headersHelper
A Claude Code settings key, read out of the shipped bundle. No mined inventory carries it: everything below comes from what this site has written about it.
The folder-trust prompt now lists commands a repo would run to mint HTTP headers.
Not Anthropic's. This is the line from the earliest changelog entry here that named it, v2.1.238.
In the changelogs
21Releases whose published page names headersHelper.
-
v2.1.305
Header helper commands from plugins now know which plugin they belong to
The command that supplies extra request headers can now be given a plugin's identity, so its environment can include plugin variables
found in this entry's text, named in this entry
-
v2.1.302
MCP credential rejection messages come from a shared message set
Messages shown when an MCP server rejects a
headersHelpercredential or an Authorization header now come from one shared set of messagesfound in this entry's text
-
v2.1.302
MCP error messages can suggest a new task instead of /mcp, plus rejected-header messages
In some sessions, MCP errors now say to start a new task or chat instead of running /mcp, and rejected credentials get their own messages
found in this entry's text
-
v2.1.302
Messages for rejected MCP server credentials are now built in one place
Errors for an MCP server rejecting your
headersHelpercredential or Authorization header now come from shared codefound in this entry's text
-
v2.1.300
Plugin commands wait until your organization's settings are read
Plugin command sources and marketplace
headersHelpercommands no longer run in a tool server and wait until organization settings have loadedfound in this entry's text, named in this entry
-
v2.1.299
MCP sign-in requests now send your configured headers
Configured MCP headers are now sent when finding OAuth details and revoking tokens, only to the same server
found in this entry's text, named in this entry
-
v2.1.284
Remote Control asks to trust an untrusted folder instead of exiting
Starting
claude rcin an untrusted folder now shows a trust prompt with a y/N question instead of printing an error and quittingfound in this entry's text
-
v2.1.284
Plugin marketplace sources can now have credentials removed and odd URLs refused
Claude Code now has a check that strips usernames, passwords and headers from plugin marketplace sources and refuses suspicious URLs
found in this entry's text
-
v2.1.281
Plugin validation now checks a plugin's MCP server files
Plugin validation now checks a plugin's MCP server files for bad settings, insecure addresses and credentials left in plain text
found in this entry's text
-
v2.1.273
MCP OAuth/auth failure messages split into four specific cases
MCP authentication failure messages now split into four specific cases instead of two generic ones
found in this entry's text
-
v2.1.248
Separate failure code when a credential helper's token is rejected
A rejected credential-helper token is now reported as its own MCP failure with clearer advice.
named in this entry, found in this entry's text
-
v2.1.248
Credential-helper tokens suppress the MCP OAuth flow
An MCP headersHelper that mints an Authorization header now suppresses the OAuth flow.
named in this entry, found in this entry's text
-
v2.1.238
Trust dialog now discloses header-minting and marketplace commands a folder declares
The folder-trust prompt now lists commands a repo would run to mint HTTP headers.
found in this entry's text
-
v2.1.238
Managed settings can refuse plugin sources and marketplace updates
Admins can block plugins and marketplaces from unlisted sources, with refusals naming the policy.
found in this entry's text
-
v2.1.238
Plugin marketplaces and archives can mint HTTP headers from a command
Marketplaces and plugins can run a command to mint short-lived HTTP headers for fetching archives.
named in this entry, found in this entry's text
-
v2.1.238
Zip-archive plugin entries can carry their own fetch credentials
Plugin archives can carry their own fetch headers or a helper command instead of inheriting them.
named in this entry, found in this entry's text
-
v2.1.238
Marketplace validation flags unsafe archive credential setups
Marketplace validation now warns about unsafe
headersHelperand missingsha256setups.named in this entry, found in this entry's text
-
v2.1.238
MCP header-minting commands run through the shared trusted-command runner
MCP header-minting commands now run with credentials stripped from their environment.
named in this entry, found in this entry's text
-
v2.1.118
MCP Server Authentication Improvements
found in this entry's text
- v1.0.120
-
v1.0.120
MCP Dynamic Header Generation with headersHelper
found in this entry's text
First cited
9The earliest release whose published evidence quoted headersHelper was v2.1.238, 20 Aug 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.
3 further spans in the ledger name it. The list above is the earliest first and stops at 6.
Presence across releases
0The miner has never read a build containing this name. It is here because a changelog entry of ours names it, which is evidence that it existed and not evidence of which releases carried it. The inventory starts at v2.1.138 and everything older than that was never mined.
Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the settings key does. All settings keys.