You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
PermissionsArea: what it touches
ImprovementsKind: in v2.1.260,
What probably matters to youSection of the release
A new shared helper, credentialHeadersWarn, flags MCP server URLs/headers and inference custom headers that look like they leak plain-HTTP credentials or shared bearer tokens, with messages like "Endpoint is plain HTTP; auth credentials travel in cleartext" and "Shared bearer token: every org member authenticates as the same identity." It's applied to both managedMcpServers config and the inferenceCustomHeaders field.
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeChanged Claude apps gateway to also refuse to start, naming the field, when a desktop policy misspells a field in a nested object of a…
