On June 29, 2026, Anthropic’s command-line coding agent Claude Code shipped v2.1.196, closing out a week of intense updates: from v2.1.186 on June 22 to this release, seven versions landed in eight days. The theme is easy to spot — enterprise governance and MCP security.
Two items stand out. Organization admins can now set default models from the org console. And a security fix repairs the trust boundary: claude mcp list no longer spawns .mcp.json MCP servers that were “self-approved” by a settings file committed inside the repository.
Org Governance: Default Models and Restrictions
v2.1.196 adds organization default models: once an admin sets them in the org console, users who have not picked a model themselves see “Org default” (or “Role default”) in /model. Combined with role-level settings, enterprises can let different teams land on different models by default instead of relying on verbal conventions.
The restriction half arrived earlier. v2.1.187, released June 23, added org-configured model restrictions: the model picker, --model, /model, and the ANTHROPIC_MODEL environment variable are all covered, and selecting a restricted model shows a “restricted by your organization’s settings” message. Defaults plus restrictions form a complete governance loop — route the right model to the right role, and block the workarounds.
Permission behavior is tightening alongside. v2.1.193 added the autoMode.classifyAllShell setting, which routes every Bash or PowerShell command through the auto-mode classifier instead of only arbitrary-code-execution patterns, and denial reasons now land in the transcript and the permissions view so audits stop guessing.
Patching MCP’s Trust Boundary
The v2.1.196 security fix targets a concrete attack: a malicious repository pre-approving the MCP servers defined in its own .mcp.json via a committed .claude/settings.json. After the fix, claude mcp list and get refuse to spawn such self-approved servers; untrusted workspaces show a pending-approval state, handing the decision back to the user.
The MCP OAuth fix in the same release is just as practical. Previously, when no scope was specified, Claude Code requested the authorization server’s entire supported scope catalog, which triggered invalid_scope failures on GitLab self-hosted and other enterprise identity providers. That is now corrected.
Connection reliability got a series of upgrades too. v2.1.193 makes headersHelper re-authenticate and reconnect automatically when a tool call returns 401/403. v2.1.191 adds retries with backoff for capability discovery (such as tools/list) and for OAuth discovery and token requests on transient network errors. And v2.1.187 stops remote MCP tool calls from hanging silently for five minutes — they now abort with a clear timeout error.
The same instinct runs through plugin handling. v2.1.195 fixed external plugins enabled only by a project-level .claude/settings.json so they now require explicit install consent on every loader path, closing another route where a repository could quietly arrange for code to load.
Other Improvements Operations Will Feel
v2.1.191 cut CPU usage during streaming responses by roughly 37%, a difference you can feel on machines that run all day. v2.1.196 turns the streaming idle watchdog on by default: if a response stream produces no events for five minutes, it aborts and retries instead of hanging forever. Background work got more resilient — long-running commands and workflows now survive the session process being stopped, restarted, or updated; on Windows, background shells are handed off instead of killed; and background agents interrupted by a daemon restart automatically resume from where they left off.
On cost, /code-review merged five cleanup finders into one, cutting token usage by about 25%. For teams that run code review as part of their daily workflow, that is money saved directly.
Smaller touches still help daily use: v2.1.191 lets /rewind recover a conversation from before a /clear, v2.1.196 gives new sessions readable default names instead of anonymous slugs, and file attachments in chat are now clickable, revealing the file in Finder or Explorer.
Two Things to Check Before Upgrading
First, v2.1.193 adds the claude_code.assistant_response OpenTelemetry event, which carries the model’s response text. By default it follows OTEL_LOG_USER_PROMPTS: deployments that already upload prompt content will start receiving response content after upgrading. Teams that want prompts only should set OTEL_LOG_ASSISTANT_RESPONSES=0.
Second, as of v2.1.196, Remote Control is disabled when ANTHROPIC_BASE_URL points at a non-Anthropic host, matching the existing behavior under Bedrock and Vertex. Teams fronting Claude Code with their own API gateway should confirm nothing in their workflow depends on that channel.
Sources
- Claude Code v2.1.196 release notes — GitHub
- Claude Code v2.1.187 release notes — GitHub
- Claude Code CHANGELOG — GitHub
- Claude Code settings — official docs
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.