Opus 4.7, Claude Design, and an MCP flaw affecting 200k servers

Opus 4.7 dropped this week with real benchmark gains for coding agents — and three breaking API changes you need to handle before upgrading. Anthropic

TLDR;

Opus 4.7 dropped this week with real benchmark gains for coding agents — and three breaking API changes you need to handle before upgrading. Anthropic Labs launched Claude Design, a new product that packages finished designs as handoff bundles for Claude Code. Claude Code itself hit v2.1.114 with xhigh effort, /ultrareview, and Auto mode for Max. A security research team disclosed a systemic MCP STDIO vulnerability affecting 200k+ servers that Anthropic declined to patch at the protocol level. And Claude Haiku 3 retires today.

API & Model Updates

Introducing Claude Opus 4.7

GA as of April 16. SWE-bench Verified jumps from 80.8% to 87.6%, CursorBench from 58% to 70%, and vision resolution is 3× higher. Pricing holds at $5/$25 per MTok — same as Opus 4.6. Three breaking API changes require immediate attention before you migrate:

temperature, top_p, top_k removed — passing any non-default value returns a 400 error. Remove these parameters from all requests.
Extended thinking budgets removed — thinking: {"type": "enabled", "budget_tokens": N} returns a 400. Switch to thinking: {"type": "adaptive"} with an output_config.effort level instead.
Prefill (assistant turn pre-population) removed — any request with a pre-populated assistant turn returns a 400.

New in 4.7: a new xhigh effort level (between high and max) is the recommended default for coding and agentic workloads. An optional task_budget parameter lets the model self-pace across a full agentic loop. The tokenizer has also changed — expect 1.0–1.35× more input tokens depending on content type, which affects cost estimates.

Behavior changes (not breaking, but prompt-tuning may be needed): more literal instruction following at lower effort levels, response length calibrated to task complexity, fewer tool calls by default, more direct tone, fewer subagents spawned by default. Benchmark to watch out for: BrowseComp (agentic web search) dropped from 83.7% on Opus 4.6 to 79.3% on Opus 4.7 — if your agents rely heavily on web research, test carefully before switching.

See the full migration guide and the what's new doc.

⚠️ Deprecation Deadlines — Action Required

Deadline	What retires	Action
TODAY — April 19	`claude-3-haiku-20240307` stops accepting requests	Migrate to `claude-haiku-4-5` now — calls are failing, not silently redirected
April 30	1M context beta (`context-1m-2025-08-07`) removed for Sonnet 4 and Sonnet 4.5	Migrate to Sonnet 4.6 or Opus 4.6 for 1M context (now GA, no beta header)
June 15, 2026	Claude Opus 4 and Sonnet 4 (`claude-opus-4-20250514`, `claude-sonnet-4-20250514`) retire	Migrate to Opus 4.6/4.7 or Sonnet 4.6

Also new: GET /v1/models and GET /v1/models/{model_id} now return max_input_tokens, max_tokens, and a capabilities object — useful for dynamically routing requests in multi-model systems. Release notes.

Claude Design — new Anthropic Labs product

Introducing Claude Design by Anthropic Labs

Launched April 17. A new Anthropic Labs product for creating designs, prototypes, slides, one-pagers, and marketing assets in collaboration with Claude Opus 4.7. Available in research preview for Pro, Max, Team, and Enterprise subscribers at claude.ai/design (off by default for Enterprise — admin toggle required).

Why this matters for builders:

Handoff bundle to Claude Code. When a design is ready to implement, Claude packages it into a bundle you can pass directly to Claude Code with a single instruction. This closes the design→code loop that traditionally requires a designer, a handoff doc, and a separate engineering session.
Auto design system from your codebase. On first run, Claude reads your repo and existing design files to extract your colors, typography, and components — then applies them automatically to every subsequent design. No more "match the brand" prompts.
Usage is separate from chat + Claude Code quotas. Claude Design has its own weekly limits that don't eat into your existing plan. Canva integration is live at launch; Datadog and Brilliant are named early enterprise users.
Community wrapped it in 12 hours. A community-built Claude Design MCP server shipped within half a day of launch, closing the design→code loop through MCP rather than the handoff bundle. Indicator of how fast the MCP ecosystem moves when Anthropic ships a new surface.
Anthropic CPO Mike Krieger resigned from Figma's board on April 14 — days before this launch.

Enterprise usage-based customers get a one-time credit covering ~20 prompts, expiring July 17, 2026. Worth using before then if you want to evaluate on Anthropic's credit.

Claude Code & CLI

Claude Code v2.1.108–v2.1.114 — This Week's Releases

v2.1.114 — parity with Claude Code v2.1.114 internals.

v2.1.113 (Apr 17) — Breaking SDK change: the TypeScript Agent SDK now spawns a native per-platform Claude Code binary instead of bundled JavaScript. Improves performance but requires the updated SDK package. 22 bug fixes across sessions, Remote Control, subagents, and terminal input.

v2.1.112 (Apr 16) — Fixes the "claude-opus-4-7 is temporarily unavailable" error that blocked Opus 4.7 in auto mode. Required if you're running Opus 4.7.

v2.1.111 (Apr 16) — Opus 4.7 xhigh effort level available via /effort, --effort, and model picker. Auto mode enabled for Max subscribers without --enable-auto-mode. New /ultrareview command: comprehensive cloud-based parallel multi-agent code review for current branch or a specific PR (/ultrareview <PR#>). New /less-permission-prompts skill scans transcript history and proposes a prioritized allowlist for .claude/settings.json. PowerShell tool rolling out on Windows (opt-in via CLAUDE_CODE_USE_POWERSHELL_TOOL). OTEL_LOG_RAW_API_BODIES env var for full API request/response logging.

v2.1.108 (Apr 14) — ENABLE_PROMPT_CACHING_1H env var opts into a 1-hour prompt cache TTL on API key, Bedrock, Vertex, and Foundry. Session recap runs automatically when you return to a session. /undo now aliases /rewind.

Full version history: claudefa.st changelog · GitHub CHANGELOG.md

Redesigned Claude Code Desktop — Parallel Sessions & Integrated Editor

Released April 14. The desktop app now supports multiple Claude Code sessions running side by side from a single window, managed via a new sidebar. Also added: integrated terminal, file editing, HTML and PDF preview, and a faster diff viewer in a drag-and-drop layout.

Introducing Routines in Claude Code

Released April 14. Routines bundle a prompt, one or more repositories, and a set of MCP connectors — packaged once and run automatically on Anthropic-managed cloud infrastructure without keeping your laptop open. Three trigger types: schedule (hourly, nightly, or weekly), API call via a per-routine HTTP endpoint with a bearer token, or GitHub webhook on repository events. Limits: Pro users get 5 runs/day, Max gets 15, Team/Enterprise up to 25. Shipped under the experimental-cc-routine-2026-04-01 beta header — shapes and rate limits may change while in research preview.

Engineering reads from Anthropic

Scaling Managed Agents: Decoupling the Brain from the Hands

Architecture writeup on Claude Managed Agents: virtualizing sessions, harnesses, and sandboxes into stable interfaces so the harness implementation can change without breaking your integration. Worth reading before building production agentic pipelines on Managed Agents.

Quantifying Infrastructure Noise in Agentic Coding Evals

How network, container startup, and tool latency affect coding eval scores. Key finding: infrastructure noise accounts for several percentage points of variance and should be measured explicitly when comparing models. Relevant if you're running your own evals.

Agent SDK & Managed Agents

Claude Agent SDK TypeScript — v0.2.107–v0.2.114 this week

v0.2.114 (Apr 18) — parity with Claude Code v2.1.114.

v0.2.113 (Apr 17) — Breaking: options.env again replaces process.env for the subprocess instead of overlaying it. To add individual variables: env: { ...process.env, MY_VAR: "x" }. Native Claude Code binary now spawned via per-platform optional dependency. New sessionStore option (alpha) on query() for mirroring transcripts to external storage. Added deleteSession(), new title option on query(), OpenTelemetry trace context propagation.

v0.2.111 (Apr 16) — Opus 4.7 support — this version is required to use Opus 4.7. Per-tool permission_policy values for remote MCP server entries; startup() and WarmQuery promoted to the public API.

Install: npm install @anthropic-ai/claude-agent-sdk@0.2.114

MCP Ecosystem

MCP 'Design Flaw' Puts 200K Servers at Risk — Researcher Disclosure

Ox Security published research on April 16 documenting a systemic vulnerability in MCP's STDIO transport that allows arbitrary OS command execution — 10 CVEs issued across downstream tools, with affected packages totaling 150M+ downloads. Anthropic declined to modify the protocol architecture, calling the behavior "expected," though they quietly updated their security policy guidance to recommend using STDIO MCP adapters with caution. If you're running STDIO-based MCP servers in production, review the Ox Security technical deep-dive and your own server's trust model. The vulnerability also enables zero-click prompt injection across Claude Code and other AI IDEs via malicious repository content.

GitHub MCP Server v1.0.0 — Generally Available

Hit 1.0.0 this week with a new set_issue_fields tool in the granular Issues toolset for setting/updating/deleting organization-level custom field values on issues. The MCP Apps UI feature flag (remote_mcp_ui_apps) is now available for gradual rollout beyond insiders mode.

Developer Tools & Community

claude-code-best-practices — #1 Trending on GitHub (19.7k stars)

The claude-code-best-practice repo hit #1 trending this week, aggregating 84 documented tactics for using Claude Code effectively. Worth a look if you're onboarding a team.

awesome-claude-code — 39.3k stars, new additions this week

The community-curated list of Claude Code skills, hooks, agents, and plugins continues to grow. New additions this week include claude-pace (a Bash statusline showing rate limit burn rate vs. time remaining) and ccxray for session analysis. The only person allowed to submit PRs to the repo is Claude — contributions go through an issue template.

OpenClaude — Open-Source Claude Code CLI Fork for 200+ Models

OpenClaude is a community fork rewritten to support OpenAI-compatible APIs, Gemini, GitHub Models, Codex, and Ollama. Install: npm install -g @gitlawb/openclaude. Not affiliated with Anthropic. Note: Anthropic appears to have blocked headless/-p mode calls from non-API Claude Code sessions — users on Max plans using scripts are being redirected to API-only access.

What Claude Code's Source Revealed About AI Engineering Culture

HN-scored analysis (76 points) of the Claude Code source following its partial disclosure. Covers architectural patterns and engineering culture observations.

Competitor Dev Tools

OpenAI Codex — Major Expansion on April 16

Codex can now operate your computer alongside you, generate images, remember preferences, and handle repeatable tasks. Developer additions: PR review, multi-file/terminal views, SSH to remote devboxes, and 90+ new plugins (Atlassian Rovo, GitLab Issues, CircleCI, Microsoft Suite, Neon, Render). Most directly comparable to Claude Code's /ultrareview + routines.

OpenAI Agents SDK — Sandbox Execution & Model-Native Harness

Updated April 15 with sandboxed container execution, a model-native harness for frontier models, and a standardized workspace abstraction (local dirs, AWS S3, GCS, Azure Blob, R2). Python-first; TypeScript support planned. Directly comparable to Claude Managed Agents. TechCrunch writeup.

Cursor 3.1 — Canvas for Interactive Agent Output

Released April 16. Canvas lets agents generate persistent React interfaces (charts, tables, diff views) directly in the Agents Window instead of markdown output. Also adds self-hosted cloud agents for enterprise — full tool execution stays in your own network.

Research & Safety

Automated Alignment Researchers: Using LLMs to Scale Scalable Oversight

Published April 14. Nine AI agents running on Claude Opus 4.6 conducted alignment research autonomously for 5 days (~800 agent-hours) and achieved a Performance Gap Recovered (PGR) score of 0.97 vs. 0.23 for a week of human researcher work on the same task. The paper also discusses sandbagging risks (models deliberately performing worse during evaluations) that affect how you should interpret evals of advanced models. Full research paper.

Anthropic's Long-Term Benefit Trust Appoints Vas Narasimhan to Board

Narasimhan (CEO of Novartis) joins the Long-Term Benefit Trust — the governance body that can override Anthropic's board in cases where commercial incentives conflict with the company's mission. Relevant context for builders evaluating Anthropic's long-term governance stability.

⚠️ Action items this week

Before deploying Opus 4.7: remove temperature/top_p/top_k; switch to thinking: {type: "adaptive"} + output_config.effort; remove any prefill assistant turns
Before deploying Opus 4.7: npm install @anthropic-ai/claude-agent-sdk@0.2.114 (TS) — v0.2.111+ is required
Before deploying Opus 4.7: re-measure costs and task budgets on real traffic (new tokenizer = 1.0–1.35× input tokens)
Test carefully if your agents rely heavily on web research: Opus 4.7 BrowseComp dropped from 83.7% → 79.3%
Today: migrate all claude-3-haiku-20240307 calls to claude-haiku-4-5
By April 30: migrate Sonnet 4 / Sonnet 4.5 workloads off context-1m-2025-08-07 beta header
By June 15: migrate off claude-opus-4-20250514 and claude-sonnet-4-20250514
Ongoing: review trust model for any STDIO-based MCP servers — see Ox Security research
Worth a look: try Claude Design at claude.ai/design — Pro/Max/Team/Enterprise, research preview

All resources

You're getting this because you subscribed to the Claude Marketplaces weekly digest at claudemarketplaces.com. First issue on the new Kit.com pipeline — reply if anything looks off.