Claude Code v2.1.305 to v2.1.306 Key Updates - allowedMcpServers Behavior Change and Tool Search Regression Fix

This is Ishikawa from the Cloud Business Division. I'll summarize the updates for Claude Code v2.1.305 ~ v2.1.306 (released October 20, 2026 ~ October 21, 2026). v2.1.306 contains only 2 bug fixes, and the majority of changes are included in v2.1.305.

The previous update article is here.

https://dev.classmethod.jp/articles/20261020-cc-updates-v2-1-304/

Update Summary

This covers 2 versions (v2.1.305 ~ v2.1.306, October 20, 2026 ~ October 21, 2026), with a total of 40 changes (38 in v2.1.305, 2 in v2.1.306). In this article's classification: 24 fixes, 8 improvements, 3 new features, 3 breaking changes, and 2 security updates.

The fixes include regressions introduced in v2.1.304 and v2.1.300. All 3 breaking changes affect the behavior of existing settings or key operations. There are also changes to the VS Code extension, Cloud sessions, Claude Tag, Code Review, and Self-hosted runner.

Notable Updates

Fixed regression causing all requests to fail on Bedrock, Vertex, and others (v2.1.305)

An issue was fixed where all requests would fail on providers such as Vertex and Bedrock when the endpoint or gateway rejects tool search. The same issue also occurred under gateways where ToolSearch is not permitted or has been removed from --tools. This was a regression introduced in v2.1.304, and v2.1.305 now retries without tool search.

If you are using Claude Code via Bedrock, Vertex, or an internal gateway and requests stopped going through in v2.1.304, I recommend prioritizing an update to v2.1.305 or later.

Fixed issue where API errors were replaced with "prompt is too long" in sessions using many MCP tools (v2.1.306)

An issue where API errors were displayed as "prompt is too long" in sessions using many MCP tools, and an issue where unnecessary compaction was being executed, have both been fixed.

If you were seeing "prompt is too long" or unnecessary compaction running in sessions with many MCP tools, I recommend updating to v2.1.306 and then re-examining the error messages that appear.

allowedMcpServers no longer filters some stdio servers in managed-mcp.json (v2.1.305)

stdio servers in managed-mcp.json that use ${VAR} only inside env will no longer be filtered by allowedMcpServers. Since those servers that were excluded from the allow list will be loaded upon upgrade, use deniedMcpServers to keep them disabled. A configuration example is shown in the "Breaking Changes and Deprecations" section below.

Administrators who are using managed-mcp.json in combination with allowedMcpServers to restrict servers should verify whether any applicable servers exist before users' machines are updated, and add deniedMcpServers if necessary.

Added sandbox.allowNestedUserNamespaces to the Linux sandbox (v2.1.305)

A new setting sandbox.allowNestedUserNamespaces has been added, which allows commands inside the Linux sandbox to create user namespaces. The CHANGELOG lists Chromium and rootless podman as targets, and also explicitly states that this setting allows those commands to bypass the sandbox's file protection.

This adds an option for those who want to run Chromium or rootless podman inside the Linux sandbox, but since it is explicitly noted that file protection can be bypassed, it seems prudent to enable this only in environments where that risk is acceptable.

/usage warnings now displayed as suggested fixes (v2.1.305)

Each warning in /usage is now displayed as a one-line suggested fix indicating its source, and the fix can be applied by pressing the f key. The same suggested fixes also appear in VS Code and /doctor.

Since each warning now shows its source and a one-line suggested fix that can be applied directly with the f key, I feel this reduces the effort needed to investigate the cause of warnings.

Target Versions and Period

New Features

• An environment variable CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS has been added for unattended retry mode (CLAUDE_CODE_RETRY_WATCHDOG), enabling detection of usage limits lifted before the reset time (v2.1.305).
• [VS Code] A "Running start-up hooks" spinner display has been added while SessionStart / Setup hooks are executing. Screen reader support is also included (v2.1.305).
• [Claude Tag] Public Slack channels that Claude has not joined now appear in the Add place search in the Claude Tag admin panel, allowing administrators to configure them from there (v2.1.305).

Improvements

• /usage warnings are now displayed as one-line suggested fixes with their source, and can be applied with the f key (see Notable Updates) (v2.1.305).
• [Code Review] Re-reviews no longer start from LGTM when previous blocking comments remain unresolved (v2.1.305).
• [VS Code] The message shown when a session fails to start on time and hooks have not been executed has changed from first guiding users to check sign-in and network, to leading with the output log and listing possible causes (v2.1.305).
• Additionally, improvements have been made to mod display (rendering of Image in iTerm2 3.5+ full-screen rendering, width of docked panes), Remote Control spawn mode messages, Cloud sessions self-hosted environment deletion dialog, and the Claude Tag admin panel (v2.1.305).

Security

• sandbox.allowNestedUserNamespaces has been added to the Linux sandbox (see Notable Updates) (v2.1.305).
• In the MCP consent dialog, it is now harder for an Enter key press intended as prompt input to be treated as Accept (v2.1.305).

Fixes (Major Items)

A selection of fixes related to stability and usability.

• Fixed regression causing all requests to fail on Bedrock, Vertex, and others: When an endpoint or gateway rejects tool search, it now retries without tool search (see Notable Updates) (v2.1.305).
• Fixed issue where API errors were replaced with "prompt is too long" in sessions using many MCP tools: The issue of unnecessary compaction being executed was also fixed at the same time (see Notable Updates) (v2.1.306).
• Fixed issue where claude -p inside a cloud session reported "Not logged in": This occurred when launched without the session's environment variables (v2.1.306).
• Fixed issue where /effort and /autocompact settings were not applied: This occurred when the model name differed from the modelOverrides value due to case differences or the presence or absence of a [1m] tag (v2.1.305).
• Fixed issues with worktree creation source and cleanup in bare repositories: Fixed an issue where a new worktree could be created from the local HEAD instead of the default branch, and an issue where worktrees for subagents with no changes might not be cleaned up (v2.1.305).
• Fixed issue where MCP servers passed via cloud sessions or SDK were being replaced: MCP servers passed via cloud sessions or SDK's setMcpServers were being replaced mid-session by servers with the same name from the user's own configuration (v2.1.305).
• Fixed issue where completed agents were re-executed on Workflow resume: Completed pipeline() / parallel() agents were being re-executed instead of being returned from the execution journal (v2.1.305).
• Fixed issue where startup warnings were displayed above the logo: Startup warnings that were being displayed as raw text above the logo are now output to the debug log. Permission rules that do not restrict anything are displayed as warning lines below the banner (v2.1.305).
• Fixed issue where Self-hosted runner repository access was failing: Repository access had been failing since v2.1.296 when git credential helpers or askpass programs read configuration via GIT_CONFIG (v2.1.305).
• Fixed issue where Code Review did not review the latest commit: This occurred when multiple pushes were made to the pull request during a review (v2.1.305).
• A quietly welcome fix: An issue where Bash commands were failing with only ENOSPC and a file path when the disk was full has been fixed. The error now indicates that the disk is full and that the command was not executed (v2.1.305). Being able to confirm from the error that the command was not executed should make it easier to isolate the cause.
• Additionally, numerous minor bugs have been fixed in screen reader mode, /usage display, Remote Control, Claude Tag routing, VS Code spinner, and more (v2.1.305).

Breaking Changes and Deprecations

Among the changes listed as "Changed" in the CHANGELOG for v2.1.305, I will cover 3 that affect existing settings or key operations. No deprecations are noted.

allowedMcpServers no longer filters managed-mcp.json stdio servers that use ${VAR} only inside env (v2.1.305)

This is the change introduced in the Notable Updates section. Since servers that were excluded from the allow list will be loaded upon upgrade, use deniedMcpServers to keep them disabled.

Note that as of the time of writing (October 21, 2026), the official documentation (How a server is evaluated) states that managed-mcp.json servers that use ${VAR} in any of command, arguments, env, URL, or headers are subject to the allow list check, which differs from the CHANGELOG description. This article follows the CHANGELOG description.

The following is a configuration example following the official documentation's notation. The assumption is that managed-mcp.json defines a stdio server company-internal that uses ${COMPANY_API_TOKEN} only inside env, as follows.

{
  "mcpServers": {
    "company-internal": {
      "type": "stdio",
      "command": "/usr/local/bin/company-mcp-server",
      "env": {
        "COMPANY_API_TOKEN": "${COMPANY_API_TOKEN}"
      }
    }
  }
}

Before the change (~v2.1.304): With the following managed-settings.json, company-internal was not loaded.

{
  "allowedMcpServers": [
    { "serverCommand": ["npx", "-y", "approved-package"] }
  ]
}

After the change (v2.1.305~): With the above configuration as-is, company-internal will be loaded. To continue blocking it, add it to deniedMcpServers.

{
  "allowedMcpServers": [
    { "serverCommand": ["npx", "-y", "approved-package"] }
  ],
  "deniedMcpServers": [
    { "serverCommand": ["/usr/local/bin/company-mcp-server"] }
  ]
}

allowed-tools for plugins mounted by path in Claude Desktop are no longer retained (v2.1.305)

When allowManagedPermissionRulesOnly is set in an organization's managed settings, allowed-tools for plugins mounted by path in Claude Desktop will no longer be retained.

The following is a configuration example.

{
  "allowManagedPermissionRulesOnly": true
}

Before the change (~v2.1.304): Even under the above setting, allowed-tools for plugins mounted by path in Claude Desktop were retained.

After the change (v2.1.305~): Under the above setting, allowed-tools for those plugins will not be retained.

y / n can no longer be used in the /artifacts deletion confirmation (v2.1.305)

The /artifacts deletion confirmation now uses 1 or Enter to keep, 2 to delete, and Esc to cancel, and y and n can no longer be used to respond.

Before the change (~v2.1.304):

y / n can also be used to respond to the deletion confirmation

After the change (v2.1.305~):

1 or Enter : Keep
2 : Delete
Esc : Cancel
y / n : Cannot be used to respond

Closing

These 2 versions felt like a continuation of changes related to errors and warnings: the fix for the v2.1.304 regression, the fix for API errors being replaced with "prompt is too long" in sessions using many MCP tools, and the suggested fix display in /usage. In particular, those using Bedrock, Vertex, or similar under endpoints or gateways that reject tool search, or those using many MCP tools, should find the most benefit.

Administrators managing MCP servers should review the breaking changes section and then try updating.

References

https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

https://code.claude.com/docs/en/changelog

https://code.claude.com/docs/en/managed-mcp

https://dev.classmethod.jp/articles/20261020-cc-updates-v2-1-304/