Claude Marketplace launches and mcp-remote gets five CVEs - plus OpenAI and Anthropic rework prompt caching

Anthropic published its own numbers on how Claude Code sessions changed between March and September: context per request grew 2.6 times, the ratio of input to output tokens went from 189:1 to 324:1, and input that misses the cache fell by more than half. Claude now works 3.3 times longer per prompt, and API-key and cloud-provider users can set a one-hour cache lifetime themselves.

The caching mechanics moved on the API side the same week. OpenAI's GPT-6 caching update applies the discount to shared prefixes reused within 30 minutes, adds explicit cache breakpoints, and lets you change reasoning effort without breaking the cache. Anthropic added a beta that defines tools mid-conversation, so adding or changing a tool no longer invalidates the prompt cache. Anthropic's worked example puts numbers on it: 2.8M input tokens cost $11.20 uncached and $1.62 at a 90% cache hit rate, and an output token costs 100 times a cache read. For an agent that re-reads a long prefix every turn, the hit rate is now the line on the bill that moves most.

A correction to last issue: the same post says the lower Opus 5.5 price is passed on to Pro, Max and Team limits, including cached context, so they go about 25% further than on Opus 5. We wrote that Anthropic had not put a number on it.

From us

• Yaw Terminal 2.1.8 - update if you use Git Search on Windows. In 2.1.7 and earlier, Git Search started git by bare name in the searched folder, and Windows looks for a program in that folder before PATH, so a git.exe planted at a repository's root ran with your privileges when Git Search searched it. The same applied on macOS and Linux when PATH had an empty, . or relative entry. 2.1.8 resolves git to an absolute path from absolute PATH entries only.
• Yaw Terminal - typing in the Command Palette (mod+shift+p) now also searches files in the active pane's folder, with a live preview that follows the selection; Enter opens the file in a new tab. Claude Opus 5.5 is the Yaw Mode default for new setups (it needs Claude Code 2.1.280 or later), and GPT-6 Sol and Luna are in AI Providers, with Sol as the ChatGPT default. Before Claude Code starts, Yaw rewrites saved permission rules Claude Code would reject or warn about, such as Write(src/**) to Edit(src/**), so panes open without the warnings. Install Software offers Antigravity CLI in place of Gemini CLI, which Google stopped serving to free and consumer users in June. The typed provider has three tiers, typed++, typed-- and the free local typed, and from 2.1.7 on a Linux update keeps your session through the restart.
• Yaw MCP 1.0.13 - reads Codex config.toml files correctly again after smol-toml 1.9.0 changed the objects it returns, which had made install codex-cli, doctor and heal treat every valid Codex config as malformed. Yaw Terminal 2.1.8 bundles it. Codex never re-lists tools, so activate and dispatch replies now tell it to call newly loaded tools through mcp_connect_exec. 1.0.12 added yaw-mcp secrets reset, the way back from a forgotten vault passphrase: it moves the old vault aside and starts a new one.
• typed CLI 1.7.2 - Auto Mode asks only at hard stops: deleting or writing outside the project, git that discards work or rewrites the remote, publishing and deploying, credentials and network egress, and downloaded code. Replayed over 205 real sessions, the median number of permission prompts per session fell from 31 to 3. Bash and PowerShell commands can run in the background (/jobs), --add-dir lets a session work in a sibling repo, and typed mcp login runs OAuth for remote MCP servers.
• oam 0.16.4 - one process.stdout.write() reaches the terminal as one write, so TUI frames no longer arrive in two pieces and flicker; in the same ConPTY test, node delivered 12 of 12 frames whole. An agent:false HTTP request releases its connection as node does, in 7 ms rather than two seconds.
• mcp-compliance 0.20 - tests servers against the 2026-07-28 spec: 103 tests, the server/discover handshake, and --spec-version auto|2025-11-25|2026-07-28. Skipped checks no longer count as passes, so a grade can drop on upgrade.

From the Yaw blog

• MCP Server Managers Compared: Do You Need a Proxy? - with one client and a few servers, claude mcp add is enough. A manager pays off once at least two of these apply: several clients sharing one server list, tool-context bloat, or plaintext credentials in config files. It compares local brokers, self-hosted gateways and Docker's MCP Gateway, including where Yaw MCP loses.

Claude Code this week

• v2.1.281 (Sep 23): send now (ctrl+enter) moves running tools to the background instead of cancelling the turn; a recursive rm whose target is command-substitution output, like rm -rf "$(pwd)", now prompts even in auto mode and with a Bash allow rule; "attribution": false in settings.json hides commit and PR attribution (older versions skip a settings file that contains it); resumed sessions no longer re-send earlier turns in a changed form, which could break the prompt cache. Self-hosted runners that append --system-prompt or --append-system-prompt must switch to the -file variants.
• v2.1.280 (Sep 22): the default model on Pro and Team Standard plans is now Opus rather than Sonnet; a stray y or n no longer confirms or closes a dialog; CLAUDE_CODE_MAX_MCP_DESCRIPTION_LENGTH changes the 2,048-character cap on MCP tool descriptions.

The broader week

• mcp-remote: five CVEs - researchers disclosed five vulnerabilities in the stdio-to-remote MCP bridge that many Claude Code and desktop setups reach through npx mcp-remote, including two code-execution bugs (CVE-2026-51996 and CVE-2026-51997) affecting 0.1.16 through 0.1.38. The GitHub advisories name no patched version, and the package now lives at punkpeye/mcp-remote. The researchers' write-up covers the OAuth paths.
• Claude Marketplace - one directory for plugins, connectors, agents and service partners, with 2,000+ plugins and connectors at launch. Enterprises can put part of their committed Anthropic spend toward Claude-powered software from Cursor, Snowflake, CrowdStrike and others, and builders list plugins built on MCP and Agent Skills.
• Anthropic API billing - a refusal that arrives before any output is now billed when its stop_details.category is bio, frontier_llm or reasoning_extraction, at the rates of the model that ran it. Pre-output refusals in other categories stay free.
• Grok 4.7 - xAI's new model has a 500K context window and costs $2 input and $6 output per million tokens below 200K prompt tokens. On xAI's own numbers it scores 37.6% on Terminal-Bench 4.0 and 71.0% on DeepSWE v1.1. It is also in GitHub Copilot.
• Codex CLI 0.156 - an optional fullscreen UI (/tui) with transcript search, a /usage dashboard, and worktree sessions on by default. 0.156.1 adds GPT-6 Sol and Luna to the model picker.
• Copilot CLI 1.0.88 - enterprise managed settings now apply in ACP mode and --server sessions, which previously ran with no managed MCP, permission or plugin policy. Separately, the Copilot app gets local sandboxing for files, network and Git credentials, off by default.
• MCP TypeScript SDK 2.1.0 and 1.30.1 - Streamable HTTP bodies stop at 4 MiB with a 413 before parsing, and JSON-RPC batches are capped at 100 messages. Raise maxRequestBodySize if your server takes larger payloads.
• Google Cloud API Gateway as an MCP server - annotate an OpenAPI spec and the gateway serves each operation as an MCP tool on /mcp, reusing your existing auth, quota and logging. tools/list is unauthenticated by default, and only JWT, not an API key, can secure it.