Claude Code v2.1.292: claude plugin install --marketplace, an effort Parameter for Subagents, and MCP Protocol 2026-07-28 by Default

Claude Code v2.1.292 is a large release with 92 changelog entries. It lets claude plugin install add a marketplace as part of the install, gives the Agent tool an effort parameter, adds CLAUDE_CODE_OVERLOADED_RETRY_BASE_DELAY_MS, and makes local MCP servers negotiate protocol version 2026-07-28 by default. It also fixes several security and permission issues, including permission prompts being bypassed for file reads from network (UNC) paths, alongside many plugin, mod, scheduled task and cloud session fixes.

What’s New

`--marketplace` for `claude plugin install`

claude plugin install now accepts --marketplace <source>. It adds the marketplace if needed, under the same policy checks as claude plugin marketplace add, then installs the plugin from it.

`effort` Parameter for the Agent Tool

The Agent tool has a new effort parameter, so Claude runs a sub-agent at the effort level you ask for.

`CLAUDE_CODE_OVERLOADED_RETRY_BASE_DELAY_MS`

The new CLAUDE_CODE_OVERLOADED_RETRY_BASE_DELAY_MS environment variable sets a longer base delay for the backoff when Claude Code retries an overloaded (529) request.

MCP Protocol Negotiation and Faster Startup

Local (stdio) MCP server connections now negotiate protocol version 2026-07-28 by default on every install, including Bedrock, Vertex and Foundry; MCP_PROTOCOL_NEGOTIATION=legacy opts out. Local servers that ignore the newer protocol check are remembered for 7 days after one slow connect and then connected the older way without the wait. In claude -p and SDK sessions, the first turn no longer waits for HTTP and SSE MCP servers to answer resources/list.

Mod API Additions

Mods can hook the new prompt.autocomplete event to add their own rows to the prompt box’s autocomplete list. $.model.complete gains prompt caching: prompt and system take blocks of text, and cache: true on a block caches the request up to it. The agent.spawn mod hook now also covers workflow agents, with their run and index, so a mod can refuse them.

Better Ctrl+C Draft Recovery

A prompt cleared with Ctrl+C now stays reachable with Up even after a slash command or a sent message.

Sandbox Auto-Allow for Env-Prefixed Interpreter Commands

With strict sandbox mode set in user, managed or --settings settings, an interpreter command with an environment variable prefix, like FOO=bar python3 app.py, now runs unprompted under sandbox auto-allow.

Routine Runs Publish Private Artifacts Without Asking

Scheduled and Run now routine runs now publish a new artifact that only you can see without asking for approval. Artifacts that request connectors or other access still ask.

Stricter `claude plugin test` and Agent Name Limits

In claude plugin test, a failed expect inside a hook the test registered, or a stub answer the engine refuses, now fails the test instead of passing silently. Agent names are now limited to 256 characters: a longer one is rejected, and a skill’s or a plugin file’s name longer than that is ignored.

Code Review Analytics

The PRs reviewed chart in Code Review analytics now shows the period’s total with its change from the previous period, plus a breakdown by repository.

Fixes and Improvements

Security: PreToolUse hook approvals and auto mode no longer bypass the permission prompt for file reads from network (UNC) paths. Sandboxed commands can no longer read the staged file copies of /ultrareview uploads under ~/.claude/seed-admin, a notebook or PDF read on macOS and Windows can no longer return a file outside what was approved through a link swapped mid-read, and a tampered on-disk cache of server-managed settings can no longer switch off or unseat the built-in policy plugin while the settings fetch fails.
Windows paths: rm -rf on the 8.3 short name or another alternate Windows spelling of the home folder or a drive is now treated as removing it.
Auto and plan mode: Subagent definitions with permissionMode: auto no longer enter auto mode when auto mode is unavailable, a skill’s or slash command’s allowed-tools rule no longer comes back in a later turn when you leave auto mode or plan mode partway through that turn, and a compaction summary that repeated /name can no longer let Claude invoke a skill reserved for the user.
Proxy: NO_PROXY is no longer ignored for Claude Code’s own API requests (sign-in, policy, feedback, artifacts) when HTTPS_PROXY is set.
MCP: An MCP tool with a name longer than 128 characters no longer makes every request fail; that tool is now left out and an MCP error names it.
Managed settings: claude plugin commands such as marketplace add and install no longer run before an organization’s managed settings have loaded on a first run.
Headless runs: One-shot claude -p and Agent SDK runs no longer stop a background command 5 seconds after the final result, and one-shot claude -p runs no longer drop a scheduled wakeup; both are now waited for.
Resume and scheduled tasks: Plan mode is restored when resuming from the claude --resume session picker or with /resume. Saved scheduled tasks created after /resume, /branch or /clear now fire, and a background session’s /loop no longer silently stops when the session’s process restarts.
Search and read tools: Grep and Glob no longer report no matches when the file or folder they were given can’t be read; Claude retries once or tells you. The Read tool now returns an error when a PDF’s pages is a list such as “6,9,15” instead of silently returning only the first entry, and @-mentioned text files over 256KB are no longer left out silently.
Tool input: Grep accepts file_path for path, and Write, WebFetch and Read ignore a few stray parameters instead of failing the call.
Hooks: <system-reminder> tags written in a hook’s output are now escaped before they reach Claude.
Rendering: Long bulleted or numbered replies stream, resize and re-open in the transcript (ctrl+o) much faster, and fullscreen mode no longer sends a full-screen clear on every window resize and Ctrl+L when iTerm2 is detected.
Prompt input: Vim mode no longer leaves the cursor past the end of a line or loses the j/k column on shorter lines, and f/t/F/T/;/, no longer jump to a match on another line. Overlapping pastes no longer reach Claude partly as typed text, and fast typing, input-method text and decomposed accents are no longer dropped while a prompt footer row is selected.
Plugins and mods: A plugin’s tool.check hook answering allow no longer runs a tool that requires your answer (a question, a plan approval) without showing its dialog, tool calls made while the plugin hooks worker restarts are no longer answered without the plugins’ permission hooks, and plugin tool.call hooks now see the arguments the tool will run with. Plugins whose hooks module makes many $.state calls through one const no longer take minutes to load or validate.
Organization plugins: An organization’s plugin is no longer unloaded on its own reload, or after another plugin crashed, when it returned a $ name that a user-installed mod had added; the mod is now unloaded instead.
Cloud sessions: Cloud sessions with a large transcript no longer ask for a permission again after it was approved, scheduled tasks and other queued notifications are no longer lost when a message is retried or edited, and the thinking setting chosen in the client survives a container restart. SVG, HEIC, TIFF and other less common image files now attach as regular files, and approval prompts no longer offer an ineffective “Always allow” for connector tools that an organization set to require approval.
Claude Tag: Replies sent in a Slack thread while Claude is still on its first request there are no longer held or missed, @Claude !status now says when and why Claude has stopped reading a channel’s untagged messages, and an Edit button on the Allowed domains card lets Enterprise admins open the access bundle that sets the channel’s domains.
Code Review: A queued review no longer fails when the pull request moves to a new base branch and the old one is deleted (the commit is re-queued), and reviews of a pull request that edits a CLAUDE.md now use that file’s rules from the base branch.

This release contains 92 changes in total; see the full changelog for the complete list.

How to Update

Check your installed version: claude --version
Update in place: claude update
Local (stdio) MCP servers now negotiate protocol version 2026-07-28 by default; if one of your servers needs the previous behavior, set MCP_PROTOCOL_NEGOTIATION=legacy to opt out.