2026-07-01-claude-code-v2-1-196-security-fix-claude-mcp-list-get-no-longer-spaw

v2.1.196: Security fix - claude mcp list/get no longer spawn .mcp.json servers that a repo self-approved via a committed .claude/settings.json; untrusted workspaces now show 'Pending approval'. (channel: tagged-release, 2026-06-29). Operator consequence: Advisory-shape fix: a committed settings file could previously cause read-only MCP listing commands to spawn attacker-chosen MCP servers in an untrusted clone. Re-audit any workflow that runs claude mcp list/get against untrusted repos; upgrade to >= 2.1.196. Full receipted detail lives in harvest/watchlist.md.

Receipt

https://github.com/anthropics/claude-code/releases/tag/v2.1.196

Finding metadata

Confidence: high

Run: 2026-07-01-weekly-digest-2026-06-24_2026-07-01-frontier-v0

Finding ID: 2026-07-01-claude-code-v2-1-196-security-fix-claude-mcp-list-get-no-longer-spaw

Accepted signals

Claude Code 2.1.196 closes an MCP self-approval hole and binds Remote Control to the Anthropic host / 2026-07-01

Source links

Primary links, including exact changelog lines when available.

Claude Code
github release2026-07-01-claude-code-v2-1-196-security-fix-claude-mcp-list-get-no-longer-spawanthropics/claude-code / v2.1.196

Versioned source: run artifact