Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.219 Home All releases ←olderv2.1.218 v2.1.220newer→
Claude Code v2.1.219

MCP policy URL expansion fails closed on wildcard-injecting env values

You'll notice
Useful3 Signal0
MCP Notable

MCP policy URL allowlists now refuse environment variables that sneak wildcards in and widen a match.

What

Expanding ${VAR} inside MCP policy URL predicates now detects environment values that smuggle in wildcard semantics and refuses to treat the resulting predicate as safe.

Details
  • The expander gains a wildcardVars output listing offending variables.
  • A value counts as a wildcard if it contains after NFKC normalization, matches %2a case-insensitively, or decodes to a after percent-decoding.
  • A predicate whose expansion pulled in any such variable is marked unsafe alongside the existing host, hash and query checks.
  • Allowlist URL entries using such an expansion fail closed; denylist entries are unaffected.
  • The expander also gained a fallback env map so policy-settings env can supply variables missing from the process env.
  • Neither wildcardVars nor the check existed in the previous build; this closes a route to widening a policy match through an environment variable.
Evidence

wildcardVars, a value injected wildcard semantics

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.219 →