{"version":"2.1.319","anchor":"cloud-launch-mcp-urls-with-credentials-are-no-longer-recorde","canonical_anchor":"cloud-launch-mcp-urls-with-credentials-are-no-longer-recorde","heading":"Cloud sessions stop recording MCP server addresses that may hold secrets","tier":"notice","area":"Cloud Sessions","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.319\/e\/cloud-launch-mcp-urls-with-credentials-are-no-longer-recorde","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.319","markdown":"### Cloud sessions stop recording MCP server addresses that may hold secrets\n\nIn Anthropic cloud sessions, MCP server addresses are no longer recorded at launch when they look like they carry credentials\n\n**What**\n\nIn Anthropic cloud sessions (where `CLAUDE_CODE_REMOTE` is set), Claude Code records which MCP servers were set up at launch. MCP servers are outside tools Claude can connect to. Now:\n\n- A server's address is no longer recorded when its headers hold values that look like credentials.\n\n- Claude Code also records each server's origin, the scheme and host part of the address.\n\n- Parts of an address that look secret, such as long unique IDs, `sk-` keys and mixed-case tokens, are detected.\n\nBefore, the full address was always recorded under the same conditions.\n\n**Why**\n\nIt lowers the chance of passwords or keys ending up in launch records.\n\n- Area: Cloud Sessions\n- Names: `CLAUDE_CODE_REMOTE`\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: no"}