Cline Quietly Changes Your Default Model, Kilo Code Stops Following MCP Redirects, and the MCP SDK Starts Shipping Skills

At a glance

• Cline picks a new default model for most providers if you never pinned one.
• A second Cline app now attaches to a running task instead of starting a copy you cannot stop.
• Kilo Code stops connecting to remote MCP servers that redirect to another origin.
• The MCP TypeScript SDK lets servers ship agent skills, with three behavior changes to check first.

This is a thin Monday, and we will say so plainly. The four big coding CLIs sat still on npm, Cursor's main changelog still tops out at October 16, the Cursor CLI changelog still leads with v2026.10.22, and the GitHub changelog has nothing after 7:42 PM ET Friday. What did move is the plumbing your agents rely on. Cline and Kilo Code both shipped between 11:34 PM ET Sunday and 5:06 AM ET Monday.

Treat today as a defaults audit day: pin the model in every Cline provider you use, check your remote MCP server URLs for redirects, and read the MCP SDK v2.4.0 upgrade notes before you bump it.

Top Stories

1. Cline changes your default model and stops running two copies of one task

Cline published four releases overnight: the VS Code extension v4.1.26 at 5:06 AM ET, CLI v3.0.74 at 12:03 AM ET, Desktop v0.0.49 at 12:49 AM ET and SDK v0.2.0 at 11:34 PM ET Sunday. The change most likely to surprise you is in the model catalog. Default models change for most providers, mostly to Kimi K3.1 Pro, MiniMax M3.1 Flash or DeepSeek V4.1 Flash 1017, and the release notes say it plainly: if you use a provider without pinning a model, expect a different default. On the Cline provider itself, an unset model goes back to Claude Sonnet 5.5. Model requests now retry at most 3 times instead of 5.

The CLI and Desktop app fix a problem with tasks open in more than one Cline app. Opening a task that is already running elsewhere now attaches to that run instead of starting a second one that could not be stopped, and if an app closes mid task, requests waiting on it fail with a clear message instead of hanging. In the extension, disabled rules now stay disabled, chat text no longer lands in your terminal when a command starts, and free tier keys on the gemini provider stop failing every turn with a 429 error on Gemini 3 and later.

Practical dev impact: If your team relies on whatever model Cline picks for a provider, pin one today. Our read: cost, speed and quality can all shift without anyone touching settings. Anyone who drives the same task from the CLI and the Desktop app should update both so the second app attaches instead of duplicating work.

2. Kilo Code v7.8.18 drops MCP servers that redirect to another origin

Kilo Code v7.8.18 landed at 5:05 AM ET Monday, and its CLI half updates the MCP TypeScript SDK to v1.32.1 to fix security issues Dependabot flagged, including MCP HTTP and OAuth requests that followed cross origin redirects. The consequence is spelled out: a remote MCP server whose URL redirects to another origin, or answers a POST with a 301, 302 or 303 redirect, no longer connects, and the fix is to use the server's final URL instead. That SDK version itself reached npm on October 5, so the news is Kilo shipping it.

The VS Code side fixes copying selected chat text with Cmd or Ctrl+C or right click Copy in VS Code 1.143, where the selection had been clearing and focus jumping to the prompt. It also updates vite to v7.3.7 for CVE-2026-112944.

Practical dev impact: If a remote MCP server stops connecting after you update, check whether its URL redirects before you blame the server, and swap in the final URL. Our read: a server URL that worked last week can fail today with no change on the server side. VS Code 1.143 users who copy answers out of Kilo's chat can update to get copy working normally again.

3. MCP TypeScript SDK v2.4.0 lets servers ship agent skills

This one is older, about 2.6 days at our check. The MCP TypeScript SDK team released v2.4.0 at 2:32 PM ET Friday, alongside v1.32.2 for the v1 line, which is what npm latest for @modelcontextprotocol/sdk points to. The headline is Skills over MCP (SEP-2640): a server publishes a folder of skills with loadSkills(folder) and skills.attach(server), and a client lists, reads and verifies them with SkillsClient, checking size, digest and SKILL.md frontmatter. It works on both the 2025-11-25 and 2026-07-28 protocol revisions, and attach is experimental and may change in a minor release.

The upgrade notes carry three behavior changes. A tool that puts x-mcp-header on a number parameter is now rejected, as the 2026-07-28 spec requires, so use z.int() or remove the annotation. On a 2025-11-25 connection, an outputSchema built with z.object(...).meta({ id }) is no longer wrapped, so read structuredContent rather than structuredContent.result. And the bundled validator now rejects a $id or $ref with an invalid URI scheme such as my_tool:output.

Practical dev impact: If you maintain an MCP server on the v2 packages, search for those three patterns before upgrading. Each one can break a tool that works today: a tool clients no longer list, a result read from the wrong field, or a schema that no longer compiles. Teams that keep agent skills in a repo now have a standard way to serve them.

Practical Impact Analysis

The thread running through all three stories is that defaults and connections changed underneath you while you were not looking. Cline shifts the model you get when you never chose one, Kilo Code refuses a redirect it used to follow, and the MCP SDK stops accepting schemas it used to tolerate. Our read: none of these breaks loudly at install time, so a short audit this morning beats a confused afternoon. Cline leads because an unpinned model affects every task, while the MCP changes mostly matter to teams that run or build remote servers.

Elsewhere at our check, every npm tag matched Sunday: Claude Code latest v2.1.310 and stable v2.1.308, Copilot CLI latest v1.0.103, Codex latest v0.164.0, and Gemini CLI latest v0.65.0 with no nightly newer than the one published at 9:35 PM ET Saturday. The Cursor CLI changelog still leads with v2026.10.22, and Cursor's main changelog with October 16.

Tutorial

Read the script before you run it.

1. Run step 1 on any machine with Cline or Kilo Code, and check the Cline and Kilo Code extension versions in your editor's Extensions view.
2. Run step 2 from the root of a project that builds an MCP server.
3. Set mcp_url in step 3 only if a remote MCP server stopped connecting.

# We have not run this script end to end on every platform. It only prints and searches unless you uncomment a line.
# 1. Cline and Kilo Code. At 5:52 AM ET Mon 26 Oct npm showed cline latest v3.0.74
#    and @kilocode/cli latest v7.8.18.
npm view cline dist-tags --json
npm view @kilocode/cli dist-tags --json
#    Global npm installs of either CLI, if any. Prints (empty) when there are none.
npm ls -g --depth=0 cline @kilocode/cli 2>/dev/null
#    Optional, npm installs only. Pinned at 5:52 AM ET Mon 26 Oct, latest channel:
# npm install -g cline@3.0.74
#    Installed the Cline CLI some other way? Update it that way instead, and do not mix the two.

# 2. MCP SDK v2.4.0 patterns. Lists file names only, skips node_modules.
npm view @modelcontextprotocol/server dist-tags --json
if ! grep -rlE --include=*.ts --include=*.js --exclude-dir=node_modules -e "x-mcp-header" -e "structuredContent[.]result" . ; then echo "no x-mcp-header or structuredContent.result matches"; fi
#    Files that set a schema id or ref. Open each and look for a scheme like my_tool:output.
if ! grep -rlE --include=*.ts --include=*.js --exclude-dir=node_modules -e "[$]id" -e "[$]ref" . ; then echo "no schema id or ref matches"; fi

# 3. Does a remote MCP server URL redirect? Prints the status and target, follows nothing.
mcp_url=""
if [ -n "$mcp_url" ]; then
  curl -s -o /dev/null -w "%{http_code} %{redirect_url}\n" "$mcp_url"
else
  echo "set mcp_url to check a server"
fi
echo "Done. Nothing was installed or changed."

If step 3 prints a 301, 302 or 303 pointing at another host, confirm you trust that host, then use its URL in your MCP config. Our read: a plain request will not show a redirect that the server sends only for POST, so if the URL looks clean and still fails, ask the server's owner for its final URL. For Cline, open Settings, then API Configuration, and pick a model explicitly for each provider you use.

Sources:

• Cline v4.1.26 release
• Cline CLI v3.0.74 release
• Cline Desktop v0.0.49 release
• Cline SDK v0.2.0 release
• Kilo Code v7.8.18 release
• Kilo Code pull request 15430, MCP SDK update
• MCP TypeScript SDK v2.4.0 release
• MCP TypeScript SDK v1.32.2 release
• Claude Code on npm
• Copilot CLI releases
• Codex releases
• Gemini CLI releases
• Cursor changelog
• Cursor CLI changelog
• GitHub changelog

Recommended AI prompt

Copy this paragraph into ChatGPT, Claude, Gemini, Grok, or whatever AI you use.