Daily signal: MCP's reference servers move to the new spec era and break their own upgrade path, while Tasks client support and file downloads enter the specification queue
The MCP project's reference servers moved to the 2026-07-28 specification and to semantic versions between 11 and 25 Oct, and the semver switch is why a security release can go unnoticed. The specification itself had no release; documentation merges add Tasks to the client support matrix and widen the File Uploads group to downloads.
Covers Mon 26 Oct 08:00 CET to Tue 27 Oct 08:00 CET
Short, deliberately. No new MCP specification, TypeScript SDK (2.4.0), Python SDK (2.3.0) or A2A (v1.0.1) release since the 26 Oct signal, and I verified no new frontier or open-weight model release in the window (search results were dated July to September or aggregator claims without a vendor page; a reported OpenAI decision of 28 Sep to withdraw a planned model over safety findings is outside the window and rests on press only, so I do not cover it). Claude Code 2.1.311 (26 Oct) and Codex 0.164.0 (with unannotated alpha builds 0.165 and 0.166 on 26 and 27 Oct) add little. GitHub pages were the only reachable primary sources; modelcontextprotocol.io did not resolve. Vulnerabilities from the reference servers are in the [security brief](/reports/2026-10-27-security-brief/).
In brief
- Reference servers: v1.0.0 (11 Oct) moved the TypeScript packages from date versions to semver, v2.0.0 (19 Oct) rebuilt them on the new specification and SDK v2 (Node 24 floor, Python servers need mcp 2.3 or later), and v2.1.0 (25 Oct) shipped eight security fixes. Date-versioned installs are never offered 2.0.x by a package manager.
- Client-visible change in 2.0.0: an unknown tool now returns a JSON-RPC -32602 error instead of an isError result, which agents that parse the old shape may mishandle.
- Specification repository: Tasks Extension added to the client support matrix (merged 26 Oct); a follow-up marks Tasks support for Claude Code and Claude.ai (open). File Uploads group charter widened to downloads (merged 26 Oct). Meetings ban third-party AI notetaker bots (merged 26 Oct).
- SDKs and protocols: nothing new. TypeScript 2.4.0 (23 Oct), Python 2.3.0 (2 Oct), A2A v1.0.1 (28 May). Security work in the queue is SEP-2809 (attested tool-server admission, open since 28 May) and the Security Interest Group restructure (PR 3331).
- Coding agents: Claude Code 2.1.311 fixes a Linux sandbox failure when read blocking is on; Codex 0.164.0 is still the latest stable build. No new permission-layer bypass fixes this window.
The reference servers’ version scheme is now a security control
What happened. Three releases of modelcontextprotocol/servers in two weeks changed how the reference servers are built and numbered. v1.0.0 (11 Oct) was the last release on the older protocol and moved the TypeScript packages from date versions (2025.x, 2026.x) to semantic versions, leaving the Python packages on date versions. v2.0.0 (19 Oct) refactored the servers to the current specification while still answering older clients, moved the TypeScript servers to SDK v2 with a Node 24 floor, and rebuilt the Python servers (fetch, git, time) on the Python SDK’s MCPServer class, which requires mcp>=2.3,<3. v2.1.0 (25 Oct) is the security release described in the security brief. I read the release notes and checked the npm and PyPI registries: the npm latest tag is 2.0.1 for both packages I looked at, 2.0.1 was published 25 Oct at 00:05 UTC, and mcp-server-fetch is at 2026.10.24.
Analysis. Two changes bear on security beyond the fixes themselves. First, versioning. A package manager treats 2026.8.31 as higher than 2.0.1, so range-based updates, npm outdated and dependency bots do not offer the move to 2.x, and the project says so in its advisories. That makes the version scheme part of the update channel: when a project changes it, every automated safety net keyed on ‘newer version’ goes quiet for those who pinned the old scheme. Second, a client-visible behaviour change in 2.0.0: an unknown tool name now gets a JSON-RPC -32602 error instead of a result flagged isError, tool error and validation text changed, and servers now advertise prompts and resources capabilities. The release notes do not label these as breaking. Agent code that handles tool failure by inspecting the old result shape, or that tells a model ‘the tool failed, try again’ on a protocol error, behaves differently; a retry loop on a hard error is a resource and a cost problem, and in some designs an injection channel (an attacker-influenced error string is fed back to the model). This is my inference; I have not tested a client.
Why it matters. The reference servers are what teams copy into their own agents. Most downstream copies will not see an upgrade prompt, so the project’s advisories reach fewer people than the CVE count suggests.
Mitigation and detection. Treat the reference servers as vendored code with an owner: pin by exact version, subscribe to the modelcontextprotocol/servers release feed, and add a CI check that compares your pinned version with the registry’s latest tag. Re-run client tests against 2.x servers before upgrading, with attention to tool-failure handling.
Recommendation (opinion): upgrade deliberately, not by range. Do the move to 2.x as a planned change with client tests, because the behaviour shift is real, but do it this week for filesystem and everything because of the fixes.
Sources: servers releases (v1.0.0, v2.0.0, v2.1.0) · npm: server-filesystem · PyPI: mcp-server-fetch
Specification repository: documentation moves, nothing normative
What happened. The specification and SDK remain at 2026-07-28 with no release. Merged on 26 Oct: pull request 3355 adds the Tasks Extension to the extensions client support matrix (commit 54b91cd); pull request 3446 widens the File Uploads Working Group charter so that server-to-client file downloads are a secondary item, where it previously listed them as out of scope because Resources already carry small files; pull request 3457 bars third-party AI notetaker bots and unofficial recording from community meetings, citing capture of participants’ words without consent. Open: pull request 3459 marks Tasks support for Claude Code and Claude.ai. Dependency bumps (vite, markdown-it, others) account for the rest of the commits; the pages do not say whether any is a security fix.
Analysis. Tasks (long-running work) is moving from specification text toward real client support, and the server side of it is where the flaws have been: the TypeScript SDK’s experimental tasks were not tied to the creating session until the 20 Oct advisory (CVE-2026-111767, covered 21 Oct), and the Events proposal’s webhook-style delivery is under review for the same ownership questions. As clients start sending task requests, a server’s task store and its binding of a task to its owner decide whether one user can read or cancel another’s work; that is a server-implementation property that the support matrix does not say anything about. File downloads are the other item. The charter says downloads are needed for files too large for a JSON-RPC message and for files that need authorization to fetch; the moment a protocol adds an out-of-band fetch URL, the usual questions return: who issues it, how long it lives, whether it is bound to the caller, and whether a server can be made to fetch an internal address (the fetch-server SSRF class this week). The charter text on those points is not in the pull request, so they are open questions, not findings. The notetaker-bot rule is a small confidentiality control, relevant because working-group calls discuss unfixed security issues; the pull request does not give that as the reason.
Why it matters. Both Tasks and downloads create state and URLs held on behalf of a caller, and the project’s history with that class (session binding, cross-client delivery, SSRF guards) says the defaults will be set by SDKs and host products, not by the matrix.
Mitigation and detection. If you write an MCP server that will offer Tasks, store the authenticated principal with each task and check it on every read, cancel and subscribe; if you host files for download, issue short-lived, caller-bound links. Watch pull request 3459 and the File Uploads group for threat-model text.
Recommendation (opinion): ask for the security section before you adopt. When a client or SDK announces Tasks or download support, ask the vendor how a task is bound to its owner and how download links are scoped.
Sources: PR 3355 · PR 3446 · PR 3457 · open pull requests · SEP-2809
Coding agents, SDKs, protocols and models: what did not move
Claude Code 2.1.311 (26 Oct) fixes sandboxed Bash failing with a bwrap error when a plugin folder is also an added directory and read blocking outside the working directory is on, stops retrying requests the API marks as not retryable, and makes DISABLE_COMPACT in settings files only able to turn compaction off. The sandbox fix matters mildly: a sandbox that fails closed pushes users to switch it off, so reliability bugs are a security problem too. Codex 0.164.0 (23 Oct) is still the latest stable build; builds 0.165 and 0.166 on 26 and 27 Oct are pre-releases without notes. The MCP TypeScript SDK is at 2.4.0, the Python SDK at 2.3.0 and A2A at v1.0.1, as on 26 Oct. I found no confirmed model release, system card or pricing change in the window.
Sources: Claude Code releases · Codex releases · TypeScript SDK releases · Python SDK releases · A2A releases