1 00:00:00,640 --> 00:00:07,520 This one's brought to you by Jellypod AI, and it's a small line in the 2.1.318 notes 2 00:00:08,060 --> 00:00:11,280 that could matter a lot if you manage Claude Code for a team. 3 00:00:12,060 --> 00:00:18,100 You'll remember 2.1.318 added auth expiration dates and effort on mod forks. 4 00:00:18,800 --> 00:00:23,320 It also quietly widened organizational MCP security policy. 5 00:00:24,340 --> 00:00:29,640 Right, and following the managed settings and write boundary stuff from 2.1.316 and 6 00:00:29,800 --> 00:00:32,360 2.1.317, this fits the pattern. 7 00:00:32,980 --> 00:00:38,920 The release notes say deniedMcpServers URL entries now also block Anthropic-provided 8 00:00:38,980 --> 00:00:41,120 servers whose upstream URL matches. 9 00:00:42,560 --> 00:00:46,080 They also block connectors in cloud sessions and on self-hosted runners, 10 00:00:46,280 --> 00:00:48,460 where the session is given the connector's own URL. 11 00:00:49,780 --> 00:00:52,180 Otherwise, the notes say, you deny a connector by name. 12 00:00:53,443 --> 00:00:54,963 So why care? 13 00:00:55,903 --> 00:00:59,323 A lot of admins write URL entries thinking it's a perimeter. 14 00:00:59,903 --> 00:01:03,363 Block this vendor endpoint, block that untrusted host, done. 15 00:01:04,563 --> 00:01:09,483 The docs already say deniedMcpServers applies even to servers in 16 00:01:09,563 --> 00:01:15,783 managed-mcp.json, so a managed server that matches an entry won't load. 17 00:01:16,823 --> 00:01:17,783 That's the strong part. 18 00:01:18,443 --> 00:01:21,963 The change is about extending where a URL can match. 19 00:01:22,518 --> 00:01:25,258 And I'd keep fact and interpretation separate here. 20 00:01:25,658 --> 00:01:27,978 The fact is the notes describe the new matching. 21 00:01:28,578 --> 00:01:31,998 My read is that if you relied on a URL entry and assumed it covered 22 00:01:32,098 --> 00:01:36,138 Anthropic-provided servers or cloud connectors, it's worth rechecking now. 23 00:01:36,798 --> 00:01:40,698 The notes don't spell out what happened before, so I won't claim a specific hole. 24 00:01:41,310 --> 00:01:42,290 Okay, using it. 25 00:01:42,930 --> 00:01:48,090 In your managed settings, add the entries to deniedMcpServers. 26 00:01:48,670 --> 00:01:49,350 Something like this. 27 00:01:49,830 --> 00:01:51,990 An array with a URL, say 28 00:01:52,190 --> 00:02:01,570 https://untrusted-upstream.example.com/mcp, 29 00:02:02,330 --> 00:02:03,730 then another URL, 30 00:02:04,150 --> 00:02:12,650 https://api.githubcopilot.com/mcp/, 31 00:02:14,030 --> 00:02:18,010 and then a plain name string for a connector you want blocked by name. 32 00:02:18,490 --> 00:02:20,390 Same setting, three kinds of entries. 33 00:02:21,008 --> 00:02:23,868 The URL has to match the one the session is actually given. 34 00:02:24,388 --> 00:02:28,608 In cloud sessions and on self-hosted runners that's the connector's own URL, 35 00:02:28,868 --> 00:02:30,268 so a URL entry works. 36 00:02:31,008 --> 00:02:35,088 Elsewhere, like connectors the desktop app delivers to local and SSH sessions, 37 00:02:35,508 --> 00:02:39,708 the docs say those arrive in-process and are governed from your claude.ai 38 00:02:39,768 --> 00:02:40,808 organization settings. 39 00:02:41,948 --> 00:02:43,408 So don't lean on a URL there. 40 00:02:43,848 --> 00:02:45,608 Use the name, and check those org settings. 41 00:02:46,093 --> 00:02:52,753 To verify, run claude mcp list on a managed machine, and look at the MCP 42 00:02:52,853 --> 00:02:55,773 config diagnostics section if something's off. 43 00:02:56,313 --> 00:02:59,793 Inside a session, /mcp shows servers. 44 00:03:00,753 --> 00:03:01,733 And here's the caveat. 45 00:03:02,153 --> 00:03:07,633 The docs warn that servers blocked or dropped by policy can just stop loading with 46 00:03:07,713 --> 00:03:09,693 no warning that policy is the reason. 47 00:03:10,733 --> 00:03:13,453 So tell your developers before you push a broad entry. 48 00:03:13,947 --> 00:03:16,207 Yeah, test a new entry on one machine first. 49 00:03:16,807 --> 00:03:19,407 Now the smaller fixes, all MCP flavoured. 50 00:03:19,967 --> 00:03:24,067 claude mcp add and remove used to write the config without its lock. 51 00:03:24,527 --> 00:03:29,627 Now they wait for the lock or exit 1, though the notes admit another job's save can 52 00:03:29,707 --> 00:03:31,327 still replace a saved server. 53 00:03:31,827 --> 00:03:33,207 Useful on shared network homes. 54 00:03:33,962 --> 00:03:34,362 Two more. 55 00:03:35,062 --> 00:03:40,822 Stdio MCP servers that exit on the version probe aren't re-probed every start 56 00:03:40,882 --> 00:03:41,302 anymore. 57 00:03:42,022 --> 00:03:46,422 If one dies in under three seconds for its own reason, it's pinned to the legacy 58 00:03:46,482 --> 00:03:47,962 handshake for seven days. 59 00:03:48,982 --> 00:03:54,262 And calling an MCP tool before it's loaded now returns its input schema, 60 00:03:54,662 --> 00:03:55,702 not a vague error. 61 00:03:56,647 --> 00:03:57,387 So the takeaway. 62 00:03:57,827 --> 00:04:02,547 If you run a denylist, audit your URL entries against cloud and runner connectors, 63 00:04:02,907 --> 00:04:06,627 add names for the rest, and verify with claude mcp list. 64 00:04:07,247 --> 00:04:09,227 That's 2.1.318.