AI library

Source · release

Claude Code release 2.1.319

Author
Anthropic
Published
6 November 2026
Added
9 November 2026
Original
https://github.com/anthropics/claude-code/releases/tag/v2.1.319

Summary

Claude Code 2.1.319 was released on 2026-11-06. It is a large release. Claude Code can now run MCP tool calls that a server handles as tasks in the background. A new setting denies tool calls instead of waiting at a permission prompt. A new /claude-api command looks for slow spots in Claude API code. Auto mode behind LLM gateways changes, and several permission and sandbox bypasses are fixed.

Key points

  • MCP tasks in the terminal: when an MCP server runs a tool call as a task, Claude Code moves it to the background at once and tells Claude the result when it finishes. Nothing to install; it also works without feature-flag fetching (Bedrock, Vertex, Foundry, gateways). CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND=1 makes it wait inside the call, and CLAUDE_CODE_DISABLE_MCP_TASKS=1 turns tasks off.
  • permissions.denyInsteadOfPrompting: set it in settings and any tool call that would wait on a permission prompt is denied, and the turn carries on. It applies to terminal sessions, subagents, and teammates. Useful for unattended runs that should never hang on a prompt.
  • /claude-api latency-optimize: finds where your Claude API code makes users wait and tries faster settings against your own eval.
  • /tasks "Earlier in this session": finished subagents stay listed, so you can reopen one and message it, even after a restart.
  • Auto mode behind gateways: with telemetry or feature flags off, calls the server cannot check are asked about or denied, with no fallback to the local classifier. CLAUDE_CODE_AUTO_MODE_SERVER=0 keeps the old classifier; =1 forces the server check. claude -p now exits 1 when auto mode refused actions for lack of a safety check. CLAUDE_CODE_DISABLE_FEATURE_FLAGS stops flag fetching without turning off telemetry.
  • Self-paced /loop changed: it ends when a turn finishes without rescheduling, instead of setting a fallback wakeup. CLAUDE_CODE_LOOP_KEEPALIVE=1 keeps the old behaviour.
  • Hooks: PostToolUse hooks now run (up to 10 s) on tool calls that finish after a new message interrupts the turn. ${CLAUDE_PLUGIN_ROOT} now works in a plugin's subagentStatusLine.
  • Security fixes: a Bash permission bypass through a crafted environment prefix, a sed command skipping checks in accept-edits and auto mode, deny rules missing commands with quoted words, a sandbox escape when creating a worktree, and /rewind writing through a directory symlink. Self-hosted runners with --trust-workspace false now also block repository hooks and skills. Nested .claude/skills folders load only when you start or /cd there if the Bash sandbox is on.
  • MCP fixes: servers on the older handshake failed to connect or returned empty results because Claude Code declared an extension it only uses with newer servers.
  • Billing warning: Claude Code now warns at startup when it falls back to the ant auth login sign-in, which bills the Claude Console organization.
  • Released with TypeScript Agent SDK 0.3.319 (see that note). Python SDK 0.2.179 came out the same day; its notes list no changes.

Why it matters

Long MCP jobs no longer block the conversation, and denyInsteadOfPrompting gives headless and scheduled runs a clean way to fail fast. The permission-bypass fixes make upgrading worthwhile for anyone using auto or accept-edits mode.