arikusi/deepseek-mcp-server

v1.8.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo MCP Developer Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

ai claude-code deepseek deepseek-v4 gemini-cli llm

+3 more

mcp mcp-server typescript

Affected surfaces

auth breaking_upgrade

ReleasePort's take

Moderate signal

editorial:auto 1mo

Self‑hosted HTTP transport now mandates authentication for MCP endpoints. Node.js 18 support is discontinued; Node.js 20+ is required.

Why it matters: Authentication enforcement (severity 90) blocks unauthorized access to MCP endpoints, while dropping Node.js 18 forces upgrades to Node.js 20 or newer by the v1.8.0 release.

Summary

AI summary

Closes missing‑authentication report on self‑hosted HTTP transport (GHSA-72f3-6w86-7rv3) and updates dependencies.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Self-hosted HTTP transport now requires authentication for MCP endpoints. Self-hosted HTTP transport now requires authentication for MCP endpoints. Source: llm_adapter@2026-06-14 Confidence: high	—
Breaking	High	Requires Node.js 20 or newer; Node 18 support dropped. Requires Node.js 20 or newer; Node 18 support dropped. Source: llm_adapter@2026-06-14 Confidence: high	—
Dependency	Medium	Upgraded `@modelcontextprotocol/sdk` to 1.29.0 and testing deps to vitest 4.1.8. Upgraded `@modelcontextprotocol/sdk` to 1.29.0 and testing deps to vitest 4.1.8. Source: llm_adapter@2026-06-14 Confidence: high	—

Full changelog

Security release. Closes the missing-authentication report on the self-hosted HTTP transport (GHSA-72f3-6w86-7rv3) and clears the outstanding npm audit advisories.

Security

The self-hosted HTTP transport no longer ships open by default.

HTTP_HOST defaults to 127.0.0.1, which also turns on the MCP SDK's DNS rebinding protection. A plain run is not reachable off the host.
HTTP_AUTH_TOKEN, when set, requires Authorization: Bearer <token> on POST/GET/DELETE /mcp (timing-safe compare). /health stays open for probes.
HTTP_ALLOWED_HOSTS keeps host-header validation when binding to 0.0.0.0.
Binding to 0.0.0.0 without a token logs a startup security warning. The bundled docker-compose.yml publishes to 127.0.0.1 only.

Dependencies

@modelcontextprotocol/sdk to 1.29.0 and vitest / @vitest/coverage-v8 to 4.1.8. npm audit goes from 13 advisories to 0.

Breaking

Requires Node.js 20 or newer. Node 18 reached end of life in April 2025.

Full notes: https://github.com/arikusi/deepseek-mcp-server/blob/main/CHANGELOG.md#180---2026-06-14

Breaking Changes

Requires Node.js 20 or newer; Node 18 EOL in April 2025

Security Fixes

GHSA-72f3-6w86-7rv3 — missing‑authentication report on self‑hosted HTTP transport closed
npm audit advisories cleared (13 → 0)

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track arikusi/deepseek-mcp-server

Get notified when new releases ship.

About arikusi/deepseek-mcp-server

MCP server for DeepSeek AI with chat, reasoning, multi-turn sessions, function calling, thinking mode, and cost tracking.

All releases →