unstale

npm / @modelcontextprotocol/server-everything

@modelcontextprotocol/server-everything

What changed in @modelcontextprotocol/server-everything 1 to 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-11-12.

6 breaking2 security2 new APIs and options2 behavior and defaults15 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.12 on npm

@modelcontextprotocol/server-everything 218 changes

Breaking changes 6

  • HTTP transports bind to loopback by default; set HOST to widen the bind address.

    2.4.0release notes

  • Credential-like values are masked by default.

    2.2.0release notes

  • The tool now fails when the HTTP response is an error.

    2.2.0release notes

  • The tool now refuses non-public addresses on every hop.

    2.2.0release notes

  • HTTP and SSE transports check the Origin header and refuse requests from other web origins, preventing web pages from calling server tools or reading their results.

    2.1.0release notes

  • The TypeScript servers' Node floor is raised to 24, affecting which Node.js versions developers can use to run the server.

    2.0.0release notes

Security 2

  • Server images run as their non-root user.

    2.4.0release notes

  • TypeScript servers run on the user's Node.js runtime; use Node.js 24.22.1 or 26.12.1, or later, to receive the security updates.

    2.2.0release notes

New APIs and options 2

  • The Docker image supports a Streamable HTTP mode, giving developers another way to run the server.

    2.3.0release notes

  • Light and dark themed icons are added to every primitive.

    2.3.0release notes

Behavior and default changes 1

  • The server supports the modern era spec while continuing to answer legacy era clients.

    2.0.0release notes

Fixes and other changes 7

  • Task/update answers are counted in UTF-8 bytes rather than characters.

    2.4.0release notes

  • Every tool input property is described, helping developers understand the tool inputs.

    2.4.0release notes

  • A cancelled long-running operation now stops instead of continuing to run.

    2.3.0release notes

  • The gzip-file-as-resource resource now has resource icons.

    2.3.0release notes

  • Names the resource-prompt's allowed argument values so developers can understand the available choices.

    2.3.0release notes

  • The tool's PNG output no longer includes the corrupt iCCP chunk.

    2.2.0release notes

  • The elicitation request summary now summarizes the form's own fields.

    2.2.0release notes

@modelcontextprotocol/server-everything 19 changes

Behavior and default changes 1

Fixes and other changes 8

  • Async task tools stay within their client task.

    1.0.0release notes

  • Instructions qualify capability-gated tools.

    1.0.0release notes

  • Dynamic blob resources are labeled application/octet-stream.

    1.0.0release notes

  • Unknown and duplicate HTTP+SSE sessions are handled.

    1.0.0release notes

  • Session resources are scoped to their server.

    1.0.0release notes

  • SSE reports that a port is already in use instead of reporting that the server is running.

    1.0.0release notes

  • Streamable HTTP returns 404 for unknown sessions, replays per stream, and closes sessions on shutdown.

    1.0.0release notes

  • Subscriptions are cleaned up when a session disconnects.

    1.0.0release notes