You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
0Signal: worth watching, 1 to 5
MCPArea: what it touches
ImprovementsKind: in v2.1.219,
What probably matters to youSection of the release
What
Expanding ${VAR} inside MCP policy URL predicates now detects environment values that smuggle in wildcard semantics and refuses to treat the resulting predicate as safe.
Details
The expander gains a wildcardVars output listing offending variables.
A value counts as a wildcard if it contains after NFKC normalization, matches %2a case-insensitively, or decodes to a after percent-decoding.
A predicate whose expansion pulled in any such variable is marked unsafe alongside the existing host, hash and query checks.
Allowlist URL entries using such an expansion fail closed; denylist entries are unaffected.
The expander also gained a fallback env map so policy-settings env can supply variables missing from the process env.
Neither wildcardVars nor the check existed in the previous build; this closes a route to widening a policy match through an environment variable.
Evidence
wildcardVars, a value injected wildcard semantics
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeChanged managed MCP allowlist/denylist ${VAR} entries to resolve from the startup environment and managed-settings env instead of…
