Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.238 Home All releases ←olderv2.1.237 v2.1.239newer→
Claude Code v2.1.238

Trust dialog now discloses header-minting and marketplace commands a folder declares

You'll notice
Useful4 Signal3
Permissions

The folder-trust prompt now lists commands a repo would run to mint HTTP headers.

What

The folder-trust screen lists commands the repo's own settings would run to mint HTTP headers, alongside the existing marketplace, OpenTelemetry and proxy helper warnings, so a repo cannot introduce a command that runs on first fetch without appearing in the prompt.

Details
  • The preview now walks extraKnownMarketplaces including alias keys, and lists URL-source and per-plugin headersHelper entries plus command-source plugin entries, rendered as <key>: <command> → <url> with truncation.
  • Project and local .mcp.json and settings MCP servers that declare a headersHelper are listed too.
  • Trust telemetry gained hasRepoHeadersHelpers.
  • Dependency resolution will not auto-install a plugin whose archive is fetched through an entry headersHelper; that requires an explicit /plugin install.
  • Plugin autoupdate gained the failure classes entry_helper_disabled_by_policy, entry_helper_remote_policy_unconsented and entry_helper_not_inlined, plus deferred and policy-blocked counters.
Evidence

This folder runs commands to mint HTTP headers (headersHelper), declared in , extraKnownMarketplaces[

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.238 →