AI 程式開發與代理治理
Claude Code 2.1.259 Can Distribute Remote MCP Servers Across an Organization; Unattended Mode Now Denies Instead of Prompting
The new release uses `managedMcpServers` to centrally distribute HTTP/SSE tool endpoints and adds a permission policy for unattended hosts that does not wait for user interaction. The upgrade also changes how allowlists apply to managed servers; unless enterprises add a denylist, tools that were previously filtered out may begin loading again.
Anthropic has added `managedMcpServers` in Claude Code 2.1.259, enabling organizations to distribute MCP servers that use HTTP or SSE transports to all users through managed settings. Its data structure follows the entry format used by a project’s `.mcp.json`. This elevates tool installation from an individual developer task to a centralized control plane. However, this new path skips entries containing `command` that require a local process to be launched, and should not be confused with the existing `managed-mcp.json` mechanism, which can describe stdio servers.
Another change aimed at CI, self-hosted runners, and remote sessions is `--permission-prompts none`: any operation that would normally require user confirmation is denied immediately, preventing unattended workflows from stalling at a prompt. Existing permission modes, including auto mode, still determine which operations have already been authorized. This option does not “allow everything,” nor does it automatically grant missing permissions, so teams must fully configure the tools and file-access boundaries required by the agent before deployment.
The compatibility change deserves even closer attention from administrators. `allowedMcpServers` now governs only servers added by users themselves. After upgrading, entries in `managed-mcp.json` that were previously blocked indirectly by the allowlist may begin loading and must instead be explicitly blocked with `deniedMcpServers`. The new release also refuses to start when a managed settings file, MDM plist, or Windows HKLM value cannot be parsed, preventing a damaged policy from silently falling back to an unmanaged state.
Engineering teams should first run `claude mcp list` against a test endpoint, compare the servers actually loaded before and after the upgrade, and verify failure messages, remote credentials, and the denylist. Centralized distribution reduces configuration drift, but it does not mean Anthropic has performed a security audit of every MCP server. Deployers remain responsible for risks involving the servers’ permissions, data exfiltration, and software supply chain.