Claude Code 2.1.305: upgrade past the tool-search outage, then audit MCP

Verdict, October 21, 2026. OP, and a must-upgrade, if claude --version is 2.1.304 and requests fail on Bedrock, Vertex, another provider, or a gateway that rejects tool search or leaves ToolSearch out of --tools. The October 20, 2026 changelog says 2.1.305 retries without tool search. Mid as a feature drop for everyone else. The same release loads some managed-mcp.json stdio servers an allowlist used to keep off, and it adds a Linux sandbox switch the changelog says can get around file protections. Check the allowlist before rollout. Leave that switch unset unless a sandboxed command needs a user namespace. No letter moves on the AI Coding Agents board. S stays locked. OP or Mid has not run this build.

The notes below are the Claude Code changelog and docs, read October 21, 2026. Behavior described there is a vendor claim.

Symptom: requests fail on 2.1.304

NERF 2.1.304, dated October 19, 2026, turned tool search on by default behind a custom ANTHROPIC_BASE_URL. A 400 or 422 from the gateway is retried without it. Source: 2.1.304 (opens in a new tab).

NERF The October 20 notes call a wider failure a 2.1.304 regression: every request failing on Vertex, Bedrock, and other providers when the endpoint or a gateway rejects tool search, and behind gateways with ToolSearch disallowed or left out of --tools. The changelog does not publish an error string, a failure count, or a list of gateway products. Source: 2.1.305 (opens in a new tab).

Fix: get to 2.1.305 or newer

BUFF 2.1.305 says Claude Code now retries without tool search. There is no settings key for that retry. Source: 2.1.305 (opens in a new tab).

Run claude --version. The changelog says to. Source: changelog (opens in a new tab).
Native install: claude update. Setup docs say that applies an update immediately. Background updates take effect on the next start. Source: Update Claude Code (opens in a new tab).
It follows your channel. "latest" is the default. "stable" is typically about a week old and skips releases with major regressions. Homebrew claude-code tracks stable; claude-code@latest tracks latest. Homebrew, WinGet, apt, dnf, and apk do not auto-update through Claude Code by default. Documented upgrades: brew upgrade claude-code or brew upgrade claude-code@latest, and winget upgrade Anthropic.ClaudeCode. A notice can arrive before the package has the build. Linux package commands are on that page. Source: setup (opens in a new tab).
claude install accepts a version like 2.1.118, or stable or latest. The printed example is claude install stable. For this patch: claude install 2.1.305. The installer takes a version the same way; the sample is 2.1.89. Source: CLI reference (opens in a new tab), setup (opens in a new tab).
October 21's newest entry is 2.1.306: claude -p reporting "Not logged in" in cloud sessions started without the session environment, and an API error shown as "prompt is too long" with an unneeded compaction when a session has many MCP tools. It does not mention tool search. Landing on 2.1.306 is past the fix. Source: 2.1.306 (opens in a new tab).

Still on 2.1.304: check Auto-update channel in /config, and whether a package manager owns the binary. A custom ~/.local/bin/claude launcher is left in place, so a new build can sit under ~/.local/share/claude/versions/ and not be the one you run. Source: setup (opens in a new tab).

Leave the new Linux sandbox switch off

HIDDEN NERF 2.1.305 adds sandbox.allowNestedUserNamespaces so sandboxed commands on Linux can create user namespaces. The changelog names Chromium and rootless podman, then says this lets them get around the sandbox's file protections. Source: 2.1.305 (opens in a new tab).

Turn it on only when a sandboxed command has to create a user namespace and the job matches those examples. Leave it unset otherwise. Do not put it in org-wide managed settings. The changelog does not say it turns itself on, or that file protections still hold once it is on.

The settings reference, read October 21, documents a different key, sandbox.enableWeakerNestedSandbox, for an unprivileged container. That key defaults to false, and the page says it reduces security. The page does not list allowNestedUserNamespaces, so this article does not invent a JSON block for the new key. Source: settings reference (opens in a new tab). Desktop nested sessions are a separate client: October 16.

Admins: an allowlist omission stops working

NERF 2.1.305 stops filtering managed-mcp.json stdio servers that use ${VAR} only in env. The changelog says one your allowlist left out now loads on upgrade. Use deniedMcpServers to keep it off. Source: 2.1.305 (opens in a new tab).

Do this before the binary reaches the fleet, including a stable channel that picks the release up later.

Find stdio servers in managed-mcp.json whose only variable expansion is in env. The changelog does not say this about a variable in the command or the args.
If the allowlist was what kept that server off, a miss no longer does that on 2.1.305.
Add it to deniedMcpServers. The settings reference says a denylist entry takes precedence and refuses a match from managed-mcp.json. In-process sdk servers stay exempt. Read October 21, that page still describes the allowlist exemption as entries with no variable expansion, and it does not spell out the env-only case. Follow the October 20 changelog there. An unset allowedMcpServers allows every server, so this hits orgs that set an allowlist. Source: settings reference (opens in a new tab).

What else to do on 2.1.305

QoL Each /usage warning is a one-line fix that names its source, and f applies it. The same fixes show in VS Code and /doctor. Source: 2.1.305 (opens in a new tab).

BUFF /effort and /autocompact apply when the model name differed from a modelOverrides value by letter case or a [1m] tag. A setting that was ignored can start working. Read the saved level. Source: 2.1.305 (opens in a new tab).

BUFF New worktrees in a bare repository sometimes started from local HEAD instead of the default branch, and unchanged subagent worktrees were sometimes left behind. Both are marked fixed. If you were picking the branch by hand, check the next worktree. Source: 2.1.305 (opens in a new tab). Harness row: Claude.

QoL CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS is for unattended retry mode (CLAUDE_CODE_RETRY_WATCHDOG). It notices a usage limit lifted before its reset. The changelog publishes no number. Set it only if you already run that mode. Source: 2.1.305 (opens in a new tab).

NERF /artifacts delete no longer takes y or n. 1 or Enter keeps it, 2 deletes it, Esc cancels. 2.1.304, on October 19, still accepted y, n, and Esc with the numbers. Path-mounted Claude Desktop plugins no longer keep allowed-tools when managed settings set allowManagedPermissionRulesOnly. Source: 2.1.305 (opens in a new tab), 2.1.304 (opens in a new tab).

The board stays put

No letter moves. Claude Code stays in A on the October 15 AI Coding Agents list. S stays locked. This is a client patch in front of that rank. The Claude row is unchanged.

What to do today

On 2.1.304, with tool search rejected, run claude update, then claude --version. You want 2.1.305 or newer.
Deny any managed-mcp.json stdio server that expands a variable only in env and that your allowlist was keeping off.
Leave sandbox.allowNestedUserNamespaces unset unless Linux sandbox commands need Chromium or rootless podman.
Press f in /usage. Recheck /effort and /autocompact if modelOverrides differs by case or a [1m] tag.

The weekly patch is on beehiiv: subscribe free (opens in a new tab).

The OP or Mid Team

Sources

Checked October 21, 2026.