AI library

Source · release

Claude Code changelog, versions 2.1.292 to 2.1.296

Author
Anthropic
Published
9 October 2026
Added
12 October 2026
Original
https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

Summary

Five Claude Code releases shipped between 2026-10-06 and 2026-10-09 (dates from the GitHub releases page). The most significant change is in 2.1.292 (2026-10-06): local stdio MCP servers now negotiate MCP protocol version 2026-07-28 by default, on every install including Bedrock, Vertex, and Foundry. Later releases tighten hooks so that failures and denials block actions reliably.

Key points

  • 2.1.292 (2026-10-06): stdio MCP connections default to the 2026-07-28 (stateless) protocol; MCP_PROTOCOL_NEGOTIATION=legacy opts out. Servers that ignore the newer check are remembered for 7 days and connected the old way. MCP tools with names over 128 characters are now skipped instead of breaking every request. The Agent tool gains an effort parameter for subagents. Security fixes: hook approvals and auto mode no longer bypass the prompt for Windows UNC network paths.
  • 2.1.293 (2026-10-07): Claude Haiku 5.5 becomes the default Haiku model.
  • 2.1.294 (2026-10-08): fixes prompt and agent hooks written as instructions ("Block commands that...") that were allowing what they should block.
  • 2.1.295 (2026-10-08): onFailure: "block" for command and HTTP hooks, so a hook that fails to start, times out, or crashes blocks the action instead of letting it through (fail closed). MCP tool descriptions loaded via tool search get a 16,384- character cap.
  • 2.1.296 (2026-10-09): the default cap on MCP tool descriptions rises from 2,048 to 4,096 characters; managed PreToolUse hooks that deny with "continue": false now refuse the call without ending the turn; new autoCompactWindow for subagents.

Why it matters

Claude Code is the first major MCP client in this library known to use the stateless 2026-07-28 protocol by default, a concrete sign of migration to the new spec. The hook changes show guardrails moving towards fail-closed behaviour, which matters when hooks are used as security controls.