Ing. Calogero Bono
Anthropic has published version 2.1.319 of Claude Code on GitHub. The update changes how auto mode behaves when telemetry or feature flags are turned off, even behind an LLM gateway. It also moves MCP tasks to the background and fixes dozens of errors. For those who use the agent in a company, or run it in scripts and pipelines, some changes may block actions that used to pass.
A few terms before we get into the facts. Auto mode is the mode in which Claude Code runs actions with automatic safety checks, without asking for confirmation at every step. LLM gateway is an intermediate server between the agent and the model, often used by companies for control and billing. MCP is the protocol through which the agent connects to external tools. Feature flags are switches the server uses to turn functions on or off. Telemetry is the sending of usage data.
What changes for auto mode?
According to the official release notes, with telemetry or feature flags disabled, even behind LLM gateways, calls the server cannot verify are either refused or require user confirmation. There is no longer a fallback to the built-in classifier.
Those who want to keep using it must set the variable CLAUDE_CODE_AUTO_MODE_SERVER=0. Bedrock, Vertex and Foundry remain unchanged.
Behind a gateway, CLAUDE_CODE_AUTO_MODE_SERVER=1 enables server-side checking even with CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS set. If managed settings are the ones setting it, they must also set the value 1.
How do the permission refusal and the flags work?
The setting permissions.denyInsteadOfPrompting arrives. A call that would wait for confirmation is denied and the turn continues, in terminal sessions, subagents and teammates. It is useful in automations, where nobody is there to answer.
CLAUDE_CODE_DISABLE_FEATURE_FLAGS also appears, which stops fetching flags without turning off telemetry. Each flag then uses its default value.
A related fix concerns claude -p. In auto mode, if actions are refused because a safety check is missing, it now exits with code 1 and no longer with 0. Scripts that read the exit code will see the difference.
What are background MCP tasks?
When an MCP server runs a call as a task, Claude Code immediately moves it to the background and tells Claude the result once the work is done. Those who prefer to wait can use CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND.
Two fixes concern MCP. Servers with the old handshake did not connect or returned empty results, because Claude Code declared an extension used only with newer servers. Also, a long call on a claude.ai connector sometimes did not report the result after --resume.
Those building integrations can review the gateway already touched in 2.1.316.
What does the Claude apps gateway add?
The gateway gets several new features for administrators. There are admin.pooled_conflict_rule and admin.pooled_priority_order, to decide which group budget pays first for a developer in multiple groups. There is an optional login_notice, with a message shown on the verification page and the sign-in screen. The log format can become JSON with CLAUDE_GATEWAY_LOG_FORMAT=json.
In /usage, today's, this week's and this month's spending appear for those without a spending limit. Startup warnings also appear for policies without desktopHome that use coworkTabEnabled – false or chatSessionRetentionDays, ahead of the Claude Desktop change on November 10.
There is also a warning and a line at startup if the claude.ai login ends and Claude Code continues with ant auth login access, which charges usage to the Claude Console organization.
Limits to know
The release notes are sparse. They do not explain why Anthropic is removing the fallback to the built-in classifier, nor how many installations are affected. There are no independent tests on the real effect of the blocks, and behavior behind third-party gateways may vary. The source list we have is also truncated in its last entry, so some fixes may be missing.
What changes for those working in digital
If you use Claude Code behind a corporate proxy with telemetry turned off, after the update auto mode may start asking for confirmations or refusing actions. Test it first on a test machine. Pipelines that use claude -p need to handle the new exit code 1. Anyone with Bash deny and ask rules will find a useful fix, because commands with words in quotes were slipping through. The fix for the full disk reduces the risk of empty configuration files. The same goes for projects on network folders, where listing all files at startup on Linux was also fixed.
Our take
Refusing what cannot be verified is the right choice for an agent that runs commands. A silent fallback to a local classifier gave false security. The risk lies in communication. A change this heavy for those working behind gateways sits in one line of notes, and many will only discover it when a script stops. The work on explicit warnings, such as the one about the paying organization, remains positive. After the cases of malicious extensions, it is a consistent signal.
Frequently asked questions
How do I keep the old auto mode behavior?
Set CLAUDE_CODE_AUTO_MODE_SERVER=0. This way Claude Code keeps using the built-in classifier. It remains a conscious choice, since it is precisely the fallback Anthropic has removed by default.
Are Bedrock, Vertex and Foundry affected?
No. According to the official notes they remain unchanged. The change concerns telemetry or feature flags turned off and LLM gateways.
What does permissions.denyInsteadOfPrompting do?
It denies the call that would otherwise wait for confirmation. The turn continues without blocking. It applies to terminal sessions, subagents and teammates.
How do I disable only the feature flags?
Use CLAUDE_CODE_DISABLE_FEATURE_FLAGS. It stops fetching flags without turning off telemetry. Each flag uses its default value.
What changes for claude -p?
In auto mode, if actions are refused for lack of a check, it exits with code 1. Before, it exited with 0. This applies to both text and JSON output.
What to watch for in the next Claude Code releases
Version 2.1.319 moves auto mode toward refusing when in doubt. It is worth watching how environments and scripts react.
- Try the update in a separate environment before extending it to colleagues.
- Read the next release notes looking for other changes to gateways and safety controls.
- Check managed settings if you set DISABLE_EXPERIMENTAL_BETAS, because the value 1 is also needed.
