Auto mode, explained by monkey

Auto mode is why Claude Code stopped asking you about every little thing. Instead of you approving each command, a second AI model, called the classifier, looks at what Claude is about to do before it runs. Safe things go ahead. Risky things, like a force push or a production deploy, get blocked, and Claude is told why and tries another way.

Which mode am I in?

The status bar under the prompt tells you. There are six modes. The word in brackets is what you type in settings or after --permission-mode:

• ⏸ manual mode on (default, or manual): asks before most things. Only reads run without asking.
• ⏵⏵ accept edits on (acceptEdits): file edits run without asking, plus mkdir, touch, rm, rmdir, mv, cp and sed inside your project folder.
• ⏸ plan mode on (plan): Claude looks around and writes a plan, and doesn't edit your code until you approve it.
• ⏵⏵ auto mode on (auto): everything runs, with the classifier checking in the background.
• ⏵⏵ don't ask on (dontAsk): only tools you've already approved run. Anything that would ask is refused.
• ⏵⏵ bypass permissions on (bypassPermissions): everything runs with no checks. Only for containers and VMs.

Switching with Shift+Tab

Shift+Tab steps through the modes. From a new session, which starts in auto:

auto mode on      (where a new session starts)
manual mode on    1 press
accept edits on   2 presses
plan mode on      3 presses
auto mode on      4 presses, back where you started

• From Manual, one press gets you to accept edits.
• Don't ask is never in the cycle. Start with claude --permission-mode dontAsk to use it. Bypass only shows up if you launched with it.
• On Windows, if Shift+Tab doesn't work, use Alt+M.
• In Manual or accept edits, the permission prompt for a shell command offers Yes, and switch to auto mode (v2.1.247 or later).

Pick the mode you start in

For one session, start Claude Code in the mode you want:

$claude --permission-mode manual    # or acceptEdits, plan, auto, dontAsk, bypassPermissions

To change it for every session, set defaultMode in ~/.claude/settings.json. This brings back the old way, starting in Manual:

{ "permissions": { "defaultMode": "manual" } }

How the classifier decides

Every action goes through the same checks, in order, and the first one that matches wins:

• 1. Your own allow, ask and deny rules. An ask rule still makes Claude ask you, even in auto mode.
• 2. Reading files, and editing files inside your project folder, go straight through. Writing to protected files like .git, .claude, .zshrc, .npmrc or .mcp.json is the exception.
• 3. Everything else goes to the classifier: shell commands, web requests, starting subagents and messages to other sessions.
• 4. If the classifier blocks something, Claude gets the reason and tries another way.

Blocked by default, for example:

• curl | bash, which runs a script straight off the internet
• Force push
• Production deploys
• git reset --hard or git clean -fd on work you didn't ask to throw away
• terraform destroy
• Sending secrets out
• Merging a pull request no human approved

Allowed by default: local file work, installing what's in your lock file, read-only web requests, and pushing to any branch of the repo you're in.

It trusts your project folder and the git remotes the repo already had when the session started. Everything else counts as outside. It reads your messages, Claude's actions and your CLAUDE.md, but not what the tools send back, so a booby-trapped web page can't talk it round. It runs on Claude Sonnet 5, whatever model you picked in /model.

Steer it from the chat

• Set a boundary. Say "don't push" or "wait until I review before deploying", and the classifier blocks matching actions, even ones the default rules would allow, until you lift it in a later message.
• Unblock one thing properly. "You can force-push" clears nothing. Name the action and the risky detail, like "you can force-push to my-feature-branch". That approval covers that one action only.
• Approve a block yourself. Open /permissions, go to the Recently denied tab, and press r on the action to retry it with your own approval.

The safe auto setup

Keep auto mode for speed, and add a deny rule for anything you never want, whatever the classifier thinks. A deny rule lives in a file, so compaction can't lose it, and your own rules are checked before the classifier. Put this in ~/.claude/settings.json for all your projects, or .claude/settings.json for one:

{
  "permissions": {
    "deny": [
      "Bash(git push *)"
    ]
  }
}

• Bash(git push *) refuses every command that starts with git push. Add any other command you want off-limits in the same shape.
• Deny wins. Rules are checked deny, then ask, then allow, so an allow rule can't make an exception to a deny rule.
• Already have a "permissions" block, for example with defaultMode in it? Put "deny" inside that one. Don't add a second "permissions" block.

When auto mode gives up

If the classifier blocks 3 times in a row, or 20 times in total, auto mode pauses and Claude goes back to asking you. You can't change those numbers. To see what got blocked, open /permissions and look under Recently denied.

Who has it

• Every plan, on a supported model. On the Anthropic API: Opus 4.6 or later, Sonnet 4.6 or later, Haiku 5.5 or a Fable model. Through Bedrock, Google Cloud's Agent Platform or Foundry: only Sonnet 5 or later, Opus 4.7 or later, Haiku 5.5 and the Fable models.
• On Team and Enterprise it's on by default, and an admin can turn it off for everyone.
• Organizations with the HIPAA configuration start in Manual, but can still switch to auto.
• On Enterprise, and on accounts that use an API key or a cloud provider, the classifier's checks count toward your token usage. Pro, Max and Team never show that billing notice.

Gotchas

• The docs say it plainly: auto mode "does not guarantee safety". Use it for work where you trust the general direction, and still review anything sensitive yourself.
• rm aimed at a critical path like / or ~ is never approved automatically, in any mode.
• While auto mode is on, it sets aside broad allow rules like Bash(*) or Bash(python*), and puts them back when you leave.
• Auto mode nudges Claude to keep working instead of stopping to ask you questions, so put what it needs to know in your first message.
• Accept edits still asks before writing files that can run code, like .npmrc, .zshrc and anything in .git.
• Cloud sessions only offer accept edits, plan and auto. Remote Control from your phone offers manual, accept edits, plan and auto. Neither lets you pick bypass permissions.

Monkey believe in you. Now go build.

follow @nocodemonkey