Claude Code 2.1.259 hands MCP servers to the whole org

Claude Code 2.1.259 adds managedMcpServers, a managed setting that gives every user in an organization the HTTP and SSE MCP servers it lists. It arrives alongside permission, worktree and workflow fixes in the release notes on Github.

At a glance

• Entries follow the same format as .mcp.json, and any entry naming a local command to run is skipped, which keeps the managed list to HTTP and SSE servers rather than locally launched ones.
• A new --permission-prompts none flag targets unattended headless hosts: anything that would raise a prompt is denied automatically, while the active permission mode, auto included, still decides everything else.
• Concurrent sessions stop overwriting each other's ~/.claude.json changes, so workspace trust holds and MCP and project state survive when many sessions run against the same machine at once.

The MCP surface in this release reads as an admin surface. Central distribution of servers, a mode that denies every prompt on headless hosts and a startup refusal on unreadable policy files all shift control away from the individual developer's configuration file. The trade is predictability for convenience: a fleet running unattended sessions gains a deterministic answer to permission questions, and a malformed policy file stops being a silent no-op.

forceRemoteSettingsRefresh is honoured again when a policy helper has already run

Managed forceRemoteSettingsRefresh had been ignored at startup when a policy helper configured by MDM or the managed settings file had already run. A separate startup fix covers MCP servers that disconnect while their tools are being listed: they now report the error instead of appearing connected with no tools.

OpenTelemetry metrics and events from cloud sessions had been missing the user.email, organization.id and user.account_uuid attributes. The prompt cache stopped being invalidated when the OAuth token refreshes in sessions with telemetry disabled, and repository detection keeps a known repo identity through a transient git probe failure. Sessions for claude.ai users also stop running a background GitHub connection check on every launch; the result is remembered across launches.

Bash deny rules now cover option values and git operands

Deny rules previously missed files given as option values such as --ignore-revs-file=.env, -f.env and @file, the file operands of git diff and git grep, and cd DIR && cat FILE compounds. A recursive grep -r or cp -r over a directory holding a denied file now asks.

Worktree-isolated sessions had been refusing common Bash loops, xargs pipelines and launcher-wrapped commands that cannot reach the main checkout; those run again. Worktree isolation also stopped rejecting hook-created worktrees on machines where git rev-parse fails with a message other than "not a git repository".

Blocking Stop hooks had cost the following turn the model's reasoning and, on some models, a prompt cache hit. Auto mode stops running a turn on a model it does not support when a command or skill's frontmatter names one, and frontmatter model: entries are honoured in interactive sessions.

glab merge requests show as MR !N in the collapsed tool summary

Claude Code recognizes glab mr create, merge, close, reopen, note and update, so GitLab merge requests appear as MR !N in the collapsed tool summary and refresh the footer MR badge. Running /install-github-app inside a GitLab repository now says the command is GitHub-only and points to the GitLab CI/CD docs.

claude plugin validate gains a --json flag for a machine-readable validation report. In /workflows, JSON outcomes in the agent detail view are pretty-printed with syntax colors and line breaks, and long ones fold behind an expand toggle. The VSCode extension adds an Active quick filter and a status filter menu (Needs input, Working, Completed) to the session list sidebar.

Headless and SDK sessions start their first turn up to 50 ms sooner when MCP servers finish connecting, and terminal resize and first-render performance for long responses improved through reused text measurements. Nested background subagent results are now saved in the parent subagent's transcript.

Checking allowlists before upgrade

allowedMcpServers now governs only the servers users add, so a literal managed-mcp.json entry that an allowlist used to filter out loads after the upgrade; deniedMcpServers is the way to keep it off. Unparseable managed settings become a hard failure too: a malformed managed-settings file, drop-in, MDM plist or HKLM value stops Claude Code from starting, and the error names the source.