{"version":"2.1.299","anchor":"mcp-serve-session-tunnel-resolved-via-dialing-launcher","canonical_anchor":"mcp-serve-interface-min-version-env-var-and-managed-hook-run","heading":"mcp serve gets new host options, and its session tunnel tracks its runner and token expiry","tier":"use","area":"MCP Serve","scope":"both","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.299\/e\/mcp-serve-session-tunnel-resolved-via-dialing-launcher","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.299","markdown":"### mcp serve gets new host options, and its session tunnel tracks its runner and token expiry\n\nmcp serve adds a minimum-version variable and managed-hook tools, and --session-tunnel watches its runner and stops when its stated token expiry passes\n\n**Unclear.** Whether the value given to `--session-tunnel` must now be written differently is not stated.\n\n**What**\n\n`mcp serve` runs Claude Code as an MCP server that another program can connect to and use for tools. `--session-tunnel` is the mode where it serves those tools to a remote session through a tunnel.\n\n- `CLAUDE_CODE_MCP_SERVE_INTERFACE_MIN_VERSION` is a new environment variable. If its value differs from the daemon's `min_version`, the launch version is ignored and a log line records it.\n\n- `CLAUDE_CODE_MCP_SERVE_AUTH_TOKEN` is now cleared once it has been read.\n\n- A new `RunManagedHook` tool runs command hooks, and `SetProjectMcpServerEnabled` is added.\n\n- Tunnel startup now builds a launcher through `dialingLauncherFrom` from the transport and port, and stops with its refusal text. Before, it parsed a session-tunnel envelope with `parseSessionTunnelEnvelope` and `sessionTunnelRefusal`.\n\n- `--session-tunnel` reads a `runner` with `pid` and `proc_start`. The runner is the program that started the tunnel. The tunnel refuses to start if `CCR_AGENT_PROXY_ENABLED` is set, or if it cannot see the runner (\"--session-tunnel cannot see the runner that started it\"). It exits once the runner is gone.\n\n- `--session-tunnel` now takes `session_token_expires_at` and shuts down with \"the session_token_expires_at it was started with has passed\". Before, the only message was \"the token has expired\".\n\n- A permanent relay failure now reports either `stated_expiry_passed` or `token_expired` instead of a single `expired` reason. The stated expiry is used as a fallback.\n\n**Why**\n\nThis mostly matters to programs that embed `mcp serve`. A tunnel now ends when the program that started it is gone or when its stated token expiry passes, and its reason says which expiry ended it.\n\n- Area: MCP Serve\n- Names: `--session-tunnel`\n- Tier: Use it now\n- Useful: 4\/5\n- Signal: 3\/5\n- Scope: both\n- Heads-up: yes"}