Claude Code v2.1.259–v2.1.261: safer automation, better review, and skill diagnostics

Claude Code v2.1.259–v2.1.261, published September 2–4, 2026, is a practical operations trio. The standout changes are safer non-interactive execution, centralized MCP provisioning, a clearer way to inspect changes, and better diagnostics for skills and organization policy.

Changes worth noticing

• Fail-closed headless automation: --permission-prompts none automatically denies anything that would require a prompt while leaving the active permission mode—including auto mode—to decide requests it can handle without interaction. This is useful for unattended CI, runners, and other headless hosts where a hidden prompt would otherwise stall work.
• Organization-managed MCP: the new managedMcpServers managed setting lets administrators provide HTTP or SSE MCP servers to every user using the same entry shape as .mcp.json. Entries that try to launch a local command are skipped, keeping this managed path focused on remote servers.
• Review changes without leaving the session: /diff opens a fullscreen side panel for uncommitted changes as Claude edits. /cost now points to likely prompt-cache miss causes, making cache and model changes easier to diagnose.
• Know which skills cost context: /skill-doctor reports loaded skills that go unused and their context cost. It is useful when a project has accumulated skills and each session feels heavier than it should.
• Machine-readable plugin checks: claude plugin validate --json adds structured validation output, making plugin validation easier to integrate into CI gates and release automation. /reload-plugins is also available in headless sessions.
• Safer concurrent sessions: parallel Claude Code sessions no longer silently overwrite one another's ~/.claude.json updates, reducing the risk of losing workspace trust, MCP, or project state when several sessions run at once.
• Permission and cache fixes: Bash Read() deny rules now cover more option values, file operands, compound commands, and recursive directory reads. OAuth refresh no longer invalidates the prompt cache in telemetry-disabled sessions.

Operational details

The releases also fix custom command and skill model: frontmatter being ignored in interactive sessions, make auto mode keep the session model when a requested frontmatter model is unsupported, and protect permission boundaries around Bash and file rules. v2.1.261 adds organization-policy diagnostics to /status and claude doctor, plus --append-subagent-system-prompt-file for large shared prompts. Remote Control, resume behavior, and background agents receive several reliability fixes.

What to do

Update Claude Code, then test unattended jobs with an explicit permission policy before changing production runners:

claude update
claude -p "run the repository checks" --permission-prompts none

For enterprise MCP rollout, verify the managed-server configuration on a small group first and keep local-command MCP servers in the existing approved configuration path. For plugin pipelines, prefer the new JSON validation output. If you use a large shared subagent instruction, keep it in a reviewed file and pass it with --append-subagent-system-prompt-file rather than putting it on the command line.

Auto mode now treats a public diagram-renderer URL that embeds content as an upload, so it requires approval unless you explicitly requested it. That is a good default for unattended work: upgrade, test your runners, and keep their permission policy intentional.

Official Claude Code v2.1.259 release notes · Official Claude Code v2.1.260 release notes · Official Claude Code v2.1.261 release notes