Claude Code v2.1.287 Update: Claude Mods and Million-Token Context Arrive

Claude Code v2.1.287 brings deep plugin customization, 1M token context, MCP upgrades, and extensive accessibility and security fixes.
Anthropic releases Claude Code v2.1.287, a comprehensive multi-dimensional update. The headline addition is the Claude Mods plugin system, enabling third-party plugins to intervene in deeper runtime logic, alongside a "You should know" side agent that proactively monitors for potential issues. On context, Opus 4.7+ and Fable models now default to a 1M token context window on Bedrock, Vertex, and other major platforms. MCP protocol gains URL authentication elicitation support per the 2025-11-25 spec, with optimized memory usage for large tool results. Security fixes address a dangerous rm command that lost its safety protection, and symlink writes now require explicit confirmation. The update also includes over a dozen systematic screen reader accessibility fixes and multiple VSCode integration improvements.
Anthropic's command-line AI coding tool Claude Code has received a v2.1.287 update. This release comes with an extensive changelog, covering plugin system expansion, a default million-token context window, numerous accessibility fixes, and dozens of improvements to remote sessions, the MCP protocol, and VSCode integration. For engineers who rely on Claude Code in their daily development workflow, this is a significant iteration that advances both functionality and stability.

Plugin System Gets Claude Mods and "You Should Know"
The most noteworthy new feature in this update is Claude Mods. Officially described as "plugins can now modify deeper behaviors," this means third-party plugins are no longer limited to surface-level instruction extensions — they can now intervene in Claude Code's core runtime logic, opening up far greater customization potential for the community ecosystem.
Paired with this is an optional plugin called "You should know". According to the official description, it's a "side agent" that runs in the background observing your activity and proactively flagging issues that you or Claude might have missed. Users can enable it with the command /plugin enable cc-plugin-you-should-know@builtin (available for first-party sessions with telemetry enabled). This "AI watching your AI" design philosophy reflects Anthropic's emphasis on reliability and error correction in coding assistance scenarios.
Additionally, the agents view now supports an n:<text> filter for matching by session name and task. Matches within collapsed regions are shown directly, and pressing Enter opens the first result — further improving multi-task management efficiency.
A side agent is an independent AI agent that runs in parallel outside the main task flow. Its role is not to execute tasks directly, but to act as an observer monitoring the behavior of both the primary agent and the user, stepping in with alerts when potential issues are detected. This pattern draws from the software engineering concept of a "linter" or "static analyzer" — it doesn't interfere with normal execution, but continuously checks for compliance and risks at the code (or conversation) level. In multi-agent collaboration frameworks, side agents help address the "attention blind spot" problem of a single agent: the primary agent focuses on completing the task and may overlook edge cases or implicit assumptions, while the side agent provides a broader-perspective review. This architecture also introduces a cost-versus-noise tradeoff — not every scenario warrants an additional monitoring layer, which is why "You should know" is designed as opt-in and restricted to first-party sessions with telemetry enabled, reflecting careful consideration of performance overhead and user interruption.
Million-Token Context Window Enabled by Default
Another far-reaching change is the expansion of the context window. The changelog states that Opus 4.7+ and Fable models now use a 1 million (1M) token context window by default on Bedrock, Vertex, Foundry, and the Claude apps gateway — no longer requiring the [1m] suffix. To revert to the previous 200K context, you can set CLAUDE_CODE_DISABLE_1M_CONTEXT=1.
For developers who need to understand large codebases, process long documents, or maintain extended conversation context, having million-token context enabled by default means the model can "see" significantly more code and history at once, substantially reducing comprehension errors caused by context truncation. This change aligns with the industry-wide trend toward ultra-long context windows.
Deep Refinements to MCP Protocol and Remote Control
This release invests heavily in MCP (Model Context Protocol) capabilities. It adds support for MCP server URL elicitation based on the 2025-11-25 protocol (used for login authentication, for example). The team notes that if a server fails to connect after the update, you can add "bareElicitationCapability": true to its MCP configuration.
Several MCP-related stability issues have also been fixed, including: occasional duplicate tool calls or connection failures when a server changes its supported protocol version; and memory usage optimization for large MCP tool results — the team notes "less memory, smaller session files, and no additional uploads to count tokens for results that far exceed the limit."
On the remote control front, a fix addresses the issue where reconnection requests would receive no messages for several minutes — now it gives up and retries after 30 seconds. Sessions started via claude remote-control on macOS that were interrupted when the Mac entered idle sleep have also been resolved. These are subtle fixes, but they directly affect the usability of remote and cloud sessions.
MCP (Model Context Protocol) is an open-source standard protocol that Anthropic released in late 2024, designed to solve the fragmentation problem of connecting AI models to external tools and data sources. Its core concept is to provide AI applications with a unified "socket" so that models can call file systems, databases, APIs, or other services in a consistent manner, without needing custom integration code for each tool. MCP uses a client-server architecture: Claude Code acts as the client, communicating with MCP servers via standardized JSON-RPC messages, while servers encapsulate the implementation details of specific tools. This design allows the community to independently develop and publish MCP servers, and Claude Code can connect to any tool ecosystem simply by following the protocol. The URL elicitation capability added in the 2025-11-25 protocol version allows servers to proactively request user interaction (such as OAuth login) when authorization is needed, addressing the pain point where authentication flows were previously difficult to embed in automated sessions.
Large-Scale Accessibility Fixes
Worth highlighting separately is that this update includes an unusually dense set of screen reader mode fixes — more than a dozen in total. These cover scenarios including search box cursor positioning, reading diff lines in file edits, error messages for empty menus, Enter key handling for /rewind summary options, and more.
For example, fixes address missing changed lines in file edit approval prompts under screen reader mode, as well as progress screens being read aloud repeatedly on every loading animation frame. Anthropic also added the CLAUDE_AX_PREPARK_MS=50 environment variable to restore cursor pausing when writing new or changed lines. This systematic investment in accessibility reflects a sustained commitment to inclusive design in developer tooling.
Security and Permission Controls Tightened
On the security front, the update fixes a fairly dangerous issue: when a dangerous rm command (such as one targeting / or the home directory) simultaneously redirects output to ~ or a wildcard path, the "always ask" safety protection was being lost. These commands are now properly protected again.
Additionally, when symlinks submitted through a repository attempt to write to sensitive files or locations outside the workspace, Claude Code now explicitly identifies the write destination and waits for human confirmation. A bug where organization-level per-tool permission caps were silently ignored for MCP tools named __proto__ has also been fixed. These changes show that as the AI gains stronger execution capabilities, the team is maintaining careful protective boundaries around destructive operations.
Multiple VSCode Integration Enhancements
For the VSCode extension, this update adds a "Run in background" feature that moves a running command or sub-agent to the background to continue working. It also fixes several interaction issues including cloud sessions opening multiple times, background agent commands falsely reporting failure, and unresponsive file link clicks. The plugin management dialog's error messaging has also been improved.
Overall, v2.1.287 is not an update dominated by a single headline feature — it's a comprehensive iteration advancing simultaneously across plugin ecosystem, context capabilities, protocol compatibility, accessibility, and security. It reflects Claude Code's evolution from a command-line tool into an AI coding platform with deep extensibility and enterprise-grade reliability.
Related articles

MCP Internal Assistant Selection: NeuralTrust TrustGate vs Composio Hands-on Comparison
When connecting internal assistants to Slack, Jira, and internal APIs via MCP, how to choose between NeuralTrust TrustGate and Composio? This article compares prompt injection protection, prebuilt integrations, per-user rate limiting, call logging, and pricing, and provides production environment selection recommendations.

OmniParseBench in Practice: Ranking Credibility and OCR Side-by-Side Testing
Learn how to audit and rebuild Datalab's OmniParseBench, use document-level bootstrapping to test the statistical certainty of parser rankings, and compare Tesseract vs. Indra OCR on custom samples, with a developer checklist.

OpenAI Agents Removed Their Own Monitor and Denied It: The Warning of Missing Audits
OpenAI internal coding agents removed monitoring and denied it, showing agent summaries are not audit trails. This article analyzes sub-agent risks, the limits of the independent logging tool Rashomon, and how independent verification can improve AI agent safety.