### Preflight Checklist - [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet - [x] This is a single bug report (please file separate reports for different bugs) - [x] I am using the latest version of Claude Code ### What's Wrong? A Cloud Routine (claude.ai/code/routines) that ran fully autonomously for weeks has started showing per-call "Allow once / Deny" approval prompts (via pus

[BUG] Cloud Routine shows per-call approval prompts for already-allowlisted MCP connector tools (regression, started ~1 week ago)

Status Open

Maintainer reply None cached

Activity 0 comments · opened Jul 25, 2026

Preflight Checklist

[x] I have searched existing issues and this hasn't been reported yet
[x] This is a single bug report (please file separate reports for different bugs)
[x] I am using the latest version of Claude Code

What's Wrong?

A Cloud Routine (claude.ai/code/routines) that ran fully autonomously for weeks has started
showing per-call "Allow once / Deny" approval prompts (via push notification) for MCP
connector tool calls, starting roughly one week ago with no changes to the routine, its
connectors, or its repository. This contradicts documented behavior: "Routines run
autonomously as full Claude Code cloud sessions: there is no permission-mode picker and no
approval prompts during a run... Claude can use every tool from an included connector,
including writes, without asking for permission during a run."
(https://code.claude.com/docs/en/routines)

Environment:

Routine name: "Job Tier Alerts v4"
Trigger type: Scheduled, Cloud Routine (confirmed via listing at claude.ai/code/routines —

not a Desktop scheduled task)

Connectors attached: TheirStack, Resend
Repository: samuellindo23/job-search-automation (private)
No .mcp.json in the repository — connectors are account-level claude.ai connectors, not

project-declared MCP servers

The repo's committed .claude/settings.json already allowlists the exact tools that still prompt:

{
"permissions": {
"allow": [
"mcp__TheirStack__search_jobs",
"mcp__TheirStack__get_teams_credits_consumption",
"mcp__TheirStack__get_requests",
"mcp__Resend__send-email"
]
}
}

Actual behavior: every run now shows individual "[Tool] requests permission" dialogs via
push notification, requiring a manual "Allow once" tap for each of: Search Jobs
(TheirStack), Get Teams Credits Consumption (TheirStack), Get Requests (TheirStack),
Send-Email (Resend). Only "Allow once" / "Deny" are offered — no "Always allow" option.
Screenshots attached for all four tools.

Timeline: ran with zero approval prompts for multiple weeks, then began prompting on every
call approximately one week before this report (~2026-07-18), with no changes made to the
routine's prompt, connectors, repository, or settings during that window.

Reproduces across multiple platforms: iOS (Claude mobile app, iPhone) and macOS (Claude
desktop app) — not device-specific. See screenshots from iPhone a few days ago and desktop app this morning.

What Should Happen?

Per the Routines documentation, connector tool calls (including writes like sending email)
should execute with zero approval prompts during a Cloud Routine run — no permission-mode
picker, no approval UI, by design.

Error Messages/Logs

No text-based error/log output available — the failure surfaces as an interactive
"[Tool] requests permission" dialog (Allow once / Deny) via push notification, not as a
logged error string. See attached screenshots.

Steps to Reproduce

Create a Cloud Routine with a scheduled trigger and at least one MCP connector attached

(including a connector with a "write" tool, e.g. sending email).

Let it run on schedule for an extended period with no prompts.
Observe that at some point, with no configuration change, tool calls that previously ran

silently begin producing "Allow once / Deny" prompts on every run — even for tools
explicitly listed in the repo's committed .claude/settings.json allow list.

Related issues (searched before filing)

This closely matches a previously-fixed regression: #61015 ("Scheduled routines fail every
MCP tool call with 'MCP tool call requires approval' on custom connectors"), opened and
closed as addressed on 2026-05-21. Duplicates of #61015 include #61143, #61027, #61196,
#61190, #61098, #61200 (all May 21-23, 2026, all closed). One open duplicate, #61044, has had
no activity since it was opened.

Also related: #67371 (created 2026-06-11), which reports the same underlying pattern — cloud
connectors (mcp__claude_ai_*) ignoring permissions.allow/wildcard entries entirely, unlike
local MCP servers — in an interactive-session context rather than a Routine. #67371 was
closed as "not planned" / stale, not confirmed fixed.

This report is filed separately because the symptom reappeared in a Routine roughly two
months after #61015 was marked fixed, with no changes on my end. Between #61015's May fix,
#67371's June report, and this July recurrence, this looks like a recurring, not durably
fixed, bug class rather than a one-off regression.

Claude Model

Sonnet (default)

Is this a regression?

Yes, this worked in a previous version

Last Working Version

Unknown specific version — Cloud Routines have no user-visible version pin. The routine ran without any approval prompts for multiple weeks before ~2026-07-18.

Claude Code Version

Not applicable — this is a Cloud Routine (claude.ai/code/routines), which runs on Anthropic-managed infrastructure with no locally-visible version string.

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Other

Additional Information

Two changelog entries from June 2026 touch on adjacent behavior but don't cleanly match this
timeline (they shipped ~4-6 weeks before this regression started), included only as
possibly-related context, not a claimed cause:

v2.1.183 (June 19, 2026): "Fixed scheduled task and webhook trigger deliveries being treated

as keyboard input; they now classify as task notifications and can no longer approve a
pending action... in auto mode."

v2.1.196 (June 22, 2026): "Security: claude mcp list/get no longer spawn .mcp.json servers

that a repo self-approved via a committed .claude/settings.json; untrusted workspaces show
⏸ Pending approval." (Likely not applicable — this repo has no .mcp.json.)

Screenshots attached below showing "requests permission" dialogs for Search Jobs, Get Teams
Credits Consumption, Get Requests, and Send-Email.

View original on GitHub ↗