Follow Discord
Sweep 22 Oct 2026 · 04:32Z Build v2.1.308 527 read Stable v2.1.308 Latest v2.1.308 Next v2.1.308 Feeds RSS JSON llms.txt llms-full.txt Unofficial

Claude Code v2.1.238 ·

Marketplace validation flags unsafe archive credential setups

Marketplace validation now warns about unsafe headersHelper and missing sha256 setups.

Use it now Improvements
JSON All of v2.1.238
Use it nowTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
PluginsArea: what it touches
ImprovementsKind: in v2.1.238,
What probably matters to youSection of the release
What

Catalog validation gained errors and warnings for fetch credentials: an entry using headersHelper must inline its full manifest or the helper will not be run, headers/headersHelper on non-archive sources warn as ineffective, and an archive fetched with a helper but no sha256 warns.

Details
  • Routing and identity headers are reported as dropped at download time rather than silently discarded.
Evidence

An entry with headersHelper must inline its full manifest

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Read from
Names in the bundleheadersHelperheaderssha256
Since it was published

The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.

Confirmed since Anthropic's documentation has since written up sha256, on Troubleshoot federated cloud access. * **A large request to a service other than S3 with no content hash.** When a request has no `x-amz-content-sha256` header, Agent Proxy hashes the body before signing and refuses a body over 1 MB (1,048,576 bytes). The AWS CLI and SDKs add… claude-tag/admins/federated-access/troubleshooting see the edit
Added since A small documentation edit on extended-thinking touched a line naming headers after this was published. On Claude Opus 4.5, Claude Sonnet 4.5, and earlier Claude 4 models, add the `interleaved-thinking-2025-05-14` [beta header](https://platform.claude.com/docs/en/api/beta-headers) to your API request. build-with-claude/extended-thinking see the edit
Confirmed since Anthropic's documentation has since written up headers, on MCP, plugins, skills, and hooks. | `.mcp.json` | MCP servers bundled with this plugin. A JSON object keyed by server name: `{"mcpServers": {"<name>": {"type": "http", "url": "...", "oauth": true}}}`. A remote entry uses `type` (`http` or `sse`), not `transport`, and suppo… third-party/claude-desktop/extensions see the edit
Confirmed since Anthropic's documentation has since written up headersHelper, on MCP, plugins, skills, and hooks. | `.mcp.json` | MCP servers bundled with this plugin. A JSON object keyed by server name: `{"mcpServers": {"<name>": {"type": "http", "url": "...", "oauth": true}}}`. A remote entry uses `type` (`http` or `sse`), not `transport`, and suppo… third-party/claude-desktop/extensions see the edit
How sure we are
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agreesAnthropic's documentation has since written up headersHelper, on MCP, plugins, skills, and hooks.
Anthropic's release notes agreePlugin marketplaces: headersHelper on a url marketplace or a catalog entry runs a command that mints HTTP headers (e.g. a short-lived token)…

See this entry in the whole of v2.1.238 →

Feedback