Skip to content
NLEN
Illustration: a terminal assistant sends several tool tasks to the background as glowing cards while a permission gate stays closed.

Claude Code 2.1.319: MCP tasks move to the background, deny instead of waiting and less fallback in auto mode

By Ivo Donker · — text: Claude (AI, Anthropic), checked against the sources

What changes in Claude Code 2.1.319? Three things stand out for anyone who uses the tool daily. An MCP tool that runs as a task moves to the background right away, and Claude gets the result when it finishes. A new setting, permissions.denyInsteadOfPrompting, denies a tool call that would wait on a permission prompt, so the turn continues. And behind your own LLM gateway, auto mode no longer falls back to the built-in classifier. The November 6 release also contains several security fixes, including a sandbox escape when creating a worktree.

The full list is in the release notes on GitHub. Below are the points with the most practical impact. Earlier updates are in our overview Claude Code news.

MCP tasks keep running in the background

According to the release notes, Claude Code now supports MCP tasks in the terminal: "when an MCP server runs a tool call as a task, Claude Code moves it to the background right away and tells Claude the result when it finishes". Long tool tasks, such as a build or a large search through an MCP server, no longer hold up the session. If you want the old behaviour, set CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND; CLAUDE_CODE_DISABLE_MCP_TASKS=1 turns MCP tasks off entirely. What MCP servers are and which ones matter is in our overview of MCP and agent tooling.

Deny instead of waiting on a permission prompt

The new setting permissions.denyInsteadOfPrompting means that "a tool call that would wait on a permission prompt is denied and the turn continues". It applies in terminal sessions, subagents and teammates. It is mostly useful for sessions you leave running unattended: an agent stuck on a question nobody answers now carries on without performing the action.

Auto mode behind your own gateway

Auto mode behind your own gateway
SituationWhat 2.1.319 does
Auto mode with telemetry or feature flags off, or behind an LLM gatewayCalls the server cannot check are asked about or denied; no fallback to the built-in classifier
Keep using the built-in classifierCLAUDE_CODE_AUTO_MODE_SERVER=0
Turn on the server-side check alongside CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETASCLAUDE_CODE_AUTO_MODE_SERVER=1
Bedrock, Vertex and FoundryUnchanged
claude -p in auto mode when actions were refusedNow exits with code 1 instead of 0

If you call Claude Code from scripts or CI, you will notice that last point at once: a run that was not allowed to do anything now counts as failed.

Security fixes

The release notes give no CVE numbers and no details on exploitation. Updating is the simplest measure. Today we also wrote an article on secrets in Claude Code settings, about stored approved commands and the keys they can contain.

Smaller changes you may notice

A self-paced /loop now ends when a turn finishes without rescheduling; CLAUDE_CODE_LOOP_KEEPALIVE=1 keeps the old behaviour. /tasks gets an "Earlier in this session" row listing finished subagents, which you can reopen. And Claude Code warns when your claude.ai login ends and the session continues on a sign-in that bills usage to a Console organisation. If you are just starting with the tool, the basics are in our Claude Code tutorial.

What we did not check

We read the release notes; we did not test the behaviour ourselves. Whether the security issues were exploited before the fix is not stated in the notes.

Checked on November 9, 2026.

This article was written with AI (Claude, Anthropic) and checked against the sources below.

Sources