Skills
Claude Code 2.1.238 adds headersHelper for plugin marketplaces and strips inherited credentials from MCP helper commands
The August 20 release lets a URL marketplace or catalog entry declare a headersHelper command that mints short-lived HTTP headers for catalog and same-origin archive fetches, and it only runs on install or update after showing you the command. Project-scoped headersHelper in .mcp.json and inline MCP servers in agent files now require the folder trust dialog to have been accepted, including under claude -p, and helpers from a project, plugin, or agent file run without inherited credential env vars. If you publish an internal plugin marketplace behind auth, this replaces static tokens in config with per-fetch minting.
↳ Follow the thread