Claudoscope Files

Catches Claudoscope up with Claude Code 2.1.238 through 2.1.270. Claude Code now stamps transcripts with which skill, MCP tool, or subagent drove each billed turn, which turns three configuration rails into spend surfaces: the Skills, MCPs, and Agents rails can finally answer what a thing costs, not just whether it is installed. Alongside that, two cost corrections you could not have spotted from inside the app: organizations on contracted rates were shown list price, and the pricing provider silently reset to Anthropic on every launch.

Requires a one-time full reparse on first launch (parser version bump plus a pricing-table key change), after which launches hydrate from cache as before.

Fixed

• Contracted rates are honored instead of list price. Claude Code 2.1.243 lets an organization publish negotiated per-model rates through managed modelPricing. Claudoscope read none of it, so every cost figure on a machine under a contract was the public price. Overrides are now resolved once, before the first scan, and flow through the single pricing table the whole app already shares, so every cost, chart, and alert reflects them. A row written by an override suppresses the fast-mode 2x multiplier, since the documented behavior is that the written rate is used as-is, and the resolved table is hashed into the cache key so adding, editing, or removing an override rebuilds costs rather than leaving stale ones in place.
• The pricing provider no longer resets to Anthropic on every launch. pricingProvider and pricingRegion were never persisted. Picking Vertex held for the session, then reverted at next launch, and re-picking it wiped and reindexed the entire summary cache each time. Both now persist, so the choice survives a relaunch and costs no longer silently revert to a different provider's rates overnight.
• Fable 5.1 cache reads priced at $0.25/MTok. claude-fable-5-1 became the default Fable model in 2.1.257 with cache reads at a quarter of Fable 5's $1.00, while input and output stay at $10/$50. It was previously billed at the Fable 5 cache-read rate, overstating cost on exactly the token class a long session accumulates most of.
• Cowork sessions no longer lose their hook runtime stats. The Cowork parser had been dropping the field since 1.1.0 introduced it, so hooks that fired inside a Cowork session were missing from the Hooks Runtime tab. It now forwards every pass-through field.
• Hooks referencing a managed MCP server are no longer reported as broken. Managed servers were invisible to Claudoscope, so HOOK003 checked hook matchers against a server list that omitted them and flagged working configuration. Managed servers are now part of that inventory.

New Features

• Cost attribution across skills, MCP tools, and subagents. Claude Code 2.1.24x tags billed records with the skill, MCP server and tool, or subagent type that drove the turn. A new Analytics tab reports spend per skill, per MCP tool, and per agent over the selected window, and the Skills, MCPs, and Agents rails each carry a lifetime spend chip. Skill and MCP attribution are independent partial partitions rather than two slices of one pie (a single turn can carry both tags), so each is shown with its own unattributed remainder and neither is normalized to 100%. Coverage is roughly a tenth of billed turns, because only transcripts written by 2.1.24x and later carry tags at all, so every surface states its coverage; a rail entry with no attributed spend shows no chip rather than $0.00, since absence cannot distinguish "never ran" from "ran before tagging existed". The same skill is tagged both bare and plugin-qualified, and both forms fold to one row.
• Prompt cache health. Cache Effectiveness gains a card reporting tokens re-primed and what that cost, a cold-turn floor, and the two prefix-rebuild causes a transcript can actually evidence: a session resumed on a later day (no cache TTL survives overnight, so each later day rebuilds the whole prefix) and a mid-session model switch (one model cannot read another's cached prefix). The headline is the wasted 1-hour TTL: a session that wrote heavily on the 1h tier and read back less than it wrote paid roughly twice the input price for nothing, and the premium over the 5-minute rate is reported per session. Everything here is derived from per-day and per-model totals rather than measured per turn, so the card is labelled inferred and the counts are stated as lower bounds.
• Plugin scope drift. The same plugin can be installed at both user and project scope at different commits, and which copy a session loads depends on the directory it started in, so two projects can run different code under one plugin name with nothing in the UI distinguishing them. The Plugins rail now reads the per-scope install records, badges a drifted plugin, lists each scope with its version and commit, and explains what the drift means for your specific projects.
• Managed MCP servers in the MCPs rail. managedMcpServers from organization policy was the one MCP source Claudoscope never read. Managed servers now appear with a managed badge and take precedence on a name collision, matching Claude Code, which does not let a user config override them.
• Subagent model and effort. The agent tree shows the effort level each subagent actually ran at alongside its model, and a background job's detail card reports the model, effort, and estimated cost of the run rather than only its token count.
• More of settings.json surfaced. maxEffortLevel, bashOutputMaxChars, taskOutputMaxChars, promptCacheTtl, and subagentPromptCacheTtl are read and displayed, and the Permissions section states whether reads are confined to the working directories. The cache TTL keys are display only: cost already prices the 5-minute and 1-hour tiers from each record's own split, so nothing about billing depends on them.

Security

• New CFG019. A managedMcpServers entry that defines a stdio command is reported as an error. Claude Code accepts only http and sse servers in managed scope and skips anything else without saying so, so an administrator can believe a server is deployed fleet-wide while it runs nowhere.
• New CFG020. A permissions.allow Bash rule whose wildcard is not its final segment is a privilege escalation, not a typo: Bash rules match a prefix, so Bash(git * main) ignores everything after the * and permits any command beginning git, chained ones included. Checked across user, project, and project-local settings, because allow lists usually live in the repo.
• New CFG021. bashOutputMaxChars or taskOutputMaxChars outside the range Claude Code accepts, which it clamps without reporting, so the configured number is not the one in effect.
• New HRD014. permissions.blockReadsOutsideWorkingDirectories not enabled, which leaves Read, Grep, and Glob able to reach any path on disk, including other repositories and credential files.
• Containment Escape added to the hardening auto-mode baseline (2.1.257), covering cloud metadata-credential fetches, egress-allowlist evasion, and cross-tenant reach. Installing the baseline now also satisfies HRD012, which previously reported a missing hard_deny block that the baseline never supplied.
• Four new skill checks. SKL010 flags a relative link in SKILL.md that resolves to nothing, so instructions Claude was meant to load are silently absent. SKL011 flags a tool restriction naming an MCP server that is not configured, where an allow entry grants no access and a deny entry blocks nothing. SKL015 flags the same skill name defined in two scopes, which Claude Code resolves to one without reporting which, so an edit can land in the copy that is not running. SKL016 flags an installed skill that never appears in an attributed turn while others do, since its description occupies context on every request; it stays silent until the corpus holds enough tagged turns for the absence to mean anything.
• New PLG004 for the plugin scope drift described above.
• PreModelSwitch and PostModelSwitch recognized as hook events (2.1.251), so a matcher set on either is correctly reported as dead config.