Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.248 Home All releases ←olderv2.1.247 v2.1.250newer→

Claude Code v2.1.248 27 Aug 2026

Untrusted names escaped across MCP and config messages

You'll notice

Useful2 Signal2

MCP

MCP and config error messages now escape server names and inputs before printing them.

What

More user-facing messages now escape values before printing them: MCP reconnect notices and the managed-policy block message quote the server name through a helper, and a config parse error shows the escaped input rather than the raw token. The MCP stale-entry hint is only appended if the whole message stays within 1024 characters, otherwise the plain message is shown.

Details

The stale advice text about /mcp enable and /mcp disable moved from a fixed string to a lookup.

Evidence

Expected key=value, got, was disabled in another session — disable and re-enable it in /mcp, or restart, to reconnect

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.248 →