Claude Code 2.1.319: background MCP tasks, deny-instead-of-prompting, and tighter gateway controls

Claude Code 2.1.319 is a substantial release, running to around 145 changelog lines. The thread connecting most of it is a single practical problem: unattended agent runs that freeze, fail silently, or behave inconsistently when nobody is watching the terminal. This release addresses that from several angles at once.

Background MCP task execution

The most significant new behaviour is how Claude Code handles MCP tool calls that run as tasks. Previously, an agent would wait for a slow MCP tool call to finish before continuing. If you had a long-running database query, a build check, or any other task-type MCP operation, the agent sat idle until it returned.

From 2.1.319, those calls are moved to the background immediately. The agent carries on with the rest of its plan, and the result is reported once the task completes. For teams running Claude Code in CI pipelines or multi-step autonomous sessions, this removes a meaningful source of unnecessary blocking.

If you need the old behaviour, CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND makes Claude Code wait for the task before continuing. If you want to disable task-based execution entirely, CLAUDE_CODE_DISABLE_MCP_TASKS=1 does that. The feature also works in environments without feature-flag fetching, including Bedrock, Vertex, Foundry, and LLM gateways.

The new denyInsteadOfPrompting setting

The other headline addition is permissions.denyInsteadOfPrompting. Set "denyInsteadOfPrompting": true under permissions in ~/.claude/settings.json (or pass it via --settings), and any tool call that would have paused to wait for your approval is instead denied. Claude is told it was denied, and the turn continues.

This is specifically designed for unattended runs. Without it, an agent can hit a permission prompt at 2am and sit there indefinitely. With it, that call fails fast, Claude knows why, and the session keeps moving.

It is worth understanding where this setting sits in the decision chain. Allow rules, the active permission mode, the auto-mode classifier, and PermissionRequest hooks all evaluate first. denyInsteadOfPrompting only affects calls that reach the prompt stage after all of that. It applies in terminal sessions, subagents, and teammates, so multi-agent workflows get consistent behaviour throughout.

Auto mode now fails closed behind gateways

Auto mode has had a quiet but important behaviour change. Previously, if telemetry or feature flags were off, or you were routing Claude Code through an LLM gateway, auto mode would silently fall back to the built-in classifier. That fallback is gone. Auto mode now fails closed in those situations, which means it asks or denies rather than quietly making its own call.

For gateway operators, there is a related addition: CLAUDE_CODE_AUTO_MODE_SERVER now enables server-side checking even when CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS is set. Teams that deliberately keep experimental betas off no longer face a configuration conflict to get a working auto mode path. A new CLAUDE_CODE_DISABLE_FEATURE_FLAGS variable also separates feature-flag fetching from telemetry, so you can turn one off without affecting the other.

One other change here worth flagging: claude -p now exits with code 1 when auto mode refused actions, where it previously returned 0. If you have scripts that check exit codes, review them.

Agent workflow fixes

Several fixes target the reliability of multi-agent and background workflows:

The /clear command was previously killing running commands belonging to background agents, teammates, and foreground subagents of background agents. That is fixed. Background subagents now also move shell commands to the background after three minutes on all providers, preventing prompt cache expiry during long-running operations.

The /claude-api managed-agents-onboard command now gives a new agent’s built-in tools and any quickstart template’s MCP tools the auto permission policy (“Judge risky actions”) by default, matching the behaviour of the Claude Console.

Usage reporting improvements

Developers behind a Claude apps gateway with no spend limit can now see spend broken down across three time periods in /usage. The improvement applies when the gateway runs version 2.1.319 or later. It is a small change but a useful one for teams tracking API costs across active sessions.

Security fixes

Five security issues are addressed in this release. The list includes a sandbox escape when creating a worktree, a Bash permission bypass using an environment prefix, a sed command that could skip the permission check in accept-edits and auto mode, Bash deny/ask rules missing commands with quoted words, and /rewind following directory symlinks. If you run Claude Code in environments where these edge cases are reachable, updating promptly makes sense.

A few other things worth knowing

For Windows users, Claude Code now waits longer for files locked by another process before saving, which makes corrupted ~/.claude.json files from interrupted saves much less likely.

Cloud session users will find that clicking “Send now” on a waiting message no longer terminates running background agents. They now keep running as expected.

The release also restores the optional _meta field on several MCP request and result types to conform to the MCP spec draft, and fixes a session diff failing to load on claude.ai and mobile apps when the working directory contains a file or folder named HEAD.

What this means for you

If you run Claude Code in any kind of unattended or automated context, 2.1.319 is a meaningful upgrade. The combination of background MCP tasks, denyInsteadOfPrompting, and the auto mode fail-closed change together address the most common ways a long agent session can silently grind to a halt. The security fixes are also substantial enough to warrant updating regardless of which features you use.

The exit code change for claude -p is the most likely thing to break existing scripts. Check that before updating in production pipelines.

Full release notes are on GitHub.