# Claude Code 2.1.196: MCP self-approval hole closed, Remote Control off on non-Anthropic base URLs

> Security fix: `claude mcp list`/`get` no longer spawn `.mcp.json` servers a repo self-approved through a committed `.claude/settings.json`. Remote Control is now disabled whenever `ANTHROPIC_BASE_URL` points at a non-Anthropic host, which affects anyone routing through a local proxy. Also fixes a background-job path that could permanently delete a conversation.

| | |
|---|---|
| **Tool** | Claude Code |
| **Version** | 2.1.196 |
| **Kind** | release |
| **Published** | 2026-06-29 |
| **Observed** | 2026-08-11 |
| **Significance** | 4/5 |
| **Breaking** | yes |
| **Categories** | security, breaking, fix, feature |

## What changed


- Security: `claude mcp list`/`get` no longer spawn `.mcp.json` servers self-approved via a committed `.claude/settings.json`; untrusted workspaces show `⏸ Pending approval`
- Behavior change: Remote Control disabled when `ANTHROPIC_BASE_URL` points at a non-Anthropic host, matching existing `CLAUDE_CODE_USE_BEDROCK`/`_VERTEX`/`_FOUNDRY` behavior
- Fix (data loss): waking a background job permanently deleting its conversation and re-running the original prompt when the transcript probe misread a real transcript — the file is now set aside, never deleted
- New: organization default models set in the org console, shown as "Org default"/"Role default" in `/model`
- New: readable default session names; clickable file attachments in chat (Cmd/Ctrl-click reveals in Finder/Explorer)
- Changed: streaming idle watchdog on by default for all providers — aborts and retries after 5 minutes with no stream events; disable with `CLAUDE_ENABLE_STREAM_WATCHDOG=0`
- Changed: opening the agents view from a foreground session takes one `←` instead of two
- Fix: `claude agents --dangerously-skip-permissions` silently falling back to auto mode instead of showing the bypass disclaimer and applying bypass to spawned agents
- Fix: MCP OAuth requesting the authorization server's full `scopes_supported` catalog when no scope is specified, causing `invalid_scope` failures on GitLab self-hosted and other enterprise IdPs
- Fix: rate-limit warning flicker and over-counted rate-limit telemetry under parallel requests
- Fix: PowerShell `git diff`/`git grep`, `egrep`/`fgrep`, and quoted `|` patterns reported as failures on exit 1
- Fix: mid-turn crash recovery for Remote sessions; sessions moved with `/cd` reappearing in the old resume list; Esc Esc at an idle prompt not opening the rewind menu
- Fix: `/context` showing 0 tokens for all tool groups on Bedrock; `/deep-research` misreporting verifier failures as "all claims refuted" instead of `unverified`
- Fix: `claude plugin validate` skipping local plugins with source "." and stopping after the first error class; plugin dependency version pins ignored for local-folder marketplaces
- Improved: background sessions survive process stop/restart/update, including Windows (background shells handed off, not killed); daemon-killed workers auto-resume
- Improved: `/code-review` merged five cleanup finders into one, ~25% less token usage; reduced per-frame TUI rendering work during streaming


## Sources

- [changelog_md](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md) — retrieved 2026-08-11

## Community

_No curated reactions recorded. Facts and community takes are kept in separate layers
and never blended._

---
Canonical: https://changelogs.info/claude-code/2-1-196
Entity: https://changelogs.info/claude-code
Event ID: `evt_2026-06-29_claude-code_2-1-196`
Licence: event synthesis © changelogs.info, CC BY 4.0. Linked sources belong to their vendors.