{"version":"2.1.260","anchor":"claude-in-chrome-mcp-tool-calls-now-re-check-org-policy-at-c","canonical_anchor":"claude-in-chrome-mcp-tool-calls-now-re-check-org-policy-at-c","heading":"Claude in Chrome MCP tool calls now re-check org policy at call time","tier":"notice","area":"Chrome & Browser","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.260\/e\/claude-in-chrome-mcp-tool-calls-now-re-check-org-policy-at-c","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.260","markdown":"### Claude in Chrome MCP tool calls now re-check org policy at call time\n\nChrome extension tool calls now re-check org policy at call time, not just at install.\n\nClaude in Chrome MCP tool calls now check the `allow_claude_browser_extension` managed org policy at the moment a tool call is made, not just at install or upsell time. If the policy denies the extension, the call now throws \"Claude in Chrome call refused by org policy\" instead of proceeding.\n\nThe enforcement extends across the whole Chrome bridge: the `\/chrome` settings command, the auto-enable path, and the startup dialog that offers to connect Claude in Chrome all now gate on this policy. The MCP server itself refuses to start when `CLAUDE_CODE_CHROME_MCP_ORG_DENIED` is set in its environment, exiting with cause `parent_org_policy`, and MCP connections that are blocked fail with errorCode `POLICY_BLOCKED`. The policy check defaults to denied until an org verdict is confirmed, and `allow_claude_browser_extension` has also been added to the HIPAA compliance-taint list, so HIPAA-restricted orgs block it by default. Where the policy can't be verified (third-party\/custom base URL providers, missing claude.ai sign-in, or network errors), Claude Code now logs an explicit warning and relies on the extension itself to enforce the org setting.\n\n- Area: Chrome & Browser\n- Names: `allow_claude_browser_extension`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}