When Claude Code Auto Mode Breaks Behind a Custom Proxy

A custom API endpoint can work perfectly for chat and still cause problems with Claude Code’s Auto Mode. The missing piece may not be the model response—it may be the safety-classifier results that travel alongside it.

If a proxy drops or rewrites those results, Claude Code can deny commands rather than execute them without a safety verdict. Depending on the failure, it may instead fall back to making its own classifier requests. Source

Here’s a practical troubleshooting path.

1. Try disabling server-side classifier checks

If your gateway cannot support server-side checks, set this before starting a new session:

export CLAUDE_CODE_AUTO_MODE_SERVER=0
claude

This changes where classifier checks are requested; it does not remove the classifier or make Auto Mode fully offline. Claude Code makes its own classifier requests instead, which may count toward token usage. The setting is temporary and could be removed in a future release. Source

That distinction matters: “client-managed checks” is not the same as “local pattern matching.”

2. Pre-approve a small set of trusted commands

For predictable workflows, explicit permission rules can reduce approval friction. For example:

{
  "permissions": {
    "allow": [
      "Bash(git status)",
      "Bash(npm test)"
    ]
  }
}

These rules allow the specified commands without manual approval. Rules without wildcards match exact commands; matching deny or ask rules still take precedence. You can inspect and manage the rules with /permissions. Source

Keep the list narrow. In particular, only pre-approve npm test when you trust the repository’s test scripts—“test” is a label, not a guarantee that the command has no side effects.

3. Fix the gateway, not just the response headers

If you operate the proxy, check both directions of the request:

• Requests: preserve the anthropic-beta header and the safeguards body field.
• Responses: preserve safeguard_results, streaming events, and tool-use IDs.

These are protocol fields, not merely optional metadata. A gateway that strips unfamiliar fields or rewrites tool-use IDs can break the connection between an action and its safety verdict. Source

The broader lesson: chat compatibility does not automatically mean agent compatibility.

4. Use Manual mode when you need to keep moving

For an immediate fallback, start a session with manual approvals:

claude --permission-mode default

In a running CLI session, press Shift+Tab to cycle modes and check the status bar for Manual mode. This lets you review actions yourself rather than depend on Auto Mode’s classifier. Source

The takeaway

When Auto Mode stops approving commands behind a custom endpoint, inspect the safety-check path—not just whether the model returns text.

Use client-managed classifier requests as a workaround, keep explicit approvals narrow, and preserve the full gateway protocol for a durable fix.