Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.238 Home All releases ←olderv2.1.237 v2.1.239newer→
Claude Code v2.1.238

Agents in untrusted folders can no longer define inline MCP servers

You'll notice
Useful4 Signal3
MCP not in their notes

Agents in untrusted folders can no longer define inline MCP servers; trust the project to allow it.

hasTrustDialogAccepted
What

If an agent's frontmatter declares MCP servers inline rather than by name, and the folder the agent is defined in is not trusted, those servers are now dropped for both the main thread and subagents. A log names the source and tells you to accept the trust dialog or set hasTrustDialogAccepted. There is no flag: this applies to anyone whose agent files live outside a trusted project.

Details
  • Only inline (non-string) server definitions are affected; agents that reference servers by name are unchanged.
  • The existing untrusted-origin telemetry event gained a what field distinguishing "hooks" from "mcpServers".
  • The warning is deduplicated per agent and surface, so it is logged only the first time.
Evidence

tengu_agent_hooks_origin_untrusted

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.238 →