{"version":"2.1.271","anchor":"mcp-tool-access-can-be-scoped-by-a-host-issued-grant-token","canonical_anchor":"mcp-tool-access-can-be-scoped-by-a-host-issued-grant-token","heading":"Artifact publish can be scoped by a host-issued local MCP server grant","tier":"use","area":"MCP","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.271\/e\/mcp-tool-access-can-be-scoped-by-a-host-issued-grant-token","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.271","markdown":"### Artifact publish can be scoped by a host-issued local MCP server grant\n\nArtifact publish now checks a CLAUDE_ARTIFACT_HOST_GRANT environment variable to limit which local MCP servers and tools an artifact can declare\n\n**What**\n\n- A new `CLAUDE_ARTIFACT_HOST_GRANT` environment variable, set by the app that launched the session, is parsed as JSON (`{v, servers: [{server, tools}]}`) describing which local MCP servers and tools this computer's launcher has granted.\n\n- When an artifact declares capabilities that use `host:` MCP servers, only servers\/tools named in this grant are kept; anything else is dropped and reported to the user. If the environment variable is set but can't be parsed, capability resolution is refused outright rather than silently falling back.\n\n- Before publishing an artifact that doesn't explicitly declare `capabilities`, Claude Code now checks whether the artifact's stored capabilities include local servers not covered by the current grant, and refuses the publish with a detailed error (explaining how to declare capabilities explicitly or clear them) instead of silently carrying them forward. This applies to inline-page, files-only, and full publish paths.\n\n**Why** This stops an artifact from silently retaining access to local MCP tools or servers beyond what the current computer's launcher actually permitted, so publishing an artifact can't grant it more local capability than the host intended.\n\n- Area: MCP\n- Names: `CLAUDE_ARTIFACT_HOST_GRANT`\n- Tier: Use it now\n- Useful: 4\/5\n- Signal: 3\/5"}