MCP server authentication now works directly from the CLI with claude mcp login and claude mcp logout, supporting headless setups via --no-browser for SSH sessions. Background subagents now show permission prompts in your main session with the requesting agent named, letting you deny individual tools by pressing Esc instead of auto-denying all requests.