Follow Discord
Sweep 22 Oct 2026 · 04:32Z Build v2.1.308 527 read Stable v2.1.308 Latest v2.1.308 Next v2.1.308 Feeds RSS JSON llms.txt llms-full.txt Unofficial

Claude Code v2.1.248 ·

Untrusted names escaped across MCP and config messages

MCP and config error messages now escape server names and inputs before printing them.

You'll notice Improvements
JSON All of v2.1.248
You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
MCPArea: what it touches
ImprovementsKind: in v2.1.248,
ImprovementsSection of the release
What

More user-facing messages now escape values before printing them: MCP reconnect notices and the managed-policy block message quote the server name through a helper, and a config parse error shows the escaped input rather than the raw token. The MCP stale-entry hint is only appended if the whole message stays within 1024 characters, otherwise the plain message is shown.

Details
  • The stale advice text about /mcp enable and /mcp disable moved from a fixed string to a lookup.
Evidence

Expected key=value, got, was disabled in another session — disable and re-enable it in /mcp, or restart, to reconnect

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeFixed /mcp listing a project .mcp.json entry that declares the claude.ai connector type under the trusted "claude.ai" heading; it now…

See this entry in the whole of v2.1.248 →

Feedback