Auto mode: safety classifier blocks read-only MCP tools when the conversation model is unavailable

Summary

Read-only MCP tool calls were repeatedly refused by the auto-mode safety classifier with a model-unavailability message. Five attempts, spaced 20s, 45s, 90s and ~3 min apart, returned the exact same error. The task was abandoned with zero output.

Product: Claude Code
Model: claude-opus-5 (auto permission mode)
Date: 2026-08-09
Perceived severity: high — blocks legitimate work with no user-side workaround

Error message received (identical on every attempt)

claude-opus-5 is temporarily unavailable, so auto mode cannot determine the safety of mcp__…__list_agents right now. Wait briefly and then try this action again. If it keeps failing, continue with other tasks that don't require this action and come back to it later. Note: reading files, searching code, and other read-only operations do not require the classifier and can still be used.

Steps to reproduce

1. Start a Claude Code session with an MCP server connected (Hyperagent, in this case).
2. Load the tool schemas via ToolSearch (select:…list_agents,…list_threads,…get_thread) — this works fine.
3. Invoke list_agents and list_threads (both read-only, no side effects).
4. Result: the error above, on 100% of attempts.

Attempt log

| # | Tool | Wait before | Result |
|---|---|---|---|
| 1 | list_agents | — | Classifier error |
| 2 | list_threads | — (same parallel call) | Classifier error |
| 3 | list_agents | 20 s | Classifier error |
| 4 | list_agents | 45 s | Classifier error |
| 5 | list_agents | 90 s | Classifier error |

Why this matters

1. The message contradicts itself in practice. It states that read operations don't require the classifier — yet the blocked tools are pure reads (list_*, get_*, with no write capability at all). The gating criterion appears to be "is it MCP?", not "is it risky?".
2. There is no alternative path. The user cannot mark an MCP tool as a trusted read, nor fall back to a manual approval prompt in place of the classifier. The only remedy offered is "wait and retry", which failed five times.
3. The root cause is a fragile circular dependency. Using the conversation model itself as the safety gate means any unavailability of that model takes down the entire tool layer with it — harmless tools included. An inference outage becomes a total product outage.
4. The cost lands on work already paid for. The session spent tokens on schema loading, retries and waits, and delivered nothing.

Expected behaviour

• Static risk classification for read-only MCP tools. Tools with no declared side effects should pass without a live inference call, the same way Read/Grep/Glob already do.
• Graceful degradation instead of refusal. If the classifier is down, fall back to the manual permission prompt — let the human decide, since that is exactly what the classifier is standing in for.
• A fallback model for the classifier. The safety check does not need to run on the same model as the conversation; a smaller, higher-availability model (e.g. Haiku) would serve as a backstop.
• An honest error message. If read-only MCP tools are not covered by the exemption the message cites, the message needs to say so — as written, it points users in the wrong direction.
• Don't bill blocked attempts. Calls refused before execution shouldn't consume budget.

Concrete impact in this case

A read-only audit of a Hyperagent installation (agent inventory and thread history), a prerequisite for an architecture decision. None of the 5 scoped items were verified. The work remains blocked until the classifier recovers, or has to be redone by hand through the Hyperagent UI.

Note

This report was originally written for /feedback, which is disabled whenever CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 is set — so users with that privacy setting enabled have no in-product path to report bugs at all. Worth considering whether bug reports should count as "non-essential traffic".