@modelcontextprotocol/server-everything

1 of its last 1 updates changed what the agent reads: 3 tool descriptions rewritten, up to 2.0.0.

npm package · npm page · recorded on 24 October 2026 on a clean machine with placeholder settings; only tools/list was sent. A changed description is not a vulnerability. Method and limits.

Release by release

1.0.0 → 2.0.0

major release, 19 October 2026

Added: get-header-params, trigger-list-changed, trigger-log-messages, trigger-resource-update

Removed: simulate-research-query

echo: input schema changed

get-annotated-message: input schema changed

get-env: input schema changed

get-resource-links: input schema changed

get-resource-reference: input schema changed

get-structured-content: input schema changed

get-sum: input schema changed

get-tiny-image: input schema changed

gzip-file-as-resource: description and input schema changed

Before (1.0.0)

Compresses a single file using gzip compression. Depending upon the selected output type, returns either the compressed data as a gzipped resource or a resource link, allowing it to be downloaded in a subsequent request during the current session.

After (2.0.0)

Compresses a single file using gzip compression. Depending upon the selected output type, returns either the compressed data as a gzipped resource or a resource link, allowing it to be downloaded in a subsequent request: during the current session for a 2025-era client, or for ten minutes at a minted URI on protocol version 2026-07-28.

toggle-simulated-logging: description and input schema changed

Before (1.0.0)

Toggles simulated, random-leveled logging on or off.

After (2.0.0)

Toggles simulated, random-leveled logging on or off. Deprecated: 2025-era clients only, since protocol version 2026-07-28 removes logging/setLevel; use trigger-log-messages with a per-request log level instead.

toggle-subscriber-updates: description and input schema changed

Before (1.0.0)

Toggles simulated resource subscription updates on or off.

After (2.0.0)

Toggles simulated resource subscription updates on or off. Deprecated: 2025-era clients only, since protocol version 2026-07-28 removes resources/subscribe; use trigger-resource-update with a subscriptions/listen stream instead.

trigger-long-running-operation: input schema changed

Releases tried: 1.0.0 (2026-10-11); 2.0.0 (2026-10-19).

Tools in 2.0.0

The pin is the SHA-256 of the tool's name, description and input schema, as verfy.lock records it. The same pin in your lock means your agent reads this exact definition.

Tools in 2.0.0
Tool	Description	Pin
echo	Echoes back the input string	0bd43aeb9956
get-annotated-message	Demonstrates how annotations can be used to provide metadata about content.	32b3f2119b4d
get-env	Returns all environment variables, helpful for debugging MCP server configuration	ef229750bf50
get-header-params	Returns its region argument and the Mcp-Param-Region HTTP header it arrived in. Demonstrates x-mcp-header (a 2026-07-28 Streamable HTTP client mirrors the argument into the header) and JSON Schema 2020-12 input and output schemas.	85baad4c86ef
get-resource-links	Returns up to ten resource links that reference different types of resources	5a67cef17a30
get-resource-reference	Returns a resource reference that can be used by MCP clients	0926cb018e9f
get-structured-content	Returns structured content along with an output schema for client data validation	d06e076c7ec1
get-sum	Returns the sum of two numbers	147bf7002325
get-tiny-image	Returns a tiny MCP logo image.	6adb8c34b9a2
gzip-file-as-resource	Compresses a single file using gzip compression. Depending upon the selected output type, returns either the compressed data as a gzipped resource or a resource link, allowing it to be downloaded in a subsequent request: during the current session for a 2025-era client, or for ten minutes at a minted URI on protocol version 2026-07-28.	0b2987c52cdf
trigger-list-changed	Sends a notifications/<list>/list_changed for the tool, prompt or resource list. On protocol version 2026-07-28 it is delivered on each subscriptions/listen stream that asked for that list; a 2025-era client receives it unsolicited.	48e16a535a9b
trigger-log-messages	Sends one log message at each logging level during the call. On protocol version 2026-07-28 only the messages at or above the level the request names in _meta (io.modelcontextprotocol/logLevel) are sent, and none if it names no level; a 2025-era client gets those at or above the level it set with logging/setLevel. Deprecated: logging is deprecated as of protocol version 2026-07-28.	6b668f3705ba
trigger-long-running-operation	Demonstrates a long running operation with progress updates.	5b8cb35149ed
trigger-resource-update	Sends a notifications/resources/updated for a resource URI. On protocol version 2026-07-28 it is delivered on each subscriptions/listen stream whose resourceSubscriptions name the URI; a 2025-era client receives it once it has called resources/subscribe for the URI.	d27990d7e2e6
toggle-simulated-logging	Toggles simulated, random-leveled logging on or off. Deprecated: 2025-era clients only, since protocol version 2026-07-28 removes logging/setLevel; use trigger-log-messages with a per-request log level instead.	b6769ba9b273
toggle-subscriber-updates	Toggles simulated resource subscription updates on or off. Deprecated: 2025-era clients only, since protocol version 2026-07-28 removes resources/subscribe; use trigger-resource-update with a subscriptions/listen stream instead.	dbeeee266a9f

Lock these tools

Pin what @modelcontextprotocol/server-everything serves you today, commit the lock, and a pull request fails when a tool changes, with the text before and after. Pin the package version in your MCP config as well.

$ pip install verfy
$ verfy lock check --update   # shows each tool, then writes verfy.lock
$ git add verfy.lock

# .github/workflows/verfy.yml, after actions/checkout
- uses: anvarbekovjavohir277-dot/verfy-action@v1

Maintain this server? Run the same check on your releases and add the Locked by Verfy badge to your README.