2.14.0

What's Changed

Security fixes

2.14.0 fixes three vulnerabilities reported privately against v2. Upgrade with npx @modelcontextprotocol/inspector@latest. One of them, GHSA-2fw8-7jmw-r937, also affects the deprecated v1 line, where it is fixed in 1.0.4 (@v1-latest).

• An MCP App can no longer navigate its sandbox frame away from the policy it was given. The proxy enforces a frame policy built from the app's approved CSP grants. When the frame starts to leave the document the host loaded, it closes the relay and removes the frame, and it tells the host why. (GHSA-h9j8-vj8g-v3gg)
• server.json import shows the exact command before it is saved, and rejects a package with an invalid or empty environment-variable name or unsafe tokens. URL elicitations open only http(s) URLs. Any other scheme is refused, with a reason. The HTML preview's CSP now precedes all document markup. (GHSA-rwv7-mh2c-ff2p)
• Server-supplied schema patterns are checked in bounded time. Tool output and app elicitation schemas use a linear-time matcher with per-pattern and per-schema limits. A pattern beyond those limits is reported as unverified instead of being evaluated. (GHSA-2fw8-7jmw-r937)

Upgrading

• The Node floor is now ^22.23.4 || ^24.22.1 || >=26.12.1, the October 2026 Node security releases (#2822). npm prints EBADENGINE on older versions. The field is advisory, so the Inspector still runs.
• --load latency now counts successful calls only. latencyMs and the --load-max-p99 gate cover successful calls only, failed calls are reported separately as errorLatencyMs, and tool-error text is now shown (#2836). If no call succeeds, --load-max-p99 fails with a message saying there is no p99 to check.

Other changes

• docs(skills): allow full advisory details on the GHSA draft card by @cliffhall in #2857
• chore: raise Node floor to the Oct 2026 security releases; bump vitest, happy-dom, ext-apps, ip-address by @cliffhall in #2852
• fix: reap the backend session (and stdio child) when a web tab closes or reloads by @cliffhall in #2853
• fix(core): OAuth callback listener acts only on this flow's state by @cliffhall in #2854
• fix(load): partial summary on Ctrl+C, circuit breaker, success-only latency, dropped rate slots by @cliffhall in #2855
• fix: nine small defects from the v2.13 review (#2827) by @cliffhall in #2856
• fix(docker): probe /healthz over https when the web UI serves TLS by @cliffhall in #2848
• fix(mcpdo): fail connections/list and MRU inference on an over-limit socket path by @cliffhall in #2849
• fix(tui): one-line list rows keep the selection in view; Windows-safe save-queue test by @cliffhall in #2850
• chore(release): bump version to 2.14.0 by @cliffhall in #2864
• fix(mcpdo): name a connection_lost abort instead of tallying [object Object] by @cliffhall in #2868
• fix(mcpdo): refuse a connection daemon from another release by @cliffhall in #2871
• chore(release): merge v2/main into main for v2.14.0 by @cliffhall in #2867
• fix: harden server.json import review, URL elicitation scheme, and preview CSP injection by @cliffhall in #2876
• fix(web): stop an MCP App navigating its sandbox frame elsewhere by @cliffhall in #2875
• fix(core): evaluate server-supplied schema patterns in bounded time (v2) by @cliffhall in #2877
• chore(release): merge v2/main into main for the v2.14.0 security fixes by @cliffhall in #2882

Full Changelog: 2.13.0...2.14.0
Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.14.0

Thanks for helping us improve

This release addresses issues and vulnerabilities reported by these community members. Thank you for taking the time to report them:

• @CloneOfAlex (#2824, #2825, #2826, #2827, #2834, #2835, #2836, #2837, #2843, #2847, GHSA-h9j8-vj8g-v3gg)
• @Sonica-B (#2810)
• @3099404236 (GHSA-rwv7-mh2c-ff2p)
• @KillerX345 (GHSA-2fw8-7jmw-r937)