# What changed in @modelcontextprotocol/server-everything > 27 changes in @modelcontextprotocol/server-everything 1 to 2 from its official release notes, upgrade guides and advisories: 6 breaking, 2 security, 2 new APIs and options. Each one cited. Sources checked 2026-11-12. HTML: https://unstale.sh/npm/@modelcontextprotocol/server-everything/ To see which of these apply to a repository, run `npx @unstale/cli init` in it. ## @modelcontextprotocol/server-everything 2 ### Breaking changes - HTTP transports bind to loopback by default; set HOST to widen the bind address. (2.4.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v2.4.0) - Credential-like values are masked by default. (2.2.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v2.2.0) - The tool now fails when the HTTP response is an error. (2.2.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v2.2.0) - The tool now refuses non-public addresses on every hop. (2.2.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v2.2.0) - HTTP and SSE transports check the Origin header and refuse requests from other web origins, preventing web pages from calling server tools or reading their results. (2.1.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v2.1.0) - The TypeScript servers' Node floor is raised to 24, affecting which Node.js versions developers can use to run the server. (2.0.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v2.0.0) ### Security - Server images run as their non-root user. (2.4.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v2.4.0) - TypeScript servers run on the user's Node.js runtime; use Node.js 24.22.1 or 26.12.1, or later, to receive the security updates. (2.2.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v2.2.0) ### New APIs and options - The Docker image supports a Streamable HTTP mode, giving developers another way to run the server. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v2.3.0) - Light and dark themed icons are added to every primitive. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v2.3.0) ### Behavior and default changes - The server supports the modern era spec while continuing to answer legacy era clients. (2.0.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v2.0.0) ### Fixes and other changes - Task/update answers are counted in UTF-8 bytes rather than characters. (2.4.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v2.4.0) - Every tool input property is described, helping developers understand the tool inputs. (2.4.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v2.4.0) - A cancelled long-running operation now stops instead of continuing to run. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v2.3.0) - The gzip-file-as-resource resource now has resource icons. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v2.3.0) - Names the resource-prompt's allowed argument values so developers can understand the available choices. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v2.3.0) - The tool's PNG output no longer includes the corrupt iCCP chunk. (2.2.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v2.2.0) - The elicitation request summary now summarizes the form's own fields. (2.2.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v2.2.0) ## @modelcontextprotocol/server-everything 1 ### Behavior and default changes - The request is gated on form mode. (1.0.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v1.0.0) ### Fixes and other changes - Async task tools stay within their client task. (1.0.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v1.0.0) - Instructions qualify capability-gated tools. (1.0.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v1.0.0) - Dynamic blob resources are labeled application/octet-stream. (1.0.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v1.0.0) - Unknown and duplicate HTTP+SSE sessions are handled. (1.0.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v1.0.0) - Session resources are scoped to their server. (1.0.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v1.0.0) - SSE reports that a port is already in use instead of reporting that the server is running. (1.0.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v1.0.0) - Streamable HTTP returns 404 for unknown sessions, replays per stream, and closes sessions on shutdown. (1.0.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v1.0.0) - Subscriptions are cleaned up when a session disconnects. (1.0.0) — [release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v1.0.0)