Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- The official v2.1.299 release was published October 14, 2026 and is not marked as a prerelease. Check the version each entry point actually runs.
- Gateway-key fixes cover listed request paths. Anthropic API keys are still sent; this does not disable all Anthropic connections.
- MCP policy-check order and full server-name matching changed. A policy rejection is not a reason to bypass permissions.
- Streams through a custom ANTHROPIC_BASE_URL now wait 300 rather than 180 seconds without incoming data. Other requests and intermediary proxies need not share that timeout.
Identify whose key is involved and which requests changed
Requests to Anthropic for startup, feature flags, Fast mode, profiles and feedback no longer carry an API key configured for a third-party gateway. The notes explicitly say Anthropic API keys are still sent.
A separate fix concerns server-managed settings requests: when a managed settings file sets ANTHROPIC_BASE_URL, the request carrying a third-party gateway key is now fixed. Both changes should be assessed against the actual configuration and request type.
The scope is specified requests under custom-gateway conditions. The notes do not establish that every request omits keys, or provide findings about an actual disclosure, exploitation or affected accounts. This fix alone cannot turn an unrelated historical connection error into evidence of key exposure.
Record the API gateway separately from the network proxy
First establish whether the actual session sets ANTHROPIC_BASE_URL and whether its key belongs to the third-party gateway or Anthropic. Record the configuration source, a redacted destination hostname and the running version. Keep keys, complete environment files and URLs containing sensitive parameters out of support tickets.
An HTTP or HTTPS network proxy and a model API gateway are different configurations. Setting HTTP_PROXY or HTTPS_PROXY alone does not establish that this gateway-key fix applies. Check terminals, editor panels and managed sessions separately; one terminal version does not establish that every session has updated.
Check MCP policy before checking the full server name
MCP is a protocol for connecting AI tools to external services. Version 2.1.299 fixes newly added MCP servers in headless and SDK sessions connecting before some policy checks ran. A blocked server is now reported as failed without being contacted.
It also fixes claude mcp list, claude mcp get and subagent MCP servers starting a server that policy blocks. A blocked server is now reported as blocked without starting.
Server-name matching in allow rules is narrower too: mcp__a no longer also allows servers named a__b or a_. The documented form is mcp__<server>__*, using the whole normalized name. For an intentionally authorized server named a__b, that means mcp__a__b__*. An agent tools list also needs the complete name. This checks the reach of an existing authorization; it does not add permissions or require bypass mode.
The 300 seconds concern an idle stream at a custom endpoint
The notes say streams through a custom ANTHROPIC_BASE_URL previously aborted after 180 seconds without incoming data and now wait 300 seconds, whether or not feature flags have loaded. This applies to the stated streaming condition. It is not a universal timeout for every API request.
Consider a hypothetical case: the client is willing to wait, but an enterprise proxy closes its idle connection first. The request can still fail earlier. Compare the client, gateway and network-proxy timeout records separately. Longer waiting does not itself resolve authentication failures, spend limits or policy denials, so the number 300 is no promise of success.
Review the existing path without expanding access
For a team already using a third-party gateway, record its running version, configuration source, failed request category and existing MCP authorization separately. The maintainers can then use the established upgrade process. Keep redacted error codes, request IDs and occurrence times to distinguish connection, policy and result problems.
If an MCP failure becomes an explicit policy rejection after an update, check whether the server was meant to be authorized and whether the rule names it in full. Do not clear deny rules, broaden server wildcards or switch to bypass permissions merely to remove the error. Those changes expand authorization; they do not prove that a fix is working.
A published fix does not establish every deployment result
The official GitHub release marks v2.1.299 as a non-prerelease, published October 14, 2026 at 02:49 UTC. That establishes the version and its public notes. It does not prove installation on a particular machine, organization-wide deployment or successful validation of a gateway combination. No new plan, price or regional availability is established here.
Sources
Frequently Asked Questions
Are these fixes restricted to an Enterprise plan?
The release notes do not impose a blanket Enterprise-plan restriction on these fixes. Assess the gateway, custom endpoint and MCP paths you actually use. Do not infer a change to account, regional or plan eligibility.
Should I enable bypass mode when MCP is blocked by policy?
Do not use bypass as the fix. Establish whether the server was meant to be authorized, then check its whole normalized name and the existing rules. Preserve intentional deny boundaries.
Does the v2.1.299 release mean my environment is fixed?
A release and a deployment are separate facts. Confirm the actual version and relevant configuration at the entry point you use. Release notes alone do not establish recovery for every client, gateway or proxy combination.