---
type: "post"
id: "claude-code-v2-1-319-background-mcp-tasks-b2ef14"
slug: "claude-code-v2-1-319-background-mcp-tasks-b2ef14"
title: "Claude Code v2.1.319: background MCP tasks, denyInsteadOfPrompting, security fixes"
description: "Anthropic’s Claude Code v2.1.319 release adds terminal support for MCP tasks that continue in the background, plus a permission setting that denies calls that would otherwise wait for a prompt."
retrieval_nugget: "Anthropic’s Claude Code v2.1.319 release adds terminal support for MCP tasks that continue in the background, plus a permission setting that denies calls that would otherwise wait for a prompt."
published_at: "2026-11-06"
updated_at: "2026-11-06"
record_date: "2026-11-06"
date_kind: "published_at"
topics: ["claude","mcp","claude-code"]
entities: ["Anthropic","Claude Code","Model Context Protocol","Claude apps gateway"]
related_patterns: ["agent-protocols-become-interoperability-layer"]
novelty_label: "new_fact"
what_changed: "Claude Code v2.1.319 adds background MCP tasks, denyInsteadOfPrompting, and security fixes."
prior_refs: ["https://newruntime.com/posts/claude-code-cli-gains-mcp-tasks-for-durable-1711e7/"]
source_url: "https://github.com/anthropics/claude-code/releases/tag/v2.1.319"
source_urls: ["https://github.com/anthropics/claude-code/releases/tag/v2.1.319"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:claude-code-v2-1-319-background-mcp-tasks-b2ef14"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/claude-code-v2-1-319-background-mcp-tasks-b2ef14/","markdown":"https://newruntime.com/posts/claude-code-v2-1-319-background-mcp-tasks-b2ef14.md","json":"https://newruntime.com/posts/claude-code-v2-1-319-background-mcp-tasks-b2ef14.json"}
markdown_url: "https://newruntime.com/posts/claude-code-v2-1-319-background-mcp-tasks-b2ef14.md"
---

# Claude Code v2.1.319: background MCP tasks, denyInsteadOfPrompting, security fixes

## Retrieval answer

Anthropic’s Claude Code v2.1.319 release adds terminal support for MCP tasks that continue in the background, plus a permission setting that denies calls that would otherwise wait for a prompt.

## Summary

Anthropic’s Claude Code v2.1.319 release adds terminal support for MCP tasks that continue in the background, plus a permission setting that denies calls that would otherwise wait for a prompt. The update also includes security fixes, including a Bash permission bypass fix and a sandbox escape fix. For builders, the practical change is more predictable handling of long-running tools and unattended runs.

## What happened

Anthropic published Claude Code v2.1.319 on GitHub on November 6. The release adds support for MCP tasks in the terminal: when an MCP server runs a tool call as a task, Claude Code moves it to the background right away and tells Claude the result when it finishes. A developer can set `CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND` to make Claude Code wait for an MCP task inside its tool call rather than backgrounding it. The release notes separately say MCP tasks now work in the terminal without feature-flag fetching, including with Bedrock, Vertex, Foundry, LLM gateways, and `DISABLE_TELEMETRY`; `CLAUDE_CODE_DISABLE_MCP_TASKS=1` turns the feature off.

The release also adds `permissions.denyInsteadOfPrompting`. When a tool call would wait on a permission prompt, this setting denies the call and lets the turn continue. Anthropic says it applies in terminal sessions, subagents, and teammates. That changes the behavior of a run that cannot receive an interactive approval: rather than waiting for a person at a prompt, the tool call is refused and the agent can proceed. The notes do not describe a new approval mechanism; the setting is specifically about denying calls that would otherwise wait.

For API developers, `/claude-api latency-optimize` is a new command to find where Claude API code makes people wait and try faster settings against an eval. The release also adds `CLAUDE_CODE_DISABLE_FEATURE_FLAGS`, which stops feature-flag fetching without turning off telemetry; flags then use their built-in defaults. Other additions include usage-period spending figures for developers behind a Claude apps gateway who have no spend limit, and gateway settings for pooled budget priority and operator login notices.

The release contains a broad set of fixes and behavior changes. Security-related fixes include a Bash permission bypass in which a crafted environment prefix could hide part of a command from permission checks, and a sandbox escape when creating a worktree. It also fixes a case where a `sed` command could skip a permission check in accept-edits and auto mode. MCP fixes address older-handshake servers that failed to connect or returned empty results, and long-running calls on a claude.ai connector that could fail to report results after resuming. The notes list many additional fixes across sessions, permissions, cloud, gateway, VS Code, and other parts of Claude Code.

## What the archive adds

New Runtime’s earlier coverage described MCP Tasks in Claude Code as a way to support durable long-running jobs and request user input during a task ([October 24 note](https://newruntime.com/posts/claude-code-cli-gains-mcp-tasks-for-durable-1711e7/)). This release is a new implementation detail on that known story: terminal MCP calls can now move into the background, with an explicit opt-out. An earlier [Claude Code v2.1.310 note](https://newruntime.com/posts/claude-code-v2-1-310-brings-the-monitor-24f7bd/) covered gateway retry and enterprise role controls, but this release’s main change is different.

## Trend signal

This update supports [agent protocols becoming the interoperability layer](https://newruntime.com/patterns/agent-protocols-become-interoperability-layer/): MCP task handling is a concrete way for a tool server and a client runtime to coordinate work that lasts beyond one immediate call. The release shows a specific integration behavior, not proof that MCP or any protocol family has won broader adoption. It also makes the runtime’s handling of asynchronous work visible to builders.

## Why now

The release does not give a reason for the timing. It does, however, combine the terminal MCP task behavior with permission and security changes in one version, so teams adopting this build should test both the new asynchronous flow and existing guardrails rather than treating the update as only a feature addition.

## Why it matters

Background execution can make an agent workflow less brittle when an MCP tool takes longer than a normal interactive call. Instead of holding the tool call open, Claude Code can continue and receive the result on completion. That is useful only if the surrounding workflow handles task state and completion correctly; teams should verify what the agent does while the task runs and how it reacts to a failed or delayed result.

`denyInsteadOfPrompting` addresses a different operational problem: unattended jobs cannot answer an interactive permission request. Denying the call and continuing may prevent a run from hanging, but it is not equivalent to granting access. Teams should identify which actions may be refused and ensure later steps do not treat refusal as successful execution. The security fixes reinforce the need to upgrade and test permission boundaries when agents operate on repositories or execute shell commands.

## Limits and uncertainty

The release notes describe behavior and fixes, but do not provide latency measurements, reliability figures for background MCP tasks, or comparative results for `/claude-api latency-optimize`. They do not quantify how often the listed permission bypasses or sandbox escape occurred, or identify affected deployments. The notes also do not establish how every MCP server reports task errors or cancellation to Claude Code. The release is published by Anthropic on GitHub; these notes are not an independent security audit or verification of the fixes across environments.

## Skill to build now

This week, test one slow MCP tool in a disposable Claude Code project. Record whether the call returns control immediately, how the completion result reaches Claude, and what happens when the task errors or is interrupted. Then repeat with `CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND` set to confirm your workflow can still use the waiting behavior if it depends on it. Test `permissions.denyInsteadOfPrompting` separately with a tool that would require approval; verify that downstream steps detect the denial rather than assuming the action succeeded.

## Reader takeaway

Claude Code v2.1.319 makes terminal MCP tasks asynchronous by default and gives teams a way to keep permission-gated runs from waiting indefinitely by denying the call. Treat those as workflow changes, not just release-note details: test task completion and refusal handling, and update if you run agents against code or shell commands. The release also fixes specific permission and sandbox issues.

## Open question

How reliably do different MCP servers communicate task failure and cancellation through Claude Code’s new background flow?

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Claude](https://newruntime.com/topics/claude.md): Explore the claude topic hub.
- topic hub: [Mcp](https://newruntime.com/topics/mcp.md): Explore the mcp topic hub.
- topic hub: [Claude Code](https://newruntime.com/topics/claude-code.md): Explore the claude-code topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)