{"version":"2.1.261","anchor":"server-side-auto-mode-dangerous-tool-use-classifier","canonical_anchor":"server-side-auto-mode-dangerous-tool-use-classifier","heading":"Server-side auto-mode dangerous-tool-use classifier","tier":"notice","area":"Auto Mode Safety","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.261\/e\/server-side-auto-mode-dangerous-tool-use-classifier","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.261","markdown":"### Server-side auto-mode dangerous-tool-use classifier\n\nAuto mode's dangerous-action classifier now runs server-side and blocks actions it flags or can't reach.\n\nAuto mode's server-side dangerous-tool-use classifier is expanded: API requests now carry a `safeguards: [{ type: \"dangerous_tool_use\", context }]` field, riding on a new `anthropic-beta` header entry, and the response's streaming deltas are parsed for matching `safeguard_results` against a schema of per-tool-call outcomes (flagged, not_flagged, skipped, unavailable). When flagged, the action is blocked with reason 'The server-side auto mode classifier judged this action dangerous'; if the server call is unavailable or times out, it blocks for safety with 'Classifier unavailable - blocking for safety'. The auto-mode fast-path check can now await a server classifier result and fall back to asking the user if the classification changed while queued (`mode_changed_while_queued`), recording telemetry fields `classifierSource: server` and `serverClassifierNoVerdict`, and a `tengu_auto_mode_fallback_to_ask` event.\n\n- Area: Auto Mode Safety\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5"}