MCP Servers v2.2.0 tightens cert checks; old fetch environments need a certifi refresh
caolonghua · x · 2026-10-29
MCP Servers v2.2.0 ships runtime and certificate security guidance. The TypeScript servers rely on Node.js for cert checks and bundle no CA certificates; the release recommends Node.js 24.22.1 or 26.12.1+, and warns the engines field accepts any Node 24 version, so npm won't flag unpatched runtimes. The fetch server verifies HTTPS via httpx with certifi, now locked to certifi 2026.10.23 in Docker; fetch environments created before October 23 keep older certifi and should be refreshed (uvx --refresh mcp-server-fetch or pip install -U certifi). Fetch also now refuses autonomous fetching when robots.txt returns 5xx and adds a --no-readability-js option.
More from coding & agent
- Veteran engineer: juggling 17 projects with agents, deep thinking is a muscle I'm losing — rudrank · 2026-10-29
- Agent-built component flips cash-flow: licensor pays company NOT to open-source it — mattpocockuk · 2026-10-29
- Agent sandbox boat.dev sees record growth day with 100k-view demo and nonstop Stripe orders — zack_overflow · 2026-10-29
- Dev picks Cursor's $60/mo Grok plan as best budget coding combo — pramodk73 · 2026-10-29
- Claude Duet research preview lands in users' hands as Anthropic quietly expands access — RileyRalmuto · 2026-10-29
- LangChain Core 1.7.1 Ships Two Fixes for Streams and Mermaid Diagrams — caolonghua · 2026-10-29