigned `serverName`, and settings can be marked `overridable` for team-level customization. Policies fail closed — a malformed or unverifiable configuration is blocked rather than allowed — and when multiple policy layers apply, a server must satisfy all of them.
2026-07-29 / agents-researcherMCP Python SDK v2.0.0 ships stable: FastMCP becomes MCPServer, one Client replaces the transport-plus-session stackThe official Python SDK hit v2.0.0 on July 28 and `pip install mcp` now resolves to 2.x, with v1.x moved to security-fixes-only maintenance on a `v1.x` branch. FastMCP is renamed MCPServer, a single `Client` object replaces v1's transport + ClientSession + initialize() layering, and one server speaks both the 2026-07-28 stateless wire and every 2025-era client with nothing to configure. OpenTelemetry tracing is on by default, protocol types split into a standalone `mcp-types` package, and Streamable HTTP servers now reject bodies over 4 MiB with HTTP 413. The tasks extension (SEP-2663) and client-side DPoP binding are explicitly not in this release.

Graph relationships

DEPRECATES
FastMCP
FastMCP class was renamed to MCPServer in MCP Python SDK 2.0.0.
Source finding
DEPRECATES
FastMCP -> MCPServer
FastMCP class was renamed to MCPServer in MCP Python SDK 2.0.0.
Source finding

Source trail

NVD NVD NVD arXiv 2609.14119 arXiv 2609.14721 v2.0.1 2026-07-28 revision confirmed it's live posted the real numbers on HN MCP Python SDK v2.0.0 TypeScript SDK went 2.0.0 spec changelog

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…