Claude Code 2.1.319: long MCP calls move to the background, prompts can auto-deny, and four permission holes close

Published November 8, 20265 min read

The 2.1.319 release notes run to well over a hundred items. Most are small fixes. This page pulls out the changes that alter how your sessions behave or what they allow. We read the notes and the linked docs; we haven't run each change against our own setup.

If you last caught up at 2.1.311, our guide to that release covers the team settings it added.

The fixes that are a reason to upgrade

Four items in the notes describe ways a command could get past Claude Code's own checks. None comes with a CVE or a write-up, so the notes are all we have to go on.

Several smaller rule changes tighten the same area. Bash deny and ask rules no longer miss commands written with quoted words. An exact ask rule is now refused, not asked about, when a broader deny rule covers the command. And which with flags outside a lookup set now asks first.

Two trust changes matter for shared repos. Directories added with --add-dir only register plugin marketplaces after their own trust dialog is accepted. With the Bash sandbox on, skills in nested .claude/skills folders only load if you start Claude Code in that folder or /cd there.

Long MCP calls now run in the background

MCP has a Tasks extension for slow work. When a client opts in, the server can answer tools/call with a task ID instead of a result. The client then polls tasks/get until the task is completed, failed, or cancelled, or answers it when it reaches input_required.

In 2.1.319, when an MCP server runs a tool call as a task, Claude Code “moves it to the background right away and tells Claude the result when it finishes.” Claude keeps working in the meantime, the same way it does with a background Bash command. That suits servers that kick off builds, data exports, or test runs that take minutes.

• To wait inline instead, set CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND. Claude Code then waits for the task inside its tool call.
• To turn tasks off, set CLAUDE_CODE_DISABLE_MCP_TASKS=1. The notes say tasks now work without feature-flag fetching, so this applies on Bedrock, Vertex, Foundry, LLM gateways, and with DISABLE_TELEMETRY.

If you maintain an MCP server, this changes what your users see. A tool that returns a task no longer blocks the turn, so its result arrives later in the conversation. Make sure the final result reads well on its own, without the call right above it.

Deny instead of prompting

The new permissions.denyInsteadOfPrompting setting covers the case where nobody is watching. Per the notes, “a tool call that would wait on a permission prompt is denied and the turn continues, in terminal sessions, subagents and teammates.”

That's the behavior you want for an overnight run or a teammate working through a queue. A stuck prompt used to stall the agent until someone came back. Now the call fails, Claude sees the denial, and it can try another route or report what it couldn't do. In settings it would look like this:

{
  "permissions": {
    "denyInsteadOfPrompting": true,
    "allow": ["Bash(npm test)", "Bash(npm run build)"]
  }
}

The settings reference didn't list the key yet when we checked, so we've assumed it takes a boolean. Pair it with an explicit allow list. Otherwise every command you forgot to allow becomes a silent denial, and the run finishes having done less than you expected.

Auto mode behind an LLM gateway changed

This is the change most likely to break something. Auto mode uses a server-side check to decide which actions are safe. Before 2.1.319, when that check couldn't be reached, Claude Code fell back to a built-in classifier.

Now, with telemetry or feature flags off, including behind LLM gateways, “calls the server can't check are asked about or denied, with no fallback to the built-in classifier.” Bedrock, Vertex, and Foundry are unchanged.

A related fix changes exit codes. claude -p in auto mode used to exit 0 when its actions were refused because no safety check was available. Text and JSON output now exit 1. A CI job that silently did nothing will now fail, which is what you want, but expect red builds the first time.

/status also stops showing “Auto mode server: Enabled” when the check isn't reaching the session, so check it there after you upgrade.

Other changes worth knowing

• Self-paced /loop ends sooner. It now stops when a turn finishes without rescheduling, instead of setting a fallback wakeup. CLAUDE_CODE_LOOP_KEEPALIVE=1 restores the old behavior.
• Billing surprises are flagged. When your claude.ai login ends and Claude Code continues on the sign-in from ant auth login, it now warns you and names the Console organization being billed.
• Feature flags without telemetry. CLAUDE_CODE_DISABLE_FEATURE_FLAGS stops flag fetching without turning off telemetry, and every flag uses its built-in default.
• Finished subagents stay reachable. /tasks gains an “Earlier in this session” row, so you can reopen and message a subagent after a restart.
• Hooks on interrupted calls. PostToolUse hooks now run, with up to 10 seconds, on tool calls that finish after a new message interrupts the turn. If a hook logs or formats files, it now also fires in that case.
• A git oddity fixed. /diff showed “Diff unavailable” when a repo had a file or folder named HEAD at the top level.

What to do this week

1. Update with claude update and confirm with claude --version that you're on 2.1.319 or later.
2. If you run auto mode behind an LLM gateway, decide between CLAUDE_CODE_AUTO_MODE_SERVER=0 and =1, then check /status.
3. Search CI for claude -p calls that assumed exit 0 meant success.
4. For unattended runs, try permissions.denyInsteadOfPrompting with a tight allow list.
5. If you own an MCP server with slow tools, test how its task results read when they arrive in the background.

Sources

• Claude Code v2.1.319 release notes (November 6, 2026): every change quoted on this page.
• MCP Tasks extension specification (2026-07-28): how task-returning tool calls, states, and polling work.
• Claude Code docs: All settings: the permission settings reference.