{"version":"2.1.321","anchor":"auto-mode-classifier-turned-offredirected-for-user-delegate","canonical_anchor":"auto-mode-classifier-turned-offredirected-for-user-delegate","heading":"Auto mode's safety checker behaves differently for user-delegated direct API sessions","tier":"notice","area":"Auto Mode","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.321\/e\/auto-mode-classifier-turned-offredirected-for-user-delegate","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.321","markdown":"### Auto mode's safety checker behaves differently for user-delegated direct API sessions\n\nWhen `CLAUDE_CODE_USER_DELEGATED_SESSION_DIRECT_API` is set, auto mode switches off a third-party checker role and always checks allowed MCP write tools\n\n**Unclear.** What sets this variable, and what the fallback does when the classifier refuses, is not shown.\n\n**What**\n\nIn auto mode, a classifier (an automatic checker) decides whether an action is safe instead of asking you. Claude Code now reads the environment variable `CLAUDE_CODE_USER_DELEGATED_SESSION_DIRECT_API`, meant for sessions using a user-delegated credential on a direct API. An environment variable is a named value set outside Claude Code before it starts. When this one is set:\n\n- The classifier uses its default model rather than choosing one.\n\n- The classifier's third-party role is switched off for the session.\n\n- The classifier uses its default severity thresholds, the levels at which it treats an action as risky.\n\n- A fallback runs when the classifier is unavailable or refuses to answer.\n\n- Allowed MCP tools that change things are always included in what the classifier checks. MCP tools come from separate servers that add abilities to Claude Code.\n\nWithout the variable, whether those MCP write tools are included is still decided by a server-side setting that is off by default in the code. In readings taken before this release, that setting came back on for this site's account and for an anonymous check.\n\n**Why**\n\nSessions run with a user-delegated direct API credential get their own auto mode behaviour, including a set fallback when the classifier cannot give an answer.\n\n- Flag `tengu_cowork_auto_mode_include_allowed_write_mcp`: Off by default, switched on for this account (read for one account on one subscription tier against v2.1.321; this account: on, anonymous baseline: on, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.\n- Area: Auto Mode\n- Names: `CLAUDE_CODE_USER_DELEGATED_SESSION_DIRECT_API`\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 4\/5\n- Scope: individual\n- Heads-up: no"}