Claude Code 2.1.259 adds org-wide managed MCP

Anthropic shipped Claude Code 2.1.259 on September 2, 2026. The cut adds managedMcpServers, a managed setting that lets organizations provide HTTP and SSE MCP servers to every user; --permission-prompts none for unattended headless hosts; and a fix so concurrent sessions no longer silently revert each other's ~/.claude.json. Workspace trust no longer resets, and MCP and project state is no longer lost when many sessions run at once.

Remote MCP from policy, commands skipped

managedMcpServers uses the same entry shape as .mcp.json. Entries that name a command to run are skipped, so stdio servers do not ship through this setting.

That sits beside exclusive-control managed-mcp.json, the standalone file Claude Code already reads from a system path: /Library/Application Support/ClaudeCode/managed-mcp.json on macOS, /etc/claude-code/managed-mcp.json on Linux and WSL, and C:\Program Files\ClaudeCode\managed-mcp.json on Windows. That file can include command-style servers. It cannot be delivered through server-managed settings. When it is present, Claude Code loads only the servers it defines, plus in-process servers the app that started the session registers. Users cannot add, modify, or use any other MCP servers, including plugin-provided servers and servers passed with --mcp-config. An empty mcpServers map disables MCP aside from those in-process host servers.

managedMcpServers is the remote-only push: HTTP and SSE for every user, local commands ignored.

When exclusive managed-mcp.json is active, claude mcp add fails with an enterprise-configuration error. A previously configured server that policy now blocks silently disappears from /mcp and claude mcp list, with no warning that policy is why.

Allowlists no longer filter `managed-mcp.json` servers

2.1.259 changes allowedMcpServers so it governs only servers users add. A literal managed-mcp.json server that an old allowlist used to filter out now loads on upgrade. Use deniedMcpServers to keep it off.

Denylists merge from every settings scope. A denylist match blocks the server; nothing overrides it. Users can still block a managed server for themselves. allowedMcpServers now governs only user-added servers; deniedMcpServers is what still blocks a managed-mcp.json server. Match on serverUrl or serverCommand when the rule has to stick. serverName is the label someone assigned, not the underlying server — a user can call any server github.

If your allowlist was the only thing keeping a managed server dark, add it to deniedMcpServers before you roll this cut.

Deny the prompt, keep the permission mode

--permission-prompts none is for unattended headless hosts. Anything that would prompt is denied automatically. The active permission mode, including auto mode, still decides allowed work. The flag kills prompts. It does not bypass the mode.

Headless and SDK session start also improved: the first turn begins up to 50 ms sooner when MCP servers finish connecting.

Parallel sessions keep trust and MCP state

Concurrent sessions had been silently reverting each other's ~/.claude.json changes. Under a pile of sessions and agents, workspace trust could reset and MCP or project state could vanish. That last-writer-wins bug is fixed.

Unparseable managed settings fail closed

If the managed-settings file, a drop-in, the MDM plist, or the HKLM value cannot be parsed, Claude Code now refuses to start and names the source. Broken policy no longer goes silently unenforced.

MCP servers that disconnect while their tools are being listed at startup report the error instead of showing as connected with no tools. Remote claude.ai sessions no longer take 60 seconds to start a turn after a browser-hosted MCP server's page had gone away.

GitLab MRs, plugin JSON, VS Code filters

Claude Code recognizes glab mr create/merge/close/reopen/note/update. GitLab merge requests show as MR !N in the collapsed tool summary and refresh the footer MR badge.

claude plugin validate gained --json for a machine-readable validation report.

In VS Code, the session list sidebar adds an Active quick filter and a status filter menu: Needs input, Working, and Completed.

The rest of 2.1.259 is a long fix list, including Bash Read() deny rules that now cover files given as option values (--ignore-revs-file=.env, -f.env, @file), git diff / git grep file operands, and cd DIR && cat FILE compounds.

If you manage Claude Code, read how exclusive managed-mcp.json, allowlists, and denylists interact, then upgrade. If an allowlist hid a managed server, put that server on deniedMcpServers first. Confirm the binary with claude --version.