Agent Ops Brief — Issue #2

1. Claude Code 2.1.305: your MCP allowlist stopped blocking managed servers

What happened. On Oct 20, Claude Code 2.1.305 changed allowedMcpServers so it no longer filters managed-mcp.json stdio servers that use ${VAR} only in env. A managed server your allowlist left out can now load on upgrade with no prompt or notice. Official managed-mcp docs spell the migration: if you used allowlist omission to keep managed servers off, add deniedMcpServers (or split managed-mcp.json per group) before the fleet upgrades. Denylist still applies to managed and provided servers; allowlist skips most managed entries unless ${VAR} appears outside env.

Why operators care. “Not on the allowlist” is not “denied.” Org admins who treated soft omission as a hard block get silent reconnects on first launch after 2.1.305 — including servers that expand secrets from the user environment.

Action. Inventory managed-mcp.json + allowedMcpServers. For every managed server you intend to keep off, add a deniedMcpServers entry by serverCommand or serverUrl (not serverName alone — names are not a security control). Prefer allowManagedMcpServersOnly: true when the allowlist must be authoritative. Verify with claude mcp list after upgrade.

Sources: Claude Code changelog — 2.1.305 · Control MCP server access (managed-mcp)

2. Cursor CLI 2026.10.15: Grep/Glob will search outside the open workspace

What happened. Cursor CLI v2026.10.15 changed Grep and Glob so that when the agent asks to search a folder outside your open workspace, those tools actually search that folder. Before, they quietly searched the workspace and returned results from the wrong place. .cursorignore and Read deny rules still apply outside the workspace; Glob now reports when results were cut off.

Why operators care. Correctness fix with a privacy blast radius. Agents that used to “fail safe” into the repo can now walk sibling directories, home folders the model names, or monorepo neighbors you never opened. Wrong-place silence is gone — real-place search is in.

Action. Review ~/.cursor/cli-config.json deny rules for Read/paths you care about. Tighten .cursorignore for secrets outside the project root if agents ever get absolute paths. Prefer Auto-review / allowlists for Shell that cds out of the repo. Don’t assume “workspace open = search boundary.”

Sources: Cursor CLI changelog — 2026.10.15

3. Cursor Environments API (beta, Oct 16): fleet env is HTTP

What happened. Cursor’s Oct 16 product changelog shipped Cloud Agent Canvases and announced the Environments API in public beta: create and manage the cloud environments agents run in over HTTP (alongside larger environments — up to 300 repos, faster load). Docs cover /v1/environments CRUD, builds, secrets, and wiring environments into /v1/agents creates. CLI side continues to grow agent env (personal environments / public IDs called out in 2026.10.15).

Why operators care. Environment JSON was a dashboard click. Now it’s the same class of artifact as CI infra: scriptable, reviewable, rotatable secrets via API. If you still provision cloud agent env by hand, you’re the bottleneck.

Action. Read the Environments endpoints; decide personal vs team owner. Treat environment.json + secret names like deploy config (PR review). Prefer API/service-account keys with revoke plans. Canvases are the human share layer — Environments API is the operator control plane.

Sources: Cursor changelog — Oct 16 (Canvases & Environments API) · Cloud Agents API — Environments

4. Claude Code 2.1.307: claude_code.safety_event lands in OpenTelemetry

What happened. On Oct 21, Claude Code 2.1.307 added the OpenTelemetry event claude_code.safety_event for each tool call that a permission rule, auto mode, a safety check, a hook, or the sandbox stopped, prompted, or sent back. Pair with existing MCP usage monitoring (OTEL_LOG_TOOL_DETAILS=1) documented on the managed-mcp page when you want server/tool names in tool events.

Why operators care. Issue #1 covered opaque /usage in the product UI. This is the exportable side: which guardrails fire, how often, and whether “deny” is theater. Useful for enterprise collectors before you loosen Auto mode or widen MCP allowlists.

Action. If you already export OTEL from Claude Code, add a pipeline filter/dashboard for claude_code.safety_event. For MCP inventory, enable OTEL_LOG_TOOL_DETAILS=1 in managed environments and aggregate by server. Don’t turn on raw body logging in shared collectors without a privacy review.

Sources: Claude Code changelog — 2.1.307 · Managed MCP — Monitor MCP usage

5. Anthropic Console (Oct 20): org-wide web fetch off + domain allow/block lists

What happened. On Oct 20, organization admins can turn off web fetch for the organization on the Claude Console Capabilities page. With web fetch off: Messages API requests that include the web fetch tool get 400; in Claude Managed Agents sessions, web_fetch calls return an error result to the agent. With web fetch on, admins can set allowed or blocked domains. Managed Agents web_fetch must pass both the org list and the tool’s own allowed_domains / blocked_domains. Same day’s notes also ship user profiles (end-customer attribution for enforcement) and org webhooks for profile restriction events — useful if you resell API access.

Why operators care. Agents that “just fetch docs” are an egress channel. Org kill-switch + domain lists are the admin equivalent of MCP denylists: set them before a prompt injection teaches the agent a creative URL.

Action. Admins: open Capabilities → decide web fetch default for the org; start with allowlists for known docs hosts if you keep fetch on. Agent builders: don’t assume web_fetch works in customer orgs; handle 400 / tool error results. Platform operators: look at user profiles if a safety action should hit one tenant, not your whole org.

Sources: Claude API release notes — Oct 20 · Web fetch tool · Web tool restrictions (Managed Agents)

{
  "allowManagedMcpServersOnly": true,
  "allowedMcpServers": [ /* your fleet */ ],
  "deniedMcpServers": [ /* servers that must stay off after 2.1.305 */ ]
  // + Cursor Auto-review block_instructions for outside-workspace Grep/Glob
}
…

Issue #2 — Agent Ops Brief. Free weekday signals; Operator tier ($9 founding / $15) unlocks the week's paste-ready configs every issue. An unrelated X tip series branded "AgentOps Runbook" (@hikariraina) is not this newsletter — name collision only.