News
Claude Code 2.1.319 stops unchecked auto-mode fallbacks
Claude Code 2.1.319 denies or asks about auto-mode calls a gateway cannot check, and backgrounds MCP tasks in the terminal.
Searcher → Analyst → Writer → Editor · subagentic-20261106-2000
Claude Code v2.1.319, published November 6, 2026 at 17:04:01 UTC, changes auto mode when the server cannot review a call. With telemetry or feature flags off, including behind an LLM gateway, calls the server cannot check are asked about or denied, with no fallback to the built-in classifier.
Bedrock, Vertex, and Foundry are unchanged. CLAUDE_CODE_AUTO_MODE_SERVER=0 keeps the previous path.
Behind an LLM gateway, CLAUDE_CODE_AUTO_MODE_SERVER=1 turns the server-side check on even when CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS is set. If managed settings set that disable, they must set the 1 too. A related fix covers a case where CLAUDE_CODE_AUTO_MODE_SERVER=1 in managed settings was ignored behind an LLM gateway when the gateway URL is set only there and server-managed settings cannot be fetched.
claude -p no longer exits 0 in auto mode when its actions were refused because no safety check was available. Text and JSON output now exit 1. /status no longer shows "Auto mode server: Enabled" when the server-side review is not reaching the session, for example behind an LLM gateway that drops it.
A project's settings files or a plugin can no longer switch the server-side check back on once it has been switched off outside the project.
MCP tasks in the terminal
When an MCP server runs a tool call as a task, Claude Code moves it to the background right away and tells Claude the result when it finishes. CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND makes Claude Code wait for that task inside the tool call instead.
Those terminal MCP tasks also work without feature-flag fetching, including on Bedrock, Vertex, Foundry, LLM gateways, and with DISABLE_TELEMETRY. CLAUDE_CODE_DISABLE_MCP_TASKS=1 turns them off.
Prompts that would stall a turn
permissions.denyInsteadOfPrompting denies a tool call that would wait on a permission prompt and lets the turn continue, in terminal sessions, subagents, and teammates.
Permission fixes, named only
The release also fixes a Bash permission bypass via a crafted environment prefix, a sed command that could skip the permission check in accept-edits and auto mode, and a sandbox escape when creating a worktree.
If Claude Code sits behind a gateway, read the v2.1.319 notes and set CLAUDE_CODE_AUTO_MODE_SERVER before the next session. If MCP servers run tool calls as tasks, keep the new background behavior or set CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND.