[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to v2/main, this PR will be updated.

Releases

@modelcontextprotocol/server-everything@2.2.0

Minor Changes

• #5389 35bed66 @cliffhall - Add light- and dark-themed icons (SEP-973) to the server info and to every tool, prompt, resource and resource template, in both protocol eras.

• #5365 3f867a0 @cliffhall - Add a resource collection example: reading demo://resource/collection/summer-specials, or the demo://resource/collection/by-category/{category} template, returns several contents in one resources/read, each under its item's own demo://resource/collection/item/{itemId} URI, which reads back on its own. Both templates complete their variable.

Patch Changes

• #5396 25b4a5d @cliffhall - trigger-long-running-operation now honors cancellation in both protocol eras: a cancelled call clears its pending timer and sends no further progress, so it no longer delays stdio shutdown (#1124, #4846).

• #5350 4b54ad6 @cliffhall - resource-prompt now names the values its arguments accept in prompts/list: resourceType must be "Text" or "Blob", and resourceId must be a positive integer. Prompt arguments carry no schema, so clients had no way to learn these before calling the prompt.

@modelcontextprotocol/server-filesystem@2.2.0

Minor Changes

• #5395 99ba0c6 @cliffhall - Add a --confine-roots command-line flag. With it, a 2025-era client's Roots can narrow the command-line directories but never replace or widen them: a root inside a command-line directory is allowed, a root containing one is narrowed to it, and a root outside all of them is ignored and logged. Without the flag, Roots replace the command-line directories as before.

• #5359 ea2997b @cliffhall - Add a --read-only command-line flag. With it the server registers only the tools annotated readOnlyHint: true, so every tool that writes (such as write_file and edit_file) is not listed and cannot be called, on both protocol eras and whether the directories come from the command line or a client's Roots. -- now ends the options, so a directory named like an option can still be given after it.

• #5376 af8a01b @cliffhall - Add an append_file tool that appends text to the end of a file, exactly as given, creating the file if it does not exist (#1208).

• #5385 65e68d3 @cliffhall - Add a copy_file tool that copies one regular file to a new location, keeping its permissions and modification time, and never overwrites an existing destination (#519).

• #5388 3a2e1fd @cliffhall - Add an optional depth parameter to directory_tree that limits how many levels the tree descends; omitted, the whole tree is returned as before (#1077).

• #5368 3f173d6 @cliffhall - Expose files in the allowed directories as MCP resources through a file://{+path} resource template, so a client can read a file with resources/read (text or a base64 blob by MIME type), confined to the allowed directories exactly as the tools are. resources/list stays empty, so the server never enumerates the disk.

Patch Changes

• #5390 6017ed3 @cliffhall - Log the effective allowed directories to stderr, with their source, at startup and whenever they change: from the command line, or from the client's Roots (saying whether those replaced the command-line directories), or none, with why every path is now refused. Previously the server logged only a count of valid Roots.

• #5380 d665e43 @cliffhall - Report a dangling symlink as a broken symlink. A request through a symlink whose target does not exist is still refused, but the error now names the symlink instead of saying its parent directory, which exists, does not.

• #5379 6575d87 @cliffhall - edit_file: when an edit's oldText matches nowhere, the error now names which edit failed, states the matching rules, and quotes the closest lines of the file with line numbers, plus the first differing line JSON-quoted so a whitespace difference is visible. The tool description now states the matching rules too. What matches is unchanged.

• #5384 eed581e @cliffhall - Expand ~\ to the home directory on Windows, in command-line directories, request paths and client Roots alike, as ~/ already is. On POSIX a backslash is a filename character, so ~\name there still names a literal file.

• #5377 fbddfb0 @cliffhall - read_text_file (and the deprecated read_file) now treats head: 0 or tail: 0 as a request for zero lines and returns empty text, instead of the whole file. head and tail accept only non-negative integers, and head with tail is rejected even when either is 0.

• #5353 1a7b9f9 @cliffhall - Every read-only tool (read_file, read_text_file, read_media_file, read_multiple_files, list_directory, list_directory_with_sizes, directory_tree, search_files, get_file_info and list_allowed_directories) now also sets idempotentHint: true and destructiveHint: false, so all four tool annotation hints are explicit on every tool and a client never falls back to the spec's defaults (destructive, not idempotent).

• #5383 22ce3e5 @cliffhall - Keep an allowed directory's name exactly as the file system spells it. A command-line directory, or a client Root's realpath, whose name ends in a space or a quote was trimmed, so the server allowed the sibling directory without that suffix (and refused the directory that was actually given).

• #5351 13c781a @cliffhall - Drop the unused glob runtime dependency: nothing in the server imported it (pattern matching goes through minimatch), so installing the server no longer downloads glob and its own dependencies.

• #5378 9192ea3 @cliffhall - list_directory_with_sizes no longer reports an entry it could not stat (unreadable, a dangling symlink, removed mid-listing, or a symlink leaving the allowed directories) as 0 B. Such an entry is shown with size unknown, sorts last by size, and is left out of the combined size, which notes how many files it excludes.

• #5367 4441e23 @cliffhall - The search_files description now says plainly that it finds files and directories by name, not by content, and that its glob is matched case-sensitively against each entry's path relative to path (not the working directory), so a model no longer reaches for it to grep file contents.

• #5355 135a925 @cliffhall - search_files no longer drops a subdirectory it cannot read without saying so. It still returns the matches it found, and now follows them with a note that the search is incomplete, listing each unreadable directory and its error code. Paths outside the allowed directories are still skipped silently, and an unreadable starting directory is still an error.

@modelcontextprotocol/server-memory@2.1.0

Minor Changes

• #5394 27148ef @cliffhall - Add optional lightweight read modes, so a large graph need not be returned whole: observationLimit on read_graph, search_nodes and open_nodes caps the observations returned per entity and adds each entity's total as observationCount (0 gives an overview of names, types and counts), entityTypes on read_graph keeps only entities of those types, and limit on search_nodes caps the number of matches. Calls without them return what they always have. The read_graph description now says when to use it rather than search_nodes or open_nodes.

Patch Changes

• #5362 3a412f5 @cliffhall - Warn on stderr at startup when the memory file is inside a node_modules directory, where reinstalling or updating the server, or clearing the npx cache, can delete it, and recommend in the README setting MEMORY_FILE_PATH to an absolute path you own. The default path is unchanged.

• #5349 d7ebd6f @cliffhall - create_entities, create_relations and add_observations now declare idempotentHint: true. Each already skips what is stored, so repeating a call with the same arguments has no additional effect on the graph, as with the delete tools.

• #5357 01062fc @cliffhall - add_observations stores an observation repeated within one call once, and reports it once in addedObservations, instead of storing it twice.

• #5393 942d8f1 @cliffhall - The search_nodes and open_nodes tool descriptions now say when to use each one and which sibling read tool to prefer instead, so a model looks an entity up by name with open_nodes, searches by keyword with search_nodes, and leaves read_graph for when it needs the whole graph.

@modelcontextprotocol/server-sequential-thinking@2.1.0

Minor Changes

• #5397 93f89b1 @cliffhall - Bound the thought history each connection keeps: at most MAX_THOUGHT_HISTORY thoughts (default 1000) are retained, the oldest dropped first and from its branch too, so a long-lived connection no longer grows memory without bound.

Patch Changes

• #5361 9a1cdf3 @cliffhall - Draw a multi-line thought one row per line in the stderr thought box, sized to the longest line, instead of as one broken row (#5205)

• #5352 59b7f9d @cliffhall - Remove the unused yargs dependency (and @types/yargs), so installing the server no longer pulls in yargs and its transitive packages.

• #5374 c4d0cc4 @cliffhall - Trim the sequentialthinking tool description from 2,781 to 1,009 characters (about 566 to 198 tokens), so it fits the 1,024-character cap OpenAI and Azure OpenAI put on tool descriptions (#799). The "Key features" and "Parameters explained" sections are gone: each parameter is still described by the input schema, which is unchanged, and the guidance those field descriptions do not carry is kept (#4507).