Summary: Claude Code v2.1.196, released June 29, 2026, added organization default models and closed an MCP trust-boundary hole. Admins can set org or role defaults, while a committed settings file can no longer self-approve MCP servers defined in a repository. The same release period also improved permissions auditing, MCP retries, streaming stability, background jobs, and telemetry choices.
The final entry in a rapid-fire stretch of releases landed on June 29, 2026: Anthropic’s command-line coding agent Claude Code rolled out v2.1.196. Count back to v2.1.186 on June 22 and you get seven versions in eight days, with a through-line that is hard to miss — enterprise governance and MCP security.
Two changes deserve the spotlight. One hands organization admins the ability to define default models straight from the org console. The other is a security repair that restores the trust boundary: .mcp.json MCP servers “self-approved” by a settings file committed inside the repository will no longer be spawned by claude mcp list.
Governing Models at the Org Level: Defaults Paired with Limits
The headline governance feature in v2.1.196 is organization default models. Once an admin configures them in the org console, any user who has never picked a model personally will see “Org default” (or “Role default”) in /model. Layer role-level settings on top, and each team can settle onto its own model out of the box instead of leaning on unwritten rules.
The restricting side showed up first. Org-configured model restrictions shipped in v2.1.187 on June 23, and they cover every entry point — the model picker, --model, /model, and the ANTHROPIC_MODEL environment variable. Choose a blocked model and the reply is a “restricted by your organization’s settings” message. Defaults plus restrictions close the governance loop: steer the right model to the right role while shutting down the detours.
Permission handling is tightening in parallel. Since v2.1.193, the autoMode.classifyAllShell setting sends every Bash or PowerShell command through the auto-mode classifier rather than only arbitrary-code-execution patterns, and denial reasons now appear in the transcript and the permissions view — audits no longer have to guess.
Repairing the MCP Trust Boundary
What the v2.1.196 security fix shuts down is a concrete attack: a hostile repository uses a committed .claude/settings.json to pre-approve the MCP servers defined in its own .mcp.json. With the fix in place, claude mcp list and get decline to launch self-approved servers of this kind, and an untrusted workspace sits in a pending-approval state — the decision returns to the user.
Just as practical is the MCP OAuth repair in the same release. Before, when no scope was specified, Claude Code asked the authorization server for its entire supported scope catalog, and GitLab self-hosted and other enterprise identity providers answered with invalid_scope failures. That behavior is now fixed.
Reliability picked up a run of upgrades too. When a tool call returns 401/403, v2.1.193 has headersHelper re-authenticate and reconnect on its own. Under v2.1.191, transient network errors no longer derail capability discovery (such as tools/list) or OAuth discovery and token requests — both are retried with backoff. And since v2.1.187, a remote MCP tool call that used to hang silently for five minutes instead aborts with a clear timeout error.
Plugin handling follows the same defensive instinct. As of v2.1.195, external plugins enabled only by a project-level .claude/settings.json require explicit install consent on every loader path, closing one more route a repository could use to quietly arrange for its code to load.
More Changes Operations Teams Will Notice
Performance moved as well: v2.1.191 trimmed CPU usage during streaming responses by roughly 37%, a difference you notice on machines that run all day. In v2.1.196 the streaming idle watchdog is enabled by default — a response stream with no events for five minutes aborts and retries instead of hanging forever. Background work is sturdier too: long-running commands and workflows survive the session process being stopped, restarted, or updated; on Windows, background shells are handed off rather than killed; and a background agent cut short by a daemon restart resumes automatically from where it stopped.
On cost, /code-review consolidated its five cleanup finders into one, trimming token usage by about 25% — for teams that run code review every day, that is money saved directly.
Smaller refinements smooth out daily use too: since v2.1.191, /rewind can bring a conversation back from before a /clear; v2.1.196 gives new sessions readable default names in place of anonymous slugs; and file attachments in chat are now clickable, opening the file in Finder or Explorer.
Two Checks Worth Making Before You Upgrade
First, telemetry. The claude_code.assistant_response OpenTelemetry event added in v2.1.193 carries the model’s response text, and by default its state follows OTEL_LOG_USER_PROMPTS: a deployment that already uploads prompt content will start receiving response content after upgrading. Teams that want prompts only should set OTEL_LOG_ASSISTANT_RESPONSES=0.
Second, Remote Control. From v2.1.196 onward, it is disabled whenever ANTHROPIC_BASE_URL points at a non-Anthropic host, matching how things already behave under Bedrock and Vertex. Teams putting their own API gateway in front of Claude Code should confirm first that no workflow depends on that channel.