You'll noticeTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
MCPArea: what it touches
ImprovementsKind: in v2.1.295,
ImprovementsSection of the release
What
The local preview server for MCP (Model Context Protocol, a way to connect external tools to Claude Code) now sends x-content-type-options: nosniff with its responses. This header tells the browser to trust the declared file type instead of guessing it.
The server's shared set of headers is now also applied to its "not found" response and to responses that are not web pages.
Why
This is a small security hardening of the preview server. A browser can no longer be led to treat a file as a different kind of content than the server said it was.
