Agent Ops Brief — Sample Issue #0

1. An MCP server entry is a command (and three October CVEs prove it)

What happened. SpanDock walked through three advisories published mid-October: JetBrains Junie CLI (CVE-2026-111091), Z.ai ZCode (CVE-2026-88755), and Anthropic's Claude Agent SDK (GHSA-h4mw-j7qp-8mwm / CVE-2026-96620). Same mechanism: a stdio MCP entry is a program + args that the tool launches on your machine. In headless / -p / Agent SDK / CI runs, the interactive "approve this project's MCP servers" prompt often never appears.

Why operators care. If your CI agent checks out a PR branch and loads .mcp.json (or an SDK resume ID you don't control), you may be running attacker-chosen commands with your credentials. The Claude Agent SDK fix shipped in July; the CVE published in October — CVE-chasers were months behind.

Action. Inventory every non-interactive agent job. Upgrade Claude Agent SDK to Python ≥0.2.124 / TypeScript ≥0.3.208. For Claude Code on untrusted branches, use --strict-mcp-config with an explicit allowlist (or --setting-sources that excludes project MCP). Treat every command in an MCP config like a script in the PR.

Sources: SpanDock write-up · Claude Code MCP docs

2. Claude Code 2.1.310 (Oct 23): Monitor tool + enterprise Remote Control gates

What happened. Claude Code 2.1.310 shipped today. Highlights for operators: Monitor tool and plugin monitors land on Bedrock/Vertex/Foundry (and when telemetry is off); long foreground sleeps are blocked there too. Cloud sessions / Remote Control permissions are now attachable to Enterprise custom roles. MCP tool timeouts in non-interactive sessions that leave an elicitation unanswered now tell Claude not to retry the call.

Why operators care. Enterprise teams can finally gate Remote Control / cloud sessions by role instead of org-wide on/off. The elicitation timeout fix stops headless agents from hammering a stuck MCP consent loop and burning tokens.

Action. Run claude --version. If you're on Enterprise, map Remote Control + cloud session perms into the roles that should actually have them. In CI, prefer fail-closed MCP behavior over silent reconnect thrash.

Source: Claude Code changelog

3. Cursor CLI v2026.10.22: nested AGENTS.md finally applies on edit

What happened. Cursor CLI v2026.10.22 (Oct 22) fixed a rules gap operators kept hitting: when the agent edits or creates a file in a subdirectory, it now sees that directory's AGENTS.md and nested always-apply rules — even if it never read a file there first. Same release: agent env deploy --env <public-id> redeploys an environment file onto an existing Cloud Agent environment; custom subagents whose pinned model is blocked now fall back to the parent model instead of hard-failing; MCP servers no longer hide all tools when one schema is invalid.

Why operators care. Monorepo rules that lived under packages/foo/AGENTS.md were easy to ignore mid-edit. Redeploying cloud envs without recreating them unblocks scripted fleet updates. Soft model fallback means one admin model-policy change doesn't brick every Task subagent overnight.

Action. Put package-local conventions in nested AGENTS.md (or .cursor/rules with globs). Pin Cloud Agent env public IDs in your deploy scripts and try agent env deploy --env …. Upgrade CLI: agent update.

Source: Cursor CLI changelog

4. Claude Code 2.1.309: sandbox can no longer rewrite your --mcp-config

What happened. In 2.1.309 (Oct 22), Claude Code fixed sandboxed commands being able to modify the MCP config file passed with --strict/--mcp-config. Same build: claude ultrareview now requires workspace trust (or --trust-workspace / an escape hatch env); dangerous rm/rmdir in bypass-permissions Desktop/VS Code is denied with a rewrite hint so unattended sessions keep moving.

Why operators care. If you thought the sandbox contained MCP allowlists, it didn't — until yesterday. Ultracode / ultrareview without trust is a footgun on cloned forks.

Action. Patch to ≥2.1.309 before the next unattended batch. Re-check any CI that mounts writable paths next to your MCP config. Prefer deny-by-default over bypass-permissions for overnight runs.

Source: Claude Code changelog — 2.1.309

5. Anthropic: formal verification at OSS-Fuzz scale (HN front page)

What happened. Anthropic published that Claude + Theorem produced machine-checked no-crash proofs for 239 OSS-Fuzz entry points across 123 libraries (modeled Linux / RISC-V, inputs under 64 MB, single-threaded assumptions). HN put it near the top of Oct 23 (~440 points). Claude also found and patched bugs, including CVE-2026-56132.

Why operators care. Not a "paste this tomorrow" feature — but it reframes what you ask agents to do on security-critical paths: prefer machine-checked claims over vibes when the harness exists. Also a reminder that agent-found CVEs are shipping in the wild; your dependency update loop should treat agent PRs like any other security PR.

Action. If you maintain C/C++ or fuzzed libraries, skim the post and decide whether a Theorem-style gate belongs after your agent proposes a fix, not instead of review. Don't outsource merge authority.

Sources: Anthropic research post · HN discussion

Operator config drop (paid teaser — full file below for Sample #0)

Week's theme file: headless Claude Code + Cursor rules that refuse project MCP unless you explicitly allow it.

Paste into .cursor/rules/mcp-headless-hygiene.mdc (Cursor) and mirror the shell wrapper for Claude Code CI.

---
description: MCP and headless agent hygiene — treat server entries as code
alwaysApply: true
---

# MCP / headless hygiene

- Treat every MCP `command` / args list as executable code. Review it in PRs like a shell script.
- Never tell the agent to "trust all project MCP servers" on a fork, PR branch, or untrusted checkout.
- Prefer an explicit allowlist of MCP servers for CI and `-p` / headless runs.
- If a task needs a new MCP server, stop and ask the human operator — do not invent `.mcp.json` entries.
- When editing files under a package directory, obey that package's `AGENTS.md` and nested rules.
- Do not modify MCP config files, credential stores, or `--mcp-config` targets from sandboxed or agent shell commands.

Claude Code CI wrapper (drop as scripts/claude-ci.sh):

#!/usr/bin/env bash
# Headless Claude Code on untrusted / PR checkouts — strict MCP only.
set -euo pipefail

# Only the servers YOU pass here load. Project .mcp.json is ignored under --strict-mcp-config.
STRICT_MCP_CONFIG="${STRICT_MCP_CONFIG:-$HOME/.config/claude/ci-mcp.json}"

if [[ ! -f "$STRICT_MCP_CONFIG" ]]; then
  echo "Missing $STRICT_MCP_CONFIG — create an allowlisted MCP config before CI agents run." >&2
  exit 1
fi

exec claude -p \
  --strict-mcp-config "$STRICT_MCP_CONFIG" \
  --setting-sources user \
  "$@"

Create ~/.config/claude/ci-mcp.json with only the servers your org actually wants in CI (often empty mcpServers: {} until you need one). Upgrade path checklist: Claude Code ≥2.1.309, Claude Agent SDK ≥0.2.124 / 0.3.208, Cursor CLI ≥2026.10.22.

Sample Issue #0 — Agent Ops Brief. Free weekday signals; Operator tier ($9 founding / $15) unlocks the week's paste-ready configs every issue.