From e95f39e5d590dae512f5098a9b7822dadde16893 Mon Sep 17 00:00:00 2001 From: Will-hxw <1176843521@qq.com> Date: Tue, 21 Apr 2026 04:35:52 +0800 Subject: [PATCH 1/6] fix(everything): add allowed values to resourceType description The resourceType argument in the resource-prompt was missing a description of allowed values. Added "must be 'Text' or 'Blob'" to help automated callers understand the expected input format. Issue: modelcontextprotocol/servers#3985 Co-Authored-By: Claude Opus 4.7 --- src/everything/resources/templates.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/everything/resources/templates.ts b/src/everything/resources/templates.ts index 6d4903f74c..f56214cba8 100644 --- a/src/everything/resources/templates.ts +++ b/src/everything/resources/templates.ts @@ -25,7 +25,7 @@ export const RESOURCE_TYPES: string[] = [ * The completion logic matches the input against available resource types. */ export const resourceTypeCompleter = completable( - z.string().describe("Type of resource to fetch"), + z.string().describe("Type of resource — must be 'Text' or 'Blob'"), (value: string) => { return RESOURCE_TYPES.filter((t) => t.startsWith(value)); } From f2d1095bd119f47b199daf4a7de23bf799241aa4 Mon Sep 17 00:00:00 2001 From: Will-hxw <1176843521@qq.com> Date: Tue, 21 Apr 2026 04:37:25 +0800 Subject: [PATCH 2/6] fix(everything): require key parameter for get-env tool Prevent leaking all process.env variables by requiring a specific key. This addresses a security concern where the tool was returning the entire environment without any parameter or filtering. Issue: modelcontextprotocol/servers#3986 Co-Authored-By: Claude Opus 4.7 --- src/everything/tools/get-env.ts | 34 ++++++++++++++++++++++++++++----- 1 file changed, 29 insertions(+), 5 deletions(-) diff --git a/src/everything/tools/get-env.ts b/src/everything/tools/get-env.ts index 0adbf5a14d..2cc387c733 100644 --- a/src/everything/tools/get-env.ts +++ b/src/everything/tools/get-env.ts @@ -6,26 +6,50 @@ const name = "get-env"; const config = { title: "Print Environment Tool", description: - "Returns all environment variables, helpful for debugging MCP server configuration", - inputSchema: {}, + "Returns the value of a specific environment variable, helpful for debugging MCP server configuration", + inputSchema: { + type: "object", + properties: { + key: { + type: "string", + description: + "The name of the environment variable to retrieve (e.g., 'PATH', 'HOME', 'USER')", + }, + }, + required: ["key"], + }, }; /** * Registers the 'get-env' tool. * - * The registered tool Retrieves and returns the environment variables - * of the current process as a JSON-formatted string encapsulated in a text response. + * The registered tool retrieves and returns the value of a specific + * environment variable from the current process. * * @param {McpServer} server - The McpServer instance where the tool will be registered. * @returns {void} */ export const registerGetEnvTool = (server: McpServer) => { server.registerTool(name, config, async (args): Promise => { + const { key } = args as { key: string }; + const value = process.env[key]; + + if (value === undefined) { + return { + content: [ + { + type: "text", + text: `Environment variable '${key}' is not set.`, + }, + ], + }; + } + return { content: [ { type: "text", - text: JSON.stringify(process.env, null, 2), + text: `${key}=${value}`, }, ], }; From f81f8819d97989cf7d4a725f9af03fa8e0292fe2 Mon Sep 17 00:00:00 2001 From: Will-hxw <1176843521@qq.com> Date: Tue, 21 Apr 2026 05:49:29 +0800 Subject: [PATCH 3/6] fix(filesystem): CLI directories take precedence over MCP roots When a client supports MCP roots, the server was unconditionally replacing CLI-provided allowed directories with the client's roots. This made it impossible to scope the server to a directory outside the client's project root. Now CLI arguments take precedence - only fetch and apply MCP roots when no CLI directories were provided. Fixes: modelcontextprotocol/servers#3929 Co-Authored-By: Claude Opus 4.7 --- src/filesystem/index.ts | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/filesystem/index.ts b/src/filesystem/index.ts index 7b67e63e58..885dedc90b 100644 --- a/src/filesystem/index.ts +++ b/src/filesystem/index.ts @@ -731,7 +731,10 @@ server.server.setNotificationHandler(RootsListChangedNotificationSchema, async ( server.server.oninitialized = async () => { const clientCapabilities = server.server.getClientCapabilities(); - if (clientCapabilities?.roots) { + if (clientCapabilities?.roots && allowedDirectories.length === 0) { + // Only fetch and apply MCP roots when no CLI directories were provided. + // CLI arguments take precedence over MCP roots since they are explicitly + // specified by the server operator. try { const response = await server.server.listRoots(); if (response && 'roots' in response) { @@ -744,7 +747,7 @@ server.server.oninitialized = async () => { } } else { if (allowedDirectories.length > 0) { - console.error("Client does not support MCP Roots, using allowed directories set from server args:", allowedDirectories); + console.error("Client does not support MCP Roots, or CLI directories provided. Using allowed directories from server args:", allowedDirectories); }else{ throw new Error(`Server cannot operate: No allowed directories available. Server was started without command-line directories and client either does not support MCP roots protocol or provided empty roots. Please either: 1) Start server with directory arguments, or 2) Use a client that supports MCP roots protocol and provides valid root directories.`); } From 68cbeb3a2ac2db4ad821db68f4f5799eabac1a7c Mon Sep 17 00:00:00 2001 From: Will-hxw <1176843521@qq.com> Date: Tue, 21 Apr 2026 05:51:45 +0800 Subject: [PATCH 4/6] fix(release): include lock files in version bump check The has_changes() function only considered .py and .ts files when deciding whether to bump a package version. This caused packages with only lockfile changes (e.g., uv.lock from dependabot) to be skipped during release. Now includes .lock files in the check so that any meaningful change to a package triggers a version bump. Fixes: modelcontextprotocol/servers#3870 Co-Authored-By: Claude Opus 4.7 --- scripts/release.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/release.py b/scripts/release.py index e4ce1274c3..2a3ba955c4 100755 --- a/scripts/release.py +++ b/scripts/release.py @@ -113,7 +113,8 @@ def has_changes(path: Path, git_hash: GitHash) -> bool: ) changed_files = [Path(f) for f in output.stdout.splitlines()] - relevant_files = [f for f in changed_files if f.suffix in [".py", ".ts"]] + # Include all file types since lockfile changes (e.g., uv.lock) also need version bumps + relevant_files = [f for f in changed_files if f.suffix in [".py", ".ts", ".lock"]] return len(relevant_files) >= 1 except subprocess.CalledProcessError: return False From 79cf59d6e5dd371eb64da5e8a9f3a490fd89a9fe Mon Sep 17 00:00:00 2001 From: Will-hxw <1176843521@qq.com> Date: Tue, 21 Apr 2026 11:42:53 +0800 Subject: [PATCH 5/6] docs(everything): fix get-env description to match actual behavior The get-env tool requires a 'key' parameter and returns only the value of that specific environment variable, not all environment variables as the previous description stated. Fixes the misleading documentation that described behavior that was already fixed in commit f2d1095. --- src/everything/docs/features.md | 2 +- src/everything/docs/structure.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/everything/docs/features.md b/src/everything/docs/features.md index 145595b820..809fef8364 100644 --- a/src/everything/docs/features.md +++ b/src/everything/docs/features.md @@ -11,7 +11,7 @@ - `echo` (tools/echo.ts): Echoes the provided `message: string`. Uses Zod to validate inputs. - `get-annotated-message` (tools/get-annotated-message.ts): Returns a `text` message annotated with `priority` and `audience` based on `messageType` (`error`, `success`, or `debug`); can optionally include an annotated `image`. -- `get-env` (tools/get-env.ts): Returns all environment variables from the running process as pretty-printed JSON text. +- `get-env` (tools/get-env.ts): Returns the value of a specific environment variable by name. Takes a required `key` parameter. - `get-resource-links` (tools/get-resource-links.ts): Returns an intro `text` block followed by multiple `resource_link` items. For a requested `count` (1–10), alternates between dynamic Text and Blob resources using URIs from `resources/templates.ts`. - `get-resource-reference` (tools/get-resource-reference.ts): Accepts `resourceType` (`text` or `blob`) and `resourceId` (positive integer). Returns a concrete `resource` content block (with its `uri`, `mimeType`, and data) with surrounding explanatory `text`. - `get-roots-list` (tools/get-roots-list.ts): Returns the last list of roots sent by the client. diff --git a/src/everything/docs/structure.md b/src/everything/docs/structure.md index 6bcedcd425..80b5d07e32 100644 --- a/src/everything/docs/structure.md +++ b/src/everything/docs/structure.md @@ -131,7 +131,7 @@ src/everything - `get-annotated-message.ts` - Registers an `annotated-message` tool which demonstrates annotated content items by emitting a primary `text` message with `annotations` that vary by `messageType` (`"error" | "success" | "debug"`), and optionally includes an annotated `image` (tiny PNG) when `includeImage` is true. - `get-env.ts` - - Registers a `get-env` tool that returns the current process environment variables as formatted JSON text; useful for debugging configuration. + - Registers a `get-env` tool that returns the value of a specific environment variable by name; useful for debugging configuration. - `get-resource-links.ts` - Registers a `get-resource-links` tool that returns an intro `text` block followed by multiple `resource_link` items. - `get-resource-reference.ts` From ac65e47d322f6623e8f088f32d33af76d30bbca0 Mon Sep 17 00:00:00 2001 From: Will-hxw <1176843521@qq.com> Date: Tue, 21 Apr 2026 11:50:55 +0800 Subject: [PATCH 6/6] fix(everything): add missing description to resourceType arg in get-resource-reference Adds a describe() call to the resourceType schema field to fix the schema warning that blocks automated invocation. Fixes Issue #3985 --- src/everything/tools/get-resource-reference.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/everything/tools/get-resource-reference.ts b/src/everything/tools/get-resource-reference.ts index d3dc5d3ecb..2ca06d27cd 100644 --- a/src/everything/tools/get-resource-reference.ts +++ b/src/everything/tools/get-resource-reference.ts @@ -15,7 +15,8 @@ import { const GetResourceReferenceSchema = z.object({ resourceType: z .enum([RESOURCE_TYPE_TEXT, RESOURCE_TYPE_BLOB]) - .default(RESOURCE_TYPE_TEXT), + .default(RESOURCE_TYPE_TEXT) + .describe("Type of resource to fetch: Text or Blob"), resourceId: z .number() .default(1)