{"version":"2.1.317","anchor":"plugin-bundle-mcpb-and-skill-paths-are-checked-against-the","canonical_anchor":"plugin-bundle-mcpb-and-skill-paths-are-checked-against-the","heading":"Plugin server, skill and bundle paths are refused if they lead outside the plugin","tier":"notice","area":"Plugins","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.317\/e\/plugin-bundle-mcpb-and-skill-paths-are-checked-against-the","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.317","markdown":"### Plugin server, skill and bundle paths are refused if they lead outside the plugin\n\nPlugin MCP server, skill and bundle paths are now checked against the plugin's own folder, with clearer errors when they point outside it\n\n**Unclear.** It is not clear whether the new check applies to every plugin or only to plugins that set a particular option.\n\n**What**\n\nPlugins, add-ons that extend Claude Code, name files such as MCP server programs, skill folders and bundles. Claude Code now checks these paths against the plugin's own files (a `filesAnchor` check):\n\n- MCP server paths, skill directories and MCPB configuration (plugin bundles) are now checked, and paths that lead outside the plugin are refused.\n\n- A refused bundle shows: 'This bundle can't be configured. If its path leads outside the plugin, the plugin's author needs to change it.'\n\n- A path in mcp-servers or lsp-servers that is absolute or has a '..' part now gets its own message, starting 'Server file not read:', instead of the general 'Path escapes plugin directory: ...'.\n\n- Plugin validation also skips some directories.\n\nBefore, MCP paths were joined without this check.\n\n**Why**\n\nPlugins can no longer reach files outside their own folder through these paths, and authors get clearer errors. Some existing plugins that relied on such paths may stop loading until their author fixes them.\n\n- Area: Plugins\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: yes"}