When an MCP policy predicate (an allow/deny rule) references an environment variable that's treated as a credential and blanked out for matching purposes, Claude Code now logs a warning explaining that the rule can't match a config which spells the value out literally.
MCP policy predicates warn when matching against credential variables
An MCP policy rule referencing a blanked credential variable now logs a warning that it cannot match a literal value.
You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
MCPArea: what it touches
ImprovementsKind: in v2.1.257,
ImprovementsSection of the release