LABEL CHECK / DOSSIER

Claude Code

https://github.com/anthropics/claude-code·verified at v2.1.215 (2026-07-19)·last verified 2026-07-19·volatile (re-verified per release (≤2 weeks))

14claims sampled

4as labeled

9partial

1not as labeled

10open deltas

4verified closed

1closed partial

closure trend: settings-layer CVEs and managed-policy bypasses patch within releases; enforcement-layer deltas (deny rules, alias resolution) persist or are closed stale without fixes, though hook exit-code blocking for Agent/Task calls (CC-04) is a partial exception — source-reviewed as fixed 2026-07-17, not TD-executed

Verdict

Claude Code's capability claims largely hold as labeled, but its enforcement-language claims — deny rules, hook exit-code blocking, managed-policy precedence, shell-operator awareness, and per-provider model-alias resolution — are each contradicted by confirmed silent failures, several of which the vendor closed as stale rather than fixed.

Claim ledger — 14 rows

#statusclaimedobservedevidenceverified

1not as labeled"Deny rules prevent Claude Code from using the specified tool" and "If a tool is denied at any level, no other level can allow it"Full detail →Source-reviewed against the issue tracker: deny non-enforcement is a recurring regression across three major version lines — v1.0.93 (#6699, Aug 2025), v2.0.8 (#8961, Oct 2025), and v2.1.49 (#27040, Feb 2026, where… Full detail →[1][2][3][4]2026-07-22

2partial"Claude Code is aware of shell operators, so a rule like Bash(safe-cmd *) won't give it permission to run the command safe-cmd && other-cmd ... A rule must match each subcommand independently"Full detail →Holds as the general design, source-reviewed. Full detail →[1][2][3]2026-07-16

3partial"Exit 2 = Blocking error" — the hooks reference table states exit code 2 on PreToolUse "blocks the tool call" and on Stop "prevents Claude from stopping", while any other exit code is a non-blocking error Full detail →Source-reviewed: exit 2 reliably blocks PreToolUse on Bash. Full detail →[1][2][3]2026-07-17

4partial"Hooks are user-defined shell commands, HTTP endpoints, or LLM prompts that execute automatically at specific points in Claude Code's lifecycle"Full detail →Hooks fire in the common path, but 30+ failure modes are confirmed across silent non-firing, ignored decisions, platform breakage, and data corruption: PreToolUse/PostToolUse hooks intermittently never fire while other… Full detail →[1][2][3]2026-07-22

5partial"sonnet — Uses the latest Sonnet model for daily coding tasks" and "Aliases point to the recommended version for your provider and update over time"Full detail →Source-reviewed Feb–Mar 2026: on Bedrock/Vertex, model: opus in agent frontmatter resolved to the hardcoded dated ID claude-opus-4-1-20250805 — not the live alias target — producing hard 400 errors when the org… Full detail →[1][2][3][4]—

6partial"Claude Code can connect to hundreds of external tools and data sources through the Model Context Protocol (MCP). MCP servers give Claude Code access to your tools, databases, and APIs"Full detail →Connectivity itself is broadly confirmed, but the bridge is not a transparent pass-through: it silently coerces array, object, number, and boolean parameters to strings, breaking connectors with strict Zod schemas with… Full detail →[1][2]2026-07-22

7as labeled"Each subagent runs in its own context window with a custom system prompt, specific tool access, and independent permissions"Full detail →Confirmed: per-subagent context isolation, tool allowlists and denylists (tools, disallowedTools frontmatter), per-agent model and permissionMode all behave as documented (backing block re-validated against docs and… Full detail →[1]—

8as labeledSubagents help you "Control costs by routing tasks to faster, cheaper models like Haiku"Full detail →Confirmed: per-subagent model frontmatter routes tasks to cheaper models as documented. Full detail →[1]2026-07-22

9partial"Sandboxed bash tool: Sandbox bash commands with filesystem and network isolation, reducing permission prompts while maintaining security"Full detail →The sandbox exists and is release-verified, but the boundary has had silent gaps: before v2.1.78, sandbox.enabled: true silently fell back to unsandboxed execution when seatbelt/bwrap was missing from the host. Full detail →[1]—

10partial"Trust verification: First-time codebase runs and new MCP servers require trust verification"Full detail →The dialog exists, but trust-before-verify has been breached four times by CVE: ANTHROPIC_BASE_URL in a committed settings file forwarded the API Authorization header before the trust dialog completed (CVE-2026-21852… Full detail →[1]—

11partial"Write access restriction: Claude Code can only write to the folder where it was started and its subfolders—it cannot modify files in parent directories without explicit permission"Full detail →Holds in the default path, with two patched boundary escapes: symlinks inside the workspace could redirect acceptEdits reads and writes to arbitrary filesystem locations outside the project directory (patched <… Full detail →[1]—

12as labeled"Claude Code uses strict read-only permissions by default. When additional actions are needed (editing files, running tests, executing commands), Claude Code requests explicit permission"Full detail →Confirmed as the default-mode behavior across TD's corpus review: writes, edits, and non-read-only Bash commands prompt by default, and the built-in read-only command set runs without prompting as documented. Full detail →[1]—

13partial"Managed settings: cannot be overridden by any other level, including command line arguments"Full detail →True as currently shipped per release review, but the guarantee has failed twice: before v2.1.74, a user-level allow rule or a committed skill's allowed-tools frontmatter silently won over enterprise managed ask… Full detail →[1][2]2026-07-22

14as labeled"CLAUDE.md files are markdown files that give Claude persistent instructions ... Claude reads them at the start of every session" and both memory systems "are loaded at the start of every conversation"Full detail →Confirmed: project, user, and parent-directory CLAUDE.md files load at session start, and project-root CLAUDE.md is re-injected after compaction, as documented. Full detail →[1]2026-07-22

Delta ledger — 10 open

CC-01opened ≤2026-02

Deny rules in parent settings do not apply to Agent-spawned subagents — confirmed in 5+ issues; #5465 closed not-planned as an architectural limitation

UPDATE 2026-07-04: v2.1.186 fixed 'Agent(type) deny rules and Agent(x,y) allowed-types restrictions not being enforced for named subagent spawns' — but that governs which subagent TYPES may spawn, not whether a parent… Full detail →

closes when:A deny rule set in parent settings blocks the matching command inside an Agent-spawned subagent, re-verified on a current release

evidence:[1][2]Re-verified 2026-07-04 (v2.1.201): #5465 closed not-planned, #25000 closed duplicate — neither fixedRe-verified 2026-07-17 (v2.1.212): #5465, #25000 remain closed not-planned/duplicate; no new fix or comment activityRe-verified 2026-07-19 (v2.1.215): #5465 remains closed not-planned via stale-bot, no maintainer fix; new same-symptom instance #78797 filed 2026-07-18 (repro on v2.1.214, macOS — denied command executes, only a post-hoc warning); corroborating open issues #73380, #67906, #73633, #73893; no linked fix PR anywhere

CC-02opened ≤2026-03

Path deny rules do not bind MCP tools (#28595) or Bash recursive grep/Glob (#28008) accessing the same denied paths

UPDATE 2026-07-04: TD executed the Bash-grep half of this criterion on v2.1.201 — a Read(secret.txt) deny rule did NOT block 'grep -r' recursing into the denied path (the secret line was printed verbatim), while a… Full detail →

closes when:A deny rule on a path blocks MCP file-read tools and Bash grep -r/Glob against that same path, re-verified on a current release

evidence:[1][2]Re-verified 2026-07-04 (v2.1.201, TD-executed): #28595 closed duplicate, #28008 closed stale — neither fixed; Bash 'grep -r' bypass confirmed still active by controlled reproductionRe-verified 2026-07-17 (v2.1.212, source-reviewed only — not re-executed this pass): #28595, #28008 remain closed duplicate/stale with no linked fixRe-verified 2026-07-19 (v2.1.215, source-reviewed): #28595 remains closed duplicate, #28008 closed not-planned, no fix; new corroborating open issue #78752 (2026-07-18), also #51211, #75315; v2.1.215 changelog's only deny-adjacent entry narrows dir/** allow-rule/hook scoping and explicitly states deny/ask rules keep any-depth match (unchanged) — does not touch MCP or grep/Glob

CC-03opened 2025-08

Deny-rule non-enforcement is a recurring regression — 5+ documented instances (v1.0.93 #6699 [genuine fix], v2.0.8 #8961, v2.1.49 #27040, plus 2026-07-18 instances #78764 and #78752) with only one root-cause fix

UPDATE 2026-07-04: the regression pattern holds. #6699 was closed 'completed' (a real fix, 2025-09) but deny non-enforcement recurred at v2.0.8 (#8961, still open) and v2.1.49 (#27040, since closed stale). Full detail →

closes when:A regression-test-backed fix lands and path-specific deny patterns enforce across two consecutive minor releases, re-verified

evidence:[1][2][3]Re-verified 2026-07-04 (v2.1.201, TD-executed): #6699 completed (2025-09) then regressed; #8961 still open; #27040 closed stale (2026-05-23) without a fix; deny non-enforcement (grep -r vector) confirmed persisting by controlled reproductionRe-verified 2026-07-17 (v2.1.212, source-reviewed): #8961 still OPEN, no fix landed; #27040 remains closed not-planned[6][7]Re-verified 2026-07-19 (v2.1.215): of the 3 originally-cited instances only #6699 was a genuine maintainer fix (2025-09); #8961 still open, no fix; #27040 closed via stale-bot only. Two new post-trigger instances found — #78764 (2026-07-18, invalid settings file silently drops deny/ask rules mid-session, fail-open) and #78752 (2026-07-18) — bringing the documented-instance count to 5+, not 3

CC-05opened ≤2026-02

PreToolUse/PostToolUse hooks intermittently never fire while other events in the same settings file fire reliably (#6305, open, has repro, root cause unknown)

closes when:Tool-event hooks fire on 100% of matched tool calls across a multi-session soak test, with the root cause identified and fixed, re-verified

evidence:[1]Re-verified open 2026-06-28 against v2.1.195Re-verified 2026-07-17 (v2.1.212): #6305 still open with active new repro comments through 2026-07-16 (v2.1.211, v2.1.197) — no root-cause fix landedRe-verified 2026-07-19 (v2.1.215): #6305 still open, no root cause identified; reproduced through 2026-07-16 across v2.1.153/2.1.197/2.1.211+; related open cluster #74942, #75081, #64699, #76897, #77480; v2.1.215's hook fix (exit-code-2-not-blocking-on-schema-failure) is a different, narrower bug

CC-06opened 2026-02

model: alias in agent frontmatter hardcoded to a dated model ID on Bedrock/Vertex, ignoring ANTHROPIC_MODEL — all three issues closed stale/duplicate without a linked fix (re-checked 2026-06-11)

UPDATE 2026-06-28: the Opus 4.1 crash/400 behavior is resolved — docs now show Opus 4.6 on Bedrock/Vertex and document ANTHROPIC_DEFAULT_OPUS_MODEL. Full detail →

closes when:model: opus in agent frontmatter resolves to the provider's current alias target, or honors ANTHROPIC_DEFAULT_OPUS_MODEL, on Bedrock/Vertex, re-verified on a current release

evidence:[1][2][3]Re-verified open 2026-06-28 against v2.1.195Re-verified 2026-07-17 (v2.1.212, source-reviewed, not TD-executed): #22587/#25530/#27754 unchanged (closed not-planned/duplicate); no repro run against the current releaseRe-verified 2026-07-19 (v2.1.215, source-reviewed, not TD-executed): #22587/#25530/#27754 remain closed not-planned/duplicate; corroborated by fresh open issue #73556 (2026-07-02) and closed duplicate #58274

CC-07opened ≤2026-05

MCP bridge silently coerces array, object, number, and boolean tool parameters to strings — breaks strict-Zod connectors with no error signal

UPDATE 2026-07-04: #32524 — the canonical coercion issue, 9 duplicates, 'has repro' — was closed by stale-bot as not-planned (2026-07-03), NOT fixed. Full detail →

closes when:Non-string parameters arrive at MCP tools with native JSON types and a strict-Zod connector round-trip passes, re-verified

evidence:[1][2]Re-verified 2026-07-04 (v2.1.201): #32524 closed stale/not-planned 2026-07-03 without a fix; no coercion fix in the v2.1.196–201 changelogRe-verified 2026-07-19 (v2.1.215): #32524 remains closed not-planned (2026-07-03) but still receiving fresh repro comments through 2026-07-06; duplicates #56539, #59227; new related issue #78673 (2026-07-18) shows the bug class remains active

CC-08opened ≤2026-05

~/.claude/mcp.json is silently ignored for user-level MCP config — only ~/.claude.json is honored, with no warning

UPDATE 2026-06-28: re-checked as a design gap, not a tracked bug — Anthropic treats ~/.claude.json as the intended user-level path; #56437/#62888 closed not-planned. Full detail →

closes when:Servers defined in ~/.claude/mcp.json load, or the file produces an explicit warning at startup, re-verified

evidence:[1][2][3]Re-verified 2026-07-04 (v2.1.201): #56437 (2026-06-02) and #62888 (2026-06-27) confirmed closed not-planned (stale)Re-verified 2026-07-19 (v2.1.215): design-gap characterization stands; corroborated by #71597 and #56437 (both closed dupe/stale, not fixed); current official docs confirm only ~/.claude.json is documented — no ~/.claude/mcp.json location exists

CC-09opened 2026-06-23

HTTP 304 cache response zeroes out local managed-settings.json — all deny/allow rules silently dropped

closes when:A 304 (not-modified) response from the managed-settings source preserves the locally cached deny/allow rules rather than emptying them, TD re-verified on a current release

evidence:[1]Re-verified 2026-07-17 (v2.1.212, source-reviewed): #70181 still open, no fix; new corroborating report 2026-07-10 and a related managed-settings-precedence issue (#72634) filed 2026-07-10 describing the same server-payload-wins-over-local-policy failure familyRe-verified 2026-07-19 (v2.1.215): #70181 remains open (filed 2026-06-22, updated 2026-07-10); root-caused as empty/304 remote response treated as 'policy = zero rules,' silently dropping facility-wide deny rules; maintainer-acknowledged security gap, no code fix shipped, only a PreToolUse hook workaround offered

CC-10opened 2026-06-08

Compound-command deny bypass via git -C / cd && / env-prefix forms still active (#66176, filed pre-dossier-cut, absent from prior dossier)

closes when:A Bash prefix rule does not grant permission to env-prefixed or git -C / cd && compound forms it does not literally match, TD re-verified

evidence:[1]Re-verified 2026-07-17 (v2.1.212, source-reviewed): #66176 still open, no fix, last comment 2026-06-10; not TD-executed this passRe-verified 2026-07-19 (v2.1.215): #66176 closed not-planned via stale-bot 2026-07-18, no maintainer fix; corroborating open issues #30519, #16561, #28240; #59498 duplicate

CC-11opened 2026-06

Hook reliability cluster — 4 new non-firing / corruption issues in 17 days (non-interactive non-firing #71022, Linux transcript gap #70632, /clear session_id corruption #70606, unreliable hookAdditionalContext #70479)

closes when:Tool-event and session hooks fire on 100% of matched events across a multi-platform soak test, TD re-verified

evidence:[1][2][3][4]Re-verified 2026-07-17 (v2.1.212, source-reviewed): all four issues (#71022, #70632, #70606, #70479) remain open with no linked fixRe-verified 2026-07-19 (v2.1.215): original #71022, #70632, #70606, #70479 all still open, no fix; 6+ additional hook-reliability issues filed 2026-06-25 through 2026-07-19: #74942, #75081, #76413, #76897, #77480, #78393, #78463, #69260, #78970

Closed deltas — 5 (falsification-gated)

CC-04closed partialre-verified 2026-07-17

PreToolUse exit code 2 does not block Agent/Task tool calls — 100% failure across 19 attempted blocks (#26923); fix asserted in a later release, re-verification pending

closed by:fixed in v2.1.90 — collaborator ashwin-ant confirmed on #26923 (closed COMPLETED 2026-04-18, not stale-bot) that 'PreToolUse hooks that exit with code 2 and emit JSON on stdout now correctly block the tool call (including the Task tool)'; independently corroborated by the v2.1.90 release notes: 'Fixed PreToolUse hooks that emit JSON to stdout and exit with code 2 not correctly blocking the tool call'; source-reviewed, not TD-executed → closed_partial

CC-C1closed verifiedre-verified 2026-05-24

ANTHROPIC_BASE_URL in project settings forwarded the API Authorization header before the trust dialog completed (CVE-2026-21852)

closed by:patched < v2.0.65 — Check Point Research disclosure, Jan 2026

CC-C2closed verifiedre-verified 2026-05-24

enableAllProjectMcpServers: true executed MCP startup commands before the trust dialog appeared (CVE-2025-59536)

closed by:patched < v1.0.111 (Oct 2025); CVE published Feb 2026

CC-C3closed verifiedre-verified 2026-05-24

Symlinks inside the workspace redirected acceptEdits reads and writes outside the project directory

closed by:patched < v2.1.71, per release notes

CC-C4closed verifiedre-verified 2026-05-24

User-level allow rules and skill allowed-tools frontmatter silently overrode enterprise managed ask policies

closed by:v2.1.74 security fix, per changelog

Methodology

sampling: Theory Delta Method §2 material-claims rule (strategy/method.md): a claim is sampled if it appears on the product's own label and would plausibly influence an adoption decision. Sampling frame: code.claude.com/docs label surfaces — the permissions, hooks, security, sub-agents, mcp, model-config, and memory pages — captured 2026-06-11. 14 claims sampled. Non-as-labeled rows were limited to claim areas backed by a published Theory Delta evidence page; contested label claims without a published evidence page (for example, automatic subagent delegation) were deferred to a later verification pass rather than scored.
verification depth: source-reviewed
verification statement: Evidence is drawn predominantly from Anthropic's own documentation and changelogs, the anthropics/claude-code issue tracker, CVE disclosures (Check Point Research), and Theory Delta's published findings, so the dossier's verification_depth is stated as source-reviewed. The model-alias issues (#22587, #25530, #27754, #26179) were re-checked on 2026-06-11 and re-verified 2026-06-28 (v2.1.195). Two rows carry deeper evidence: on 2026-07-04 (v2.1.201) Theory Delta EXECUTED a controlled deny-rule reproduction for row 1 / deltas CC-02 and CC-03 — a scratch project with a Read(secret.txt) deny rule driven via 'claude -p' — and observed that the direct Read tool and a direct Bash 'cat' of the denied path were both blocked, but 'grep -r' recursing into the denied file printed the secret verbatim (the #28008 bypass persists). What was NOT executed on this pass: the MCP-file-read-tool binding (CC-02, no connector wired), the built-in Glob/Grep-tool leak (CC-02, tool unavailable in the nested -p session), the subagent deny-inheritance path (CC-01), the MCP parameter-coercion round-trip (row 6 / CC-07), and every other claim row — those remain source-reviewed. Closed-delta re-verification for the four CVE deltas is by release and disclosure review, not re-execution. UPDATE 2026-07-17 (v2.1.212, this pass): drained the queued re-verification deltas (issue #2560) and the CC-04 retirement (issue #2535). All ten remaining open deltas (CC-01, CC-02, CC-03, CC-05 through CC-11) were re-checked against the live issue tracker and hold unchanged — no new fixes landed, source-reviewed only, not TD-executed (a live nested-session repro for CC-04 was attempted but blocked by this environment's own auto-mode classifier policy, which disallows --dangerously-skip-permissions). CC-04 was retired as closed_partial (not closed_verified): #26923 was fixed in v2.1.90 per maintainer confirmation, independently corroborated by the v2.1.90 release notes, but the falsification criterion was not TD-executed this pass, so per D0086 the delta is scored closed_partial rather than closed_verified; claim row 3's observed text was corrected accordingly (still partial — two unrelated exit-code gaps, #4809 and #21988, remain unconfirmed or historically patched). UPDATE 2026-07-19 (v2.1.215, this pass): re-verified all 10 open deltas (CC-01, CC-02, CC-03, CC-05 through CC-11) as the human re-verification exception path for issue #2785 (D0101 auto-apply classifier could not place these — none is a citation-redirect/fact-corrected shape). Source-reviewed only against live issue-tracker state and the changelog through v2.1.215, not TD-executed. Nine deltas hold unchanged (STILL-VALID); CC-03's instance count strengthens from 3 to 5+ documented instances (two new 2026-07-18 reports, #78764 and #78752). No delta closed and no status changed.
backing confidence: empirical
strongest case against: Claude Code ships near-daily, so version-specific findings decay fast: the model-alias hardcoding evidence dates from February 2026 and its issues were closed stale or duplicate without a linked fix — the behavior may have been quietly fixed, and the docs have since been rewritten to describe per-provider alias resolution honestly; the Task-blocking hook gap (#26923) closed completed with a vendor fix awaiting TD re-execution; and several partial verdicts rest on patched CVEs where current shipped behavior matches the label. The 2026-07-04 executed pass cuts the other way for row 1: rather than upgrading it, controlled reproduction on v2.1.201 confirmed the recursive-grep deny bypass still exfiltrates a denied file, entrenching the not_as_labeled verdict even though the three backing issues were all closed (stale/duplicate/not-planned) and direct-path deny enforcement measurably hardened in v2.1.162–163. The tool's decay class is volatile; this dossier should be re-verified per release or at least every two weeks.