[BUG] Remote routine fails with "MCP tool call requires approval" despite remote routine settings and MCP tools marked always allow

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Surface: Claude Code remote routines (scheduled task)

Every run fails on the first MCP tool call with the error:
Streamable HTTP error: Error POSTing to endpoint: MCP tool call requires approval
The MCP tool requires user approval before it can execute. Please approve the
mcp__Cipher-NYC__get_authoring_queue tool call in the permission prompt...

(a) This shouldn't be necessary because all MCP tools in question are set to always allow and remote routines should by default be able to read/write as needed.
(b) No permission prompt is rendered anywhere in the routine UI
(c) Claude in the routine repeatedly tried to create or update .claude/settings.json, which doesn't make sense. I allowed it and it did not make a difference.

What I tried:

Disconnected and reconnected the connector.
Verified the same connector calls succeed without approval in interactive Cowork and Claude Code sessions.
Committed .claude/settings.json with an explicit permissions.allow list of fully-qualified tool names (mcp__Cipher-NYC__*) to the repo. No effect — suggests remote routines don't read this file.
Confirmed via Cowork that the MCP server itself responds normally and the connector is healthy.
Confirmed the routine has the connector selected in its Connectors tab (badge shows "1").

What Should Happen?

Routine executes MCP tool calls (get_authoring_queue, set_narrative, fetch_zap_attachment) without prompting, because the connector ("Cipher-NYC") is configured with "Claude can use all tools from these connectors — including writes — without asking for permission during runs."

Error Messages/Logs

Streamable HTTP error: Error POSTing to endpoint: MCP tool call requires approval
The MCP tool requires user approval before it can execute. Please approve the
`mcp__Cipher-NYC__get_authoring_queue` tool call in the permission prompt...

Steps to Reproduce

Repro:

Connect a custom HTTP MCP server as a connector ("Cipher-NYC").
Toggle on "use all tools from this connector without asking" at the connector level.
Create a routine whose prompt calls a tool from this connector. Attach the connector under the Connectors tab.
Wait for the cron to fire or trigger manually.

Claude Model

Sonnet (default)

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

Claude 1.8089.1 (b98a06) 2026-05-19T18:28:48.000Z

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

The MCP tool schemas were recently updated (added a new optional parameter inactive_only to get_authoring_queue). Possible the runtime is caching old tool signatures and treating the updated version as "new and unapproved."
The connector was disconnected and reconnected after the schema change. Possible the internal connector ID changed and old permission grants are now orphaned.
Routine config: cloud environment "Cipher NYC Narratives" (Trusted network access, no setup script, no env vars). No GitHub repo attached. Permissions tab shows "Add a repository to configure permissions" — implying per-routine allowlists are gated behind repo attachment, which may itself be the bug for routines that don't need a repo (MCP-only workflows).