Claude Code strips credential access from MCP helper scripts

Claude Code 2.1.238 strips inherited credential environment variables from MCP helper commands, per the August 20 changelog.

Before this release, a helper shipped inside a plugin, project config, or agent file could read whatever tokens sat in your shell. Helpers from a project, plugin, or agent file now run without inherited credential env vars. Project-scoped headersHelper entries also can't execute until you accept the folder trust dialog, even when Claude Code runs headless through claude -p.

The same release adds headersHelper itself. A URL-based plugin marketplace or catalog entry can declare the command, and it mints short-lived HTTP headers for catalog and same-origin archive fetches. It only fires on install or update, and Claude Code shows you the command before running it.

For anyone running an internal plugin marketplace behind auth, that's a real swap. A static token sitting in config, readable by anyone with repo access, gets replaced by a header minted fresh for each fetch.

Until this release, a plugin author could read whatever credentials sat in your shell by shipping an MCP server inside a plugin or agent file. No exploit required, just inheritance nobody had audited. Watch whether teams that built internal MCP tooling on inherited env vars now have to rewrite their auth flow to use headersHelper instead.

The change landed in the same version train as updates to self-hosted runner draining. It's part of a run of hardening changes to how Claude Code handles plugins running outside one trusted machine.