You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
MCPArea: what it touches
ImprovementsKind: in v2.1.305,
ImprovementsSection of the release
Unclear Whether the allowlist is now enforced differently, or only its description changed, is not clear.
What
allowedMcpServers is the setting administrators use to allowlist which MCP servers (add-on tool servers) users can add. Its description now says that entries in managed-mcp.json are exempt unless ${VAR} appears in their command, args, url or header values. It used to say entries were exempt if they used no ${VAR} expansion at all.
Why
This makes clearer for administrators exactly which managed entries the allowlist covers: only where a variable appears in those four places.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubtWhether the allowlist is now enforced differently, or only its description changed, is not clear.
Anthropic's release notes agreeChanged allowedMcpServers to stop filtering managed-mcp.json stdio servers that use ${VAR} only in env: one your allowlist left out now…
