Claude Code 2.1.305–2.1.308: MCP retries, telemetry and Linux sandbox boundaries

Start with the versions: what the recent notes say

Anthropic's official Claude Code release page lists v2.1.308 as Latest, with a displayed date of October 22, 2026. Its notes only say bug fixes and reliability improvements, without naming individual changes. The detailed items are mainly in v2.1.307 (October 21), while v2.1.305 (October 20) adds a Linux sandbox option.

The page shows dates and local times but does not identify the timezone for those entries. This article follows the listed version order and dates without inferring when a particular region received an update or treating a release announcement as a change to account plans or network availability.

Linux sandboxing: nested user namespaces change the isolation boundary

v2.1.305 adds sandbox.allowNestedUserNamespaces, allowing commands inside the Linux sandbox to create user namespaces; the release notes give Chromium and rootless Podman as examples. The same note explicitly says this lets those commands get around the sandbox's file protections.

This is more than an ordinary compatibility switch. If a team relies on the sandbox to restrict file access, first check the running version and effective user-level, managed and launch-time settings. Consider changing the setting only after confirming that a workload needs nested namespaces and completing a security review. The release page does not specify the default, supported distribution channels or the full set of affected systems, so do not assume it is enabled for every Linux user.

HTTP MCP: automatic retries are limited to read-only or idempotent calls

v2.1.307 fixes a bug where an HTTP MCP connection closing midway through a tool call could cause the call to be sent twice. After the fix, only read-only or idempotent tools are retried. An idempotent operation can be repeated without adding another side effect.

This reduces some duplicate-write risks, but the release notes do not promise exactly-once execution for every MCP server or say that every tool call is retried. If a connection drops during a side-effecting action such as creating, paying, sending or deleting, check the server state and original request result before manually trying again. Do not turn an uncertain outcome into a duplicate action.

The same release also fixes MCP authentication messaging for claude -p on macOS while the keychain is locked, and timeouts that left headless runs failed when macOS or Linux computers went to sleep during an MCP connection. For either symptom, check the actual version and environment first; these fixes do not establish a new MCP permission or account rule.

OpenTelemetry: a new safety-event name, with fields still unknown

v2.1.307 adds the claude_code.safety_event OpenTelemetry event. Anthropic says an event is emitted when a permission rule, Auto mode, a safety check, a hook or the sandbox stops, prompts for or sends back a tool call.

This gives teams using OpenTelemetry an event to watch for in tool-safety flows. The release page does not specify the full event fields, whether prompts or tool inputs are included, default enablement, exporter configuration or retention period. The event name alone is not evidence that raw conversations are sent, and the article should not fill in an unpublished schema.

If your organization already has a telemetry pipeline, first confirm which events it collects under current policy, who can access them and how long they are retained. Then decide whether to use this event for alerts or audits. This article did not connect to a user's environment or verify a particular telemetry configuration.

Run a focused check after upgrading

Confirm the Claude Code version using a method supported by the installed channel. CLI users can run claude --version and compare the result with the official release page. Desktop, VS Code, headless runs and self-hosted runners may be separate execution environments, so record each version and context independently.

Then run a minimal check for each relevant change: test a read-only or explicitly idempotent tool around an MCP disconnect; check the effective nested-user-namespace policy for Linux teams; and inspect the actual safety_event export fields and internal access controls if you use telemetry. Keep settings and fields that the release notes do not specify marked as unknown.

These notes describe Claude Code tool-execution and runtime behavior. They do not announce that proxy networking can bypass platform rules, nor do they provide new plan, region-eligibility or billing commitments. Keep upgrade verification limited to the local version, MCP result, sandbox configuration and telemetry scope that is actually enabled.