An "http" transport kind enables a heavily restricted profile, but nothing in this build passes it.
The MCP server Claude Code exposes to other tools now checks incoming tool calls against the tool's own schema before dispatch and refuses a mismatch with "arguments failed schema validation" rather than passing raw input through, and it aborts work already running when a client cancels or the server shuts down. The same code now takes a transport kind, and passing "http" turns on a heavily restricted profile. Nothing in this build passes "http": the claude mcp serve command hands the server the stdio transport, so the restricted profile is reachable only by importing the module directly.
- A request's abort signal is wired to the tool's abort controller with reason "remote-cancel"; closing the server aborts in-flight work with reason "shutdown".
- Validation and cancellation are live on both transports, so
claude mcp servegets them today. - The "http" profile disables background tasks and unsandboxed command execution, and exposes only a fixed allowlist of tools.
- It also skips the CLAUDE_CODE_SIMPLE tool filter through a new option, so the allowlist rather than that filter decides what is offered.
- Under that profile the
dangerouslyDisableSandbox,run_in_backgroundand_simulatedSedEditfields are removed from the advertised tool schemas and stripped out of incoming arguments, with a note appended to the result when anything was stripped.
[serve-mode] Stripped client-supplied privilege field(s): , _simulatedSedEdit
Strings lifted out of the shipped bundle, so the claim above can be checked against them.