Claude Code Auto Mode Guide: Setup, Safety and What’s New in 2.1.319

Claude Code auto mode lets Claude run commands and edit files without asking you every time. A separate safety classifier checks each risky action first.

Version 2.1.319, first seen on November 7, 2026, changed how auto mode works behind LLM gateways. It also added background MCP tasks and new gateway admin controls. This guide covers all of it in one place.

What Claude Code auto mode is

In the classic Manual mode, Claude Code stops and asks before almost every command or edit. That is safe, but it gets tiring on a long task. Auto mode removes most of those prompts.

Instead of asking you, Claude Code sends risky actions to a classifier model. The classifier checks whether the action matches what you asked for. It blocks actions that go beyond your request, touch infrastructure it does not recognise, or look like they were driven by hostile content such as a prompt injection.

The official docs are clear that auto mode reduces prompts but does not guarantee safety. Think of it as a smart seatbelt, not a full sandbox.

How a decision is made

Claude Code runs every action through a fixed order. The first match wins.

1. Your rules: allow, ask and deny rules from your settings resolve first, with a few exceptions such as protected paths.
2. Safe actions: read-only actions and edits inside your working directory are approved straight away.
3. Everything else: goes to the classifier for a verdict.
4. If blocked: Claude gets the reason, for example [Data Exfiltration], and tries another approach.

Explicit ask rules still prompt you, even in auto mode. Deny rules block in every mode.

All six permission modes compared

Claude Code has six permission modes. Each one changes what runs without asking. Here is the full list from the official permission modes page.

Note: Plan mode is a great partner to auto mode. Plan first, approve the plan, then let auto mode carry it out. See my Claude Code plan mode guide for the full flow.

How to turn on auto mode

On Claude Code v2.1.283 or later, auto is already the built-in starting mode for interactive terminal and VS Code sessions. So you may be in auto mode right now. Check the mode indicator under the prompt.

If you are not, here are the ways to switch.

1. Update Claude Code. Run claude update or reinstall. My install guide covers every OS.
2. Cycle with Shift+Tab. In the terminal, press Shift+Tab to move through the modes. Auto sits at the end of the cycle, after Plan.
3. Or start in auto mode. Launch with claude --permission-mode auto. For a one-shot script, use claude -p "Run the tests and fix failures" --permission-mode auto.
4. Make it your default. Add "permissions": {"defaultMode": "auto"} to your user file at ~/.claude/settings.json.
5. Run the guided setup. Type /auto-mode-setup. It reads your project and recent sessions to teach auto mode about your environment.
6. Confirm it. Run /status to see the current mode and whether the server-side review is reaching your session.

Warning: A defaultMode of auto is ignored in a project’s .claude/settings.json or .claude/settings.local.json. This stops a cloned repo from switching auto mode on for you. Put it in ~/.claude/settings.json instead.

Desktop, web and VS Code

• Desktop and web: use the mode selector under the prompt box.
• VS Code: click the mode indicator. The claudeCode.initialPermissionMode setting does not accept auto, but auto is the built-in default there on recent versions.
• Headless runs: claude -p and the Agent SDK start in default unless you pass a mode. See my Agent SDK guide for SDK options.

Plans, models and providers that support it

Auto mode is available on all plans, according to the docs. On Team and Enterprise it is on by default, and admins can switch it off. The real limits are the model and the provider.

The classifier itself runs on Claude Sonnet 5 by default. Since v2.1.302 you can pick another model with the CLAUDE_CODE_AUTO_MODE_MODEL environment variable, set to a full model ID.

Tip: On Enterprise and API accounts, classifier calls count toward token usage. If you watch spend closely, read my Claude Code pricing guide.

What auto mode blocks and allows

The default rules are sensible for most developers. You can print the full lists as JSON with claude auto-mode defaults.

Blocked by default

• Remote code: downloading and running code, such as curl | bash.
• Data leaks: sending sensitive data to outside endpoints, or printing live credentials into the transcript.
• Production: production deploys and migrations.
• Destructive git: force push, git reset --hard, git clean -fd and git stash drop.
• Infra teardown: terraform destroy and similar commands.
• Review bypass: merging unapproved PRs or turning off CI checks.
• Risky deletes: recursive forced deletes whose target is an unresolved shell variable.

Allowed by default

• Local work: file operations inside the working directory.
• Dependencies: installing packages from lock files or manifests.
• Matching secrets: reading .env and sending a key to its own API.
• Reads: read-only HTTP requests.
• Pushes: pushing to branches of the current repo, except deploy-like names such as production or gh-pages.

Protected paths and broad rules

Writes to protected paths are never auto-approved. These include .git, .vscode, .claude, shell rc files like .bashrc, .npmrc and .mcp.json. In auto mode they go to the classifier.

When you enter auto mode, Claude Code also drops very broad allow rules such as Bash(*) or Bash(python*). Narrow rules like Bash(npm test) stay. The broad rules come back when you leave auto mode.

You can also set limits in plain words. If you tell Claude “don’t push”, matching actions stay blocked until you lift it.

How to teach auto mode about your setup

The classifier only trusts what it knows. If it keeps blocking your normal staging bucket or internal API, tell it about them.

• /auto-mode-setup: the guided way. It studies your project and recent sessions.
• autoMode.environment: list trusted repos, buckets and services in settings.
• autoMode.allow: add actions you always want approved. Keep "$defaults" in the list to keep the built-in exceptions.
• Hooks: for custom checks, a PreToolUse hook can add your own logic. My hooks guide shows how.

After 3 blocks in a row, or 20 in total, auto mode pauses and goes back to prompting. These limits are fixed and cannot be changed.

What is new in Claude Code 2.1.319

Releasebot first listed version 2.1.319 on November 7, 2026. The changelog is long, but three themes stand out.

1. Background MCP tasks

Some MCP servers can now run a tool call as a task. Claude Code moves that task to the background right away and tells Claude the result when it finishes. Claude can keep working in the meantime.

• Works everywhere: MCP tasks no longer need feature-flag fetching, so they work on Bedrock, Vertex, Foundry, LLM gateways and with telemetry off.
• Wait instead: set CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND to make Claude Code wait inside the tool call.
• Turn off: set CLAUDE_CODE_DISABLE_MCP_TASKS=1.

If you are new to MCP, start with my Claude Code MCP setup guide.

2. Auto mode behind gateways

• No silent fallback: with telemetry or feature flags off, including behind LLM gateways, calls the server cannot check are now asked about or denied. Set CLAUDE_CODE_AUTO_MODE_SERVER=0 to keep the built-in classifier. Bedrock, Vertex and Foundry are unchanged.
• Force the server check: CLAUDE_CODE_AUTO_MODE_SERVER=1 turns on the server-side check behind a gateway, even with experimental betas disabled.
• Harder to undo: a project’s settings or a plugin can no longer switch the server-side check back on once you turned it off outside the project.
• Better exit codes: claude -p in auto mode now exits 1, not 0, when actions were refused because no safety check was available.
• New setting: permissions.denyInsteadOfPrompting denies any call that would wait on a prompt, and the turn continues.

3. Claude apps gateway controls

• Spend in /usage: developers without a spend limit now see spend for today, this week and this month.
• Pooled budgets: admin.pooled_conflict_rule and admin.pooled_priority_order decide which group budget pays first.
• Sign-in notice: an optional login_notice shows an operator message on the sign-in pages.
• JSON logs: CLAUDE_GATEWAY_LOG_FORMAT=json outputs log lines with severity, time and message.
• Clearer errors: the spend limit error now reads like “spend limit reached · resets Dec 1”.

Note: The same release added an “Earlier in this session” row to /tasks, so you can reopen finished subagents. My subagents guide explains how they work.

Admin controls for teams

Team and Enterprise admins can shape auto mode through managed settings. These are the main keys.

HIPAA-configured organisations start in Manual mode, but users can still switch to auto. For wider security options, see my post on Claude Enterprise security controls.

Troubleshooting auto mode

Auto does not appear in the Shift+Tab cycle

Check three things. Your model must be on the supported list, no settings file may set disableAutoMode, and Anthropic can also switch it off server-side. Run /status to see which applies.

My defaultMode auto setting is ignored

You probably put it in the project’s .claude/settings.json. Move it to ~/.claude/settings.json.

Auto mode keeps blocking normal work

Run /auto-mode-setup or add your trusted services to autoMode.environment. To see the classifier’s reasoning, start with claude --permission-mode auto --debug-file classifier-debug.log and search the log for classifier_request_started.

Auto mode switched back to prompting

That is the fallback. After 3 blocks in a row or 20 in total, Claude Code pauses auto mode. Review what was blocked, adjust your request or rules, then switch back.

Everything is denied behind my LLM gateway after updating

Since 2.1.319, calls the server cannot check are no longer passed to the built-in classifier when telemetry or flags are off. Set CLAUDE_CODE_AUTO_MODE_SERVER=0 to use the client classifier, or CLAUDE_CODE_AUTO_MODE_SERVER=1 to force the server check.

Rate limit or overload errors

The classifier makes extra model calls. If you hit 429 or 529 errors, my Claude API 429 and 529 fix guide walks through the causes.

Frequently Asked Questions

Is Claude Code auto mode free?

Auto mode is a feature, not a paid add-on, and the docs list it for all plans. On Enterprise and API accounts, the classifier’s calls count toward your token usage.

Is auto mode safe to use?

It is much safer than bypass mode, because a classifier checks risky actions and blocks things like force pushes. Anthropic still says it does not guarantee safety, so keep git commits and backups.

What is the difference between auto mode and bypass permissions?

Auto mode reviews risky actions with a classifier. Bypass permissions runs everything with no review and is meant only for isolated containers or VMs.

Can I use auto mode with claude -p?

Yes. Pass --permission-mode auto. Without a mode, claude -p starts in default mode, and since 2.1.319 a run whose actions were refused for lack of a safety check exits with code 1.

Which model does the auto mode classifier use?

Claude Sonnet 5 by default. You can change it with CLAUDE_CODE_AUTO_MODE_MODEL on v2.1.302 or later.

Can my company turn auto mode off?

Yes. Admins set permissions.disableAutoMode to "disable" in managed settings, and running sessions leave auto mode when it arrives.

What are background MCP tasks?

From 2.1.319, when an MCP server runs a tool call as a task, Claude Code moves it to the background and reports the result when it is done. Set CLAUDE_CODE_DISABLE_MCP_TASKS=1 to turn this off.

Sources

• Claude Code docs: Permission modes
• Claude Code changelog on GitHub (2.1.319)
• Claude Code docs: Changelog
• Releasebot: Anthropic updates