MCP servers v2.4.0 security fixes, Pipecat 1.16 diarization
Updated 1 min read
Summary
Agent Radar 2026-11-12: MCP servers v2.4.0 fixes six advisories in filesystem, git and fetch; Pipecat 1.16 adds speakers and drops soxr. Plus Pipecat alternatives.
Agent Radar tracked two launches as of 2026-11-12, covering the window 2026-11-05 to 2026-11-12 for tools we have not written about this week. Preview, nightly, alpha, dev and release-candidate builds were left out.
At a glance
| Launch | Tool | Released | What changed |
|---|---|---|---|
| MCP servers v2.4.0 fixes six flaws in filesystem, git, fetch | MCP servers | 2026-11-11 | Six advisories; git config could run programs; filesystem read and move races; fetch IPv6 and robots.txt bypasses |
| Pipecat 1.16.0 adds diarization speakers and drops soxr | Pipecat | 2026-11-12 | speaker field on transcripts; Gemini Interactions, Zoom AI and Rime services; resampy and soxr leave core; Hume TTS deprecated |
What changed
- Upgrade
mcp-server-gitfirst: a read-only call on an untrusted repository could run a program named in its.git/config. The fix is in 2026.11.11. - Date-versioned filesystem installs will not auto-update: install
@modelcontextprotocol/server-filesystem@2.3.0explicitly. - Pipecat users should check four things: diarization in
speakerinstead ofuser_id, missingsoxr/resampy, empty function results now running the LLM, and Hume TTS shutting down on November 13.
Questions
Which MCP servers need an update today? The filesystem server (to 2.3.0) and the Python git and fetch servers (to 2026.11.11). Memory and time had no advisories.
What can replace Pipecat? Our new guide, Pipecat alternatives, covers LiveKit Agents, the OpenAI Agents SDK, TEN Framework, Vapi and Retell AI. More options are in the voice agents category.
In this issue
Rank 1 MCP servers v2.4.0 fixes six flaws in filesystem, git, fetch
Model Context Protocol Serversmodelcontextprotocol/servers v2.4.0 (November 11, 2026) fixes six advisories. Upgrade server-filesystem to 2.3.0 and mcp-server-git and fetch to 2026.11.11.
Category: MCP servers
Pricing: Not stated
Rank 2 Pipecat 1.16.0 adds diarization speakers and drops soxr
PipecatPipecat 1.16.0 (Nov 12, 2026) adds a speaker field for diarization, Gemini Interactions and Zoom AI services, and drops resampy and soxr from core.
Category: Voice agents
Pricing: Open source
