GuidesClaude Code

Claude Code auto mode: check, switch and block

By Stephen Thorn · 5 minute read ·

Claude Code auto mode: check your mode, switch it, and block what you never want run

New Claude Code sessions now start in auto mode, where a second model checks Claude's actions and Claude runs them without asking you. This guide shows how to see which mode you're in, how to make Manual your default, and the deny rules worth adding whichever mode you keep.

What you need

  • Claude Code in the terminal or VS Code. Check your version with claude --version.

  • A text editor, to change one settings file.

  • About 10 minutes.

What changed, and what auto mode is

Anthropic's week 32 notes: "Starting August 14, auto mode is the default permission mode for new sessions on Pro, Max, and Team plans. If you set a default mode yourself, it stays in place unless you accept the one-time switch prompt." The permission modes page goes further: "With Claude Code v2.1.283 or later, auto mode is the built-in starting permission mode for interactive terminal and VS Code sessions on every plan and provider."

How it works, from the same page: "A separate classifier model reviews actions before they run, blocking anything that escalates beyond your request, targets unrecognized infrastructure, or appears driven by hostile content Claude read. Explicit ask rules still force a prompt."

3 things worth knowing:

  • Reads and file edits inside your working folder are approved without going to the classifier. It reviews the rest, such as shell commands and network requests.

  • When it blocks something, you get a notification. And "if the classifier blocks an action 3 times in a row or 20 times total, auto mode pauses and Claude Code resumes prompting."

  • Anthropic's own warning: "Auto mode reduces permission prompts but does not guarantee safety."

Step 1: see which mode you're in

Look at the status bar under the prompt. It shows one of these:

  • ⏵⏵ auto mode on

  • ⏸ manual mode on

  • ⏵⏵ accept edits on

  • ⏸ plan mode on

The first time the built-in default starts you in auto mode, the terminal shows a notice at the top of the session, once. In VS Code, the mode indicator sits at the bottom of the prompt box.

Step 2: switch with Shift+Tab

Press Shift+Tab to cycle modes. From auto, the first press takes you to Manual, then accept edits, then plan, then back to auto. Manual mode asks before anything that isn't a read.

  • Manual (default): Reads only

  • acceptEdits: Reads, file edits, and common file commands such as mkdir, touch, mv and cp, inside your working folder

  • plan: Reads, plus commands the classifier approves when auto mode is available. Edits wait until you approve a plan

  • auto: Everything, with background safety checks

  • dontAsk: File reads in your working folders and tools you've pre-approved. Anything that would prompt is denied

  • bypassPermissions: Everything

2 notes on that table:

  • The docs add that acceptEdits also runs rm, rmdir and sed without asking, inside your working folder.

  • dontAsk and bypassPermissions aren't in the Shift+Tab cycle. dontAsk is for locked-down scripts. bypassPermissions only appears if you start a session with it switched on, and Anthropic says to use it "in isolated environments like containers, VMs, or dev containers without internet access, where Claude Code cannot damage your host system."

Step 3: make Manual your default

Open ~/.claude/settings.json (create it if it doesn't exist) and add this:

{  "permissions": {    "defaultMode": "default"  }}

If the file already has a "permissions" block, add the "defaultMode" line inside it. Don't paste a second block. The next session you start shows ⏸ manual mode on. If Claude Code later asks whether to switch your setting to auto mode, say no and your setting stays.

3 things can still start a session in a different mode:

  • A project's own .claude/settings.json. Project settings outrank yours, so a project that sets acceptEdits or plan starts in that mode.

  • A project that sets "auto" there. The docs say that value doesn't take effect, and Claude Code then skips your own setting and uses the built-in default. On v2.1.283 or later, that built-in default is auto mode.

  • The VS Code extension, which checks its own setting and the last mode you picked from its indicator before it reads yours. To pin Manual there, set claudeCode.initialPermissionMode to default in your VS Code user settings.

So check the status bar each time you open a new project. For one session, you can also start with claude --permission-mode default.

Step 4: block the commands you never want run

Type /permissions. The dialog lists every rule and the settings file it comes from, and you can add a rule there, even while Claude is working. There are 3 kinds:

  • Allow: runs without asking.

  • Ask: always prompts you, in auto mode too.

  • Deny: blocked.

"Rules are evaluated in order: deny, then ask, then allow." The first match wins, so an allow rule can't make an exception to a deny rule. Deny rules block in every mode, including bypassPermissions.

These 5 deny rules use the syntax from Anthropic's own examples. Add them in /permissions, or put them in ~/.claude/settings.json next to your default mode:

{  "permissions": {    "defaultMode": "default",    "deny": [      "Bash(git push *)",      "Bash(curl *)",      "Read(./.env)",      "Read(./.env.*)",      "Read(./secrets/**)"    ]  }}

  1. Bash(git push *): Claude can't push code to GitHub or any other remote. You push. If you'd rather approve each push, put the same rule under "ask".

  2. Bash(curl *): blocks curl, the command that downloads from and sends to any URL.

  3. Read(./.env): keeps Claude out of the .env file, where a project keeps its keys.

  4. Read(./.env.*): the same for files like .env.local.

  5. Read(./secrets/**): a secrets folder and everything in it.

A path that starts with ./ counts from the folder you start Claude Code in. A Read deny rule also stops Claude's tools from editing or writing that path.

Know the limits. A Bash rule matches the command as Claude writes it, so Bash(git push *) stops git push origin main but not git -C . push origin main. Read rules don't cover a script that opens files itself. For a fence that doesn't depend on the command text, the docs point to the built-in sandbox, which you turn on with /sandbox.

When auto mode blocks something, it shows in /permissions under Recently denied, where you can press r to retry it with your approval.

The mistake to avoid

Treating auto mode as a safety guarantee. Anthropic's page says it "does not guarantee safety". Telling Claude "don't push" in the chat helps, because the classifier reads it as a block, but the docs say that line can be lost when a long conversation gets compacted: "For a hard guarantee, add a deny rule instead." Use Manual for sensitive work, and keep deny rules for anything that must never happen. For a second check on risky shell commands, the MODS guide covers Blast Radius, a mod that holds commands like rm -rf and git push --force and shows what they'd change before they run.