We run the official MCP reference servers from the modelcontextprotocol/servers repo (git, filesystem, fetch, everything) with our coding agent. Which versions have known vulnerabilities, which versions fix them, and is it enough to upgrade?

What should I check, step by step?

1. Find what you actually run: check each MCP client config for npx, uvx, pip or Docker entries that start mcp-server-git, mcp-server-fetch, @modelcontextprotocol/server-filesystem or @modelcontextprotocol/server-everything, and note the version each one resolves to.

2. Upgrade mcp-server-git to 2026.10.28 or later (latest 2026.11.4) and mcp-server-fetch to 2026.10.24 or later (latest 2026.11.4).
3. Upgrade the npm servers to 2.0.1 or later (filesystem latest 2.2.0, everything latest 2.2.1). Replace any date-based pin such as 2026.8.31: those versions are deprecated and none of them carries the October 2026 fixes.
4. Pin the exact version you reviewed rather than using latest, and re-read the advisories page before each upgrade.
5. Start the git server with --repository for the one repository the agent needs, and the filesystem server with only the directories it needs; add --read-only to the filesystem server when the task only reads.
6. Don't give a filesystem server write access to a directory that a confined git server also serves: the nested .git file advisory names that combination as a realistic way to plant the redirect.
7. Keep mcp-server-fetch's default private-address guard on (don't pass --allow-private-ips), and add --allowed-hosts when the agent only needs a few sites.
8. Never run the everything server outside a test machine, and never with GET_ENV_INCLUDE_SECRETS set.
9. Run these servers inside an OS sandbox or container with only the files and network they need, because confinement inside the server has been bypassed several times.

Which vulnerabilities affect the official MCP git, filesystem, fetch and everything servers, and which versions fix them?

mcp-server-git: CVE-2025-68143 (the git_init tool could create a repository anywhere; fixed in 2025.9.25 by removing the tool), CVE-2025-68144 (argument injection in git_diff and git_checkout, for example a --output flag passed as a ref, could overwrite files) and CVE-2025-68145 (repo_path wasn't checked against --repository), both fixed in 2025.12.18. CVE-2026-27735 (git_add staged files outside the repository via ../ paths) was fixed in 2026.1.14. On October 28, 2026 a further advisory (GHSA-w766-5x43-whvw, CVSS 3.1 5.3) showed that a directory inside the allowed repository holding a .git file with a gitdir: line pointing elsewhere let tool calls read and change another repository; it's fixed in 2026.10.28.

• @modelcontextprotocol/server-filesystem: the 2025 symlink and prefix-collision bypasses (CVE-2025-53109 and CVE-2025-53110) were fixed in mid-2025. Four more advisories published on October 25, 2026 (UTC) are fixed in 2.0.1: a case-variant symlink name on case-insensitive file systems such as macOS and Windows defaults (a regression in 2026.8.31, 1.0.0 and 2.0.0), a trailing quote or whitespace that passed the check but opened a sibling directory, a race on the parent directory when creating files, and list_directory_with_sizes leaking the size of files outside the allowed directories through symlinks.
• mcp-server-fetch: three advisories published on October 25, 2026 (UTC) are fixed in 2026.10.24. robots.txt was checked only for the first URL, so a redirect could reach a disallowed page; and the private-address guard added in 2026.10.10 could be bypassed with internationalized host names (the check and the connection resolved different names) and, on NAT64 networks, with the 64:ff9b::/96 prefix that can route to a cloud metadata address.
• @modelcontextprotocol/server-everything: its HTTP transports listened on all interfaces with wildcard CORS and no authentication while a get-env tool returned the whole environment, so any web page in the browser could read the server's secrets (GHSA-mvf5-2qqv-rg3c, CVSS 3.1 6.5). It's fixed in 2.0.1; the README now says browser requests are accepted only from a localhost Origin and credential-like variables are masked unless GET_ENV_INCLUDE_SECRETS is set.

Why is @modelcontextprotocol/server-filesystem 2026.8.31 older than 2.0.1?

The npm reference servers were published with date versions (2025.1.14 through 2026.8.31) and then resumed semantic versioning at 1.0.0 on October 11, 2026. Every date-based version is now deprecated on npm with the message that date-based versions are no longer published. The October 2026 filesystem and everything advisories list no patched date-based version; the fix is 2.0.1. A version check that compares numbers will rank 2026.8.31 above 2.0.1, so check against the advisory ranges, not by which number is bigger.

• The Python servers kept date versions. mcp-server-git and mcp-server-fetch both released 2026.10.10, 2026.10.19 and 2026.11.4; the fetch fix shipped as 2026.10.24 and the git fix as 2026.10.28. If you start them with uvx and no version, you get whatever is latest when the cache refreshes, which is fine for fixes but means a reviewed version can change under you.

Are the official MCP reference servers safe to use in production?

The repository README warns that these servers are reference implementations meant to demonstrate MCP features and SDK usage, not production-ready solutions, and that you should apply safeguards for your own threat model. Most of the advisories are path or address checks that were bypassed with an unusual input, and the model supplies those inputs. The security firm that reported the 2025 git flaws (Cyata) showed they could be triggered through prompt injection, such as a poisoned README or issue the assistant reads, and chained with the filesystem server writing a .git/config to run code.

• So treat the server's own confinement as one layer. Give each server the narrowest directory, repository and host list it needs, prefer read-only modes, run it in a sandbox the model can't change, and require a person to approve writes, commits and pushes that came out of a task where the agent read untrusted content.