Claude Code v2.1.220 to v2.1.221 Major Updates - Print Mode MCP Connection Fix and Permission Check Bypass Fix

This is Ishikawa from the Cloud Business Division. I'd like to summarize the Claude Code updates from v2.1.220 to v2.1.221 (July 24 – August 3, 2026). Two permission check-related fixes are included, and I feel this is an edition where the practical impact is easy to understand. I tried MCP connections in print mode.

Here is the previous update article.

https://dev.classmethod.jp/articles/20260725-cc-updates-v2-1-219/

Update Summary

This update comes after about 10 days, covering 2 versions (v2.1.220 – v2.1.221, July 24 – August 3, 2026), with a total of 40 changes listed in the CHANGELOG. v2.1.220 contains only a single line of "Bug fixes and reliability improvements," with the remaining 39 items concentrated in v2.1.221.

The breakdown is 4 new features, 2 security fixes related to permission checks, 16 other fixes, 15 improvements and developer experience items, and 3 behavior-changing modifications. Rather than new feature additions, the composition is dominated by foundational fixes such as permission checks and MCP connection handling.

Notable Updates

Added Focus View to VS Code (v2.1.221)

A Focus view has been added to the VS Code extension. Using a toggle in the chat menu, it hides tool execution details behind an expandable per-turn summary and shows running tools via an indicator. It can be toggled with Ctrl+Alt+F or the command "Claude Code: Toggle Focus view."

For VS Code extension users who find their chat getting swept away by tool execution logs, this feels like a change that makes it easier to follow the flow of conversation.

Added mode: "mask" to Sandbox Credential Files (v2.1.221)

On Linux and WSL, mode: "mask" is now available for sandbox credential files. Commands inside the sandbox read a sentinel (dummy) copy, and the sandbox proxy replaces it with the actual value upon external transmission. You can choose to mask the entire file, or only the range captured by an extract regular expression. On macOS, file masking falls back to deny.

For those using sandboxes on Linux or WSL and passing API keys via files, this feels like a practical option beyond deny becoming available.

Added prompt-audit Subcommand to claude-api Skill (v2.1.221)

A prompt-audit subcommand has been added to the claude-api skill. It audits whether prompts and tool descriptions follow patterns written for older models.

For those who have been running applications using the Claude API for a long time and still have prompts written for older models remaining, this feels like it could serve as a clue for taking inventory.

Two Permission Check Bypasses Fixed (v2.1.221)

An issue where the Bash tool's permission check could be bypassed has been fixed. Hidden commands inside zsh [[ ]] regex conditional expressions could be executed, and the relevant commands now display a permission confirmation prompt.

Additionally, on the Windows side, an issue where PowerShell permission checks for paths containing quotes were not handled correctly has been fixed, and such paths now prompt for approval.

Since these two fixes directly impact those operating in auto mode or with allowlists based on permission check assumptions, I feel these are worth upgrading for promptly.

Fixed Issue Where MCP Servers from --mcp-config Were Not Connected in Print Mode (-p) (v2.1.221)

In print mode (-p), an issue where MCP servers loaded from --mcp-config were not connected before the first turn has been fixed. In this state, the model was outputting tool calls as plain text.

For those invoking Claude Code with -p from CI or batch processes and having it use MCP tools, this feels like a fix that has a direct effect.

Target Versions and Period

New Features

• Added Focus view to VS Code. Toggle with Ctrl+Alt+F or the command "Claude Code: Toggle Focus view" (v2.1.221)
• Added mode: "mask" to sandbox credential files (Linux / WSL. macOS falls back to deny) (v2.1.221)
• Added prompt-audit subcommand to the claude-api skill (v2.1.221)
• Added a feature to claude plugin validate that warns about marketplace plugins with names that would be rejected by Claude Desktop's managed marketplace sync (v2.1.221)

Improvements & Developer Experience

• Re-enabled tool search on Google Vertex AI for Claude 4.5 generation and later models (v2.1.221)
• In auto mode, permission checks for parallel tool calls are now cache-efficient, and switching modes while a check is pending no longer applies old results and reliably shows a confirmation prompt (v2.1.221)
• In auto mode permission checks, cached conversation prefixes are now reused between determinations, reducing prompt cache costs (v2.1.221)
• The Stats panel token total now includes cache tokens, showing a breakdown of input, output, cache read, and cache write (v2.1.221)
• On Windows startup, process creation time is now retrieved using a native kernel32 call instead of launching PowerShell, so endpoint security products that restrict powershell.exe no longer trigger confirmations (v2.1.221)
• /plugin install now refreshes the old marketplace catalog and retries before reporting that a plugin was not found (v2.1.221)
• Plugins installed from /plugin now activate immediately without /reload-plugins when it is safe to do so (v2.1.221)
• Plugins now accept "." as a skills path, and validation errors for SKILL.md directly under the root now suggest using the plugin root (v2.1.221)
• /status now displays the session type (interactive, or attached / unattended for background jobs) (v2.1.221)
• Claude in Chrome now closes browser tabs it opened once they are no longer needed (v2.1.221)
• In fast mode, a notification is now sent on the stream when usage credits run out mid-session (v2.1.221)
• In Monitor, a watch that exits without generating any output now reports that fact instead of "stream ended" (v2.1.221)
• Emoji autocomplete now accepts alternative shortcodes such as :thumbsup:, :thumbsdown:, and :love: (v2.1.221)
• Improved the error message for /ultrareview on repositories that don't share a base and history. Checkouts without a branch are now rejected early with guidance to create a branch, and git fetch --unshallow is no longer suggested for already fully cloned repositories (v2.1.221)
• Removed the repeatedly displayed "Permission mode changed while the auto-mode classifier call was queued" notification from approval prompts (v2.1.221)

Fixes (Key Items)

A selection of fixes primarily related to stability and usability.

• Fixed an issue where the thinking toggle stopped working: In sessions started with thinking turned off, subsequent toggle switches were not taking effect. Additionally, disabling while an MCP server was connecting no longer reverts on its own (v2.1.221)
• Fixed an issue where @-specified files were dropped: Canceling a prompt with Esc and resubmitting silently removed files specified with @ (v2.1.221)
• Fixed WebSearch failing with 400 errors: This occurred when thinking was disabled and effort was xhigh / max (v2.1.221)
• Fixed Bedrock AWS SSO named profile authentication failure: This occurred in desktop management sessions on Windows machines with an extra HOME environment variable set (v2.1.221)
• Fixed double token refresh on sleep resume: A rare race condition where two Claude Code processes simultaneously refreshed the same MCP connector or WIF OAuth token, requiring re-authentication (v2.1.221)
• Fixed skills not callable in non-interactive sessions: This affected plugin-provided and organization-provided skills with the same names as terminal-only built-ins such as /help and /feedback (v2.1.221)
• A quietly appreciated fix: The Vim mode yank register is now retained across dialogs, history search, and transcript views without being cleared (v2.1.221). Reducing the need to re-copy feels appreciated
• In addition, numerous minor bugs have been fixed including SDK MCP tool name resolution, large uploads via sandbox, handling of falsy environment variable values, session name synchronization, and Vim mode undo operations. v2.1.220 also has only a single line in the CHANGELOG of "Bug fixes and reliability improvements," similarly centered on minor fixes

Behavior Changes to Watch Out For

There are no explicit breaking changes or deprecations, but there are 3 changes where the same operations as before may produce different results.

Background Sessions Now Commit and Push Work (v2.1.221)

Background session behavior has changed: they now commit and push work to preserve it, create draft PRs only when the task requires it, follow git-related instructions in CLAUDE.md, and always report where the deliverables are placed at the end.

/fork Now Creates Its Own Worktree (v2.1.221)

Sessions forked with /fork now create their own new worktree instead of working in the original session's checkout.

• Before (up to v2.1.220): Sessions forked with /fork worked in the same checkout as the original session
• After (v2.1.221 onwards): Sessions forked with /fork create and work in their own dedicated worktree

Gateway model Field Validation Is Now Stricter (v2.1.221)

For the Gateway model field, values other than strings are now rejected with 400 instead of being forwarded as-is. The following is an example to illustrate the change.

• Before (up to v2.1.220): { "model": 123 } → forwarded as-is
• After (v2.1.221 onwards): { "model": 123 } → rejected with 400

Trying MCP Connections in Print Mode

In v2.1.221, I verified that MCP tools from --mcp-config are recognized in the first turn of print mode. I placed a minimal MCP stdio server (demo-mcp-server.mjs) in a working directory that exposes only a single ping tool, and loaded it from the following configuration file.

mkdir mcp-print-test && cd mcp-print-test
npm init -y
npm install @modelcontextprotocol/sdk zod

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

const server = new McpServer({ name: "demo", version: "1.0.0" });

server.registerTool(
  "ping",
  { description: "For connectivity testing. A tool that simply returns pong when called" },
  async () => ({ content: [{ type: "text", text: "pong" }] })
);

await server.connect(new StdioServerTransport());

mcp.json:

{
  "mcpServers": {
    "demo": {
      "command": "node",
      "args": ["./demo-mcp-server.mjs"]
    }
  }
}

Using --strict-mcp-config to ignore existing MCP settings and use only those from --mcp-config. I asked it only to enumerate the names without executing any tools.

% claude --version
2.1.221 (Claude Code)

% claude --mcp-config ./mcp.json --strict-mcp-config --max-turns 1 \
  -p "Please only list the names of available MCP tools. Do not execute any tools."
There is only one available MCP tool.
- mcp__demo__ping (server: demo / tool: ping)
Other tools (WebFetch, TaskCreate, CronList, etc.) are Claude Code built-in tools and are not via MCP. MCP tools can be identified by the naming convention mcp__<server name>__<tool name>.

% echo "exit code: $?"
exit code: 0

The exit code was 0. (Note: Even with the same command, whether the model responds immediately or calls a tool first is non-deterministic, so the exit code is not always guaranteed to be 0.)

I was able to confirm that mcp__demo__ping was recognized at the first turn. For those building CI or batch processes combining -p and --mcp-config, this feels like a fix worth upgrading for sooner rather than later.

In Closing

v2.1.221 feels like an edition centered on foundational maintenance — such as permission check bypass fixes and print mode MCP connection fixes — rather than new features. In particular, the two permission check fixes seem like something those who regularly delegate command execution would want to upgrade for promptly. There are also behavior-changing items, so it seems worthwhile to review them against your own workflows.

If there are any changes that interest you, why not upgrade and verify them in your own environment?

References

https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

https://code.claude.com/docs/en/changelog

https://dev.classmethod.jp/articles/20260725-cc-updates-v2-1-219/