MCP servers v2.1.0 security fixes, promptfoo 0.125.0
Updated 1 min read
Summary
Agent Radar 2026-10-26: MCP reference servers v2.1.0 fixes eight advisories; promptfoo 0.125.0 makes Claude Agent and Codex SDKs opt-in.
Agent Radar tracked two launches as of 2026-10-26, covering the window 2026-10-23 to 2026-10-26. The headline item is MCP servers v2.1.0, a security release for three of the reference Model Context Protocol servers.
At a glance
| Launch | Tool | Released | What changed |
|---|---|---|---|
| MCP servers v2.1.0 fixes eight security flaws | Model Context Protocol Servers | 2026-10-25 | Eight advisories fixed in the filesystem, everything and fetch servers |
| promptfoo 0.125.0 makes Claude Agent and Codex SDKs opt-in | promptfoo | 2026-10-23 | Two breaking dependency changes, safe mode, repeat-stability reports, ROUGE assertions |
What changed
- MCP reference servers: v2.1.0, published October 25, 2026, ships
server-filesystemandserver-everything2.0.1 andmcp-server-fetch2026.10.24. The filesystem fixes close symlink and path-check escapes, the everything server stops accepting cross-origin requests, and the fetch server tightens its internal-address checks. More on the MCP servers hub. - promptfoo: 0.125.0, published October 23, 2026, makes the Claude Agent SDK, Codex SDK and
jks-jsoptional peer dependencies and adds--safe-modefor inline JavaScript. A 0.125.1 patch followed on October 25. See the promptfoo hub.
Questions
Which item needs action first? MCP servers v2.1.0. If you run the filesystem server, the everything server over HTTP or the fetch server, upgrade, and pin 2.0.1 explicitly if you are still on a date-versioned npm release.
Which item can break an existing setup? promptfoo 0.125.0. Evals that use the Claude Agent or Codex providers, or JKS authentication, need those packages installed separately.
New comparison today: E2B vs Daytona. Related reading: E2B alternatives.
In this issue
Rank 1 MCP servers v2.1.0 fixes eight security flaws
Model Context Protocol Serversmodelcontextprotocol/servers v2.1.0 (October 25, 2026) fixes eight advisories in the filesystem, everything and fetch servers. Upgrade those three.
Category: MCP servers
Pricing: Not stated
Rank 2 promptfoo 0.125.0 makes Claude Agent and Codex SDKs opt-in
promptfoopromptfoo 0.125.0 (October 23, 2026) makes the Claude Agent, Codex and jks-js packages opt-in, adds a safe mode and reports flaky repeated tests.
Category: Agent infra
Pricing: Open source
