You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
MCPArea: what it touches
ImprovementsKind: in v2.1.247,
ImprovementsSection of the release
What
The MCP server URL handed over by the cloud bridge previously only had to sit on the bridge's origin. It now has to be this session's own proxy route or it is dropped with a warning, closing off a bridge-supplied URL pointing at another session or a crafted path.
Details
The URL must parse to that exact origin, carry no credentials and no fragment, and match the /v2/ccr-sessions/<sessionId>/mcp path for the current session.
Only allow-listed query parameters are permitted, with a fixed toolbox server id.
The nested inner URL must itself be the canonical path on the same origin, and the server id must match a fixed pattern.
Evidence
[bridge:server-config] meta url is not this session's meta proxy route on the bridge origin
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeFixed fast arrow-key + Enter sequences acting on the row above the one you navigated to in history search, /config, /mcp, /skills…
