Claude Code 2.1.257–2.1.260 adds managed MCP and safer headless controls

Claude Code’s September 2026 releases add several controls for teams running coding agents in managed or unattended environments. Versions 2.1.257 through 2.1.260 bring Fable 5.1 support, organization-managed MCP servers, a headless permission mode, and a new fullscreen diff panel.

Centrally managed MCP servers

Version 2.1.259 adds the managedMcpServers managed setting. Organizations can provide HTTP or SSE MCP servers to every user using the same entry shape as .mcp.json; entries that would run a local command are skipped.

The release also changes how allowedMcpServers is applied: it governs servers users add, while a literal managed MCP entry is loaded unless a deniedMcpServers rule keeps it off. Administrators should review both settings during migration so a policy does not unintentionally expose or suppress a server.

Headless runs can deny prompts instead of hanging

The new --permission-prompts none option is designed for unattended headless hosts. Anything that would require a permission prompt is denied automatically, while the active permission mode continues to decide actions that do not need a prompt.

That behavior is safer for automation than waiting forever for a person who is not present, but it can also make a job finish without completing its intended work. Treat a denied prompt as a structured failure in orchestration and surface it in job logs.

Fable 5.1 and review visibility

Claude Code 2.1.257 adds Claude Fable 5.1 as the default Fable model, with a 1M context window, adaptive thinking, and the documented $10/$50 per-million-token input/output rates plus cheaper cache reads. Version 2.1.260 adds a fullscreen diff panel that opens beside the conversation and shows uncommitted changes as Claude edits; toggle it with /diff.

The same release adds text-form /advisor commands for desktop, Remote Control, and headless sessions, plus more diagnostic detail for prompt-cache misses. These features make it easier to inspect and steer long runs, but teams should still review the actual diff and tool permissions before merging.

Reliability and migration notes

The releases fix concurrent-session corruption in ~/.claude.json, resume failures involving attachments or worktrees, managed-settings enforcement gaps, and several MCP, permission, and remote-session edge cases. The 2.1.260 changelog also reverses a 2.1.259 change that applied Read() deny rules to Bash arguments too broadly, so organizations with those rules should test their automation after upgrading.

Because these are fast-moving CLI releases, pin and test the version used in CI or self-hosted runners. Validate managed MCP policy, unattended prompt behavior, model selection, prompt caching, and diff review before rolling the update across a fleet.

Sources

• Claude Code Docs — “Changelog”: https://code.claude.com/docs/en/changelog
• Anthropic — Claude Code official repository changelog: https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md
• ClaudeDevs on X — official developer updates: https://x.com/ClaudeDevs