Permissions issues on the web app
Issues the maintainers labelled both platform:web and area:permissions.
68 issues · 41 open · 27 resolved (40%) · first seen Mar 6, 2026
Is this getting better or worse?
This class of problem is still growing. 41 new reports in the last 90 days vs 24 in the 90 before — +71%. The open backlog peaked at 41 in 2026-10 and sits at 41 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
17 of these reports name the Claude Code build they were running, spanning 12 releases. Heaviest reporters:
- Claude Code v2.1.146
- Claude Code v2.1.288
- Claude Code v2.1.275
- Claude Code v2.1.260
- Claude Code v2.1.42
- Claude Code v2.1.227
- Claude Code v2.1.212
- Claude Code v2.1.195
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 3 days across 27 closures. Of the 27 closures with a recorded reason, 41% were closed as completed and 16 as not-planned or duplicate. The most recent completed fix landed in 2026-07.
Workarounds reported by the community
15 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] Scheduled routines fail every MCP tool call with "MCP tool call requires approval" on custom connectors (regression ~2026-05-20)
- …naling/dispatch system that's been broken for two days. The workaround is to move the workload off claude.ai routines entirely and run it as local cron against the same connector — which works fine, but defeats the point…
Found in the description of #61015 · resolved - [BUG] Routines: MCP connector tool calls fail with "requires approval" despite connectors being added to routine
- …d prompt via (preserves model/connectors/cron) 4. Community workaround from u/e lizzle in this thread (no-op sub-agent dispatch at prompt start to warm registry) — dispatch returns READY successfully, but MCP tools remai…
Found in the thread of #61027 · resolved - [FEATURE] claude.ai: let users set a default permission mode, incl. "Skip all approvals"
- …on does not prompt again in later conversations. 4. Current workaround (not adequate). Select Auto in each conversation and set all connector tools to "Always allow" in Customize Connectors. This reduces prompts, but Aut…
Found in the description of #98159 · still open - [BUG] MCP tool calls in CCR Routines fail with "requires approval" — no approval UI shown, reconnect does not resolve
- …s impact: Production daily routine is broken. No direct-API workaround available in our environment due to deployment constraints. Currently running the routine manually each morning as a holding pattern. Happy to share…
Found in the thread of #61044 · resolved - [BUG] Remote Control: MCP permission prompts for non-read tools never surface in claude.ai/code web UI
- …mux teammate mode, similar symptom but different code path. Workaround Pre-allowlist the specific MCP tool names in : \ \ \ This eliminates the prompt entirely, sidestepping the bug — but requires knowing each tool's MCP…
Found in the description of #60385 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 1–68
Ranked by community engagement (reactions weighted over comments).
- [BUG] Scheduled routines fail every MCP tool call with "MCP tool call requires approval" on custom connectors (regression ~2026-05-20)
- [BUG] Routines: MCP connector tool calls fail with "requires approval" despite connectors being added to routine
- [FEATURE] claude.ai: let users set a default permission mode, incl. "Skip all approvals"
- [BUG] MCP tool calls in CCR Routines fail with "requires approval" — no approval UI shown, reconnect does not resolve
- [BUG] Remote Control: MCP permission prompts for non-read tools never surface in claude.ai/code web UI
- [BUG] permissions.allow in settings.json is not honored in Claude Code web remote execution — MCP tools still blocked
- [BUG] MCP tools ignore permissions.allow — every call requires manual approval
- [BUG] Claude Code Projects (Beta). The auto-mode permission check blocks approved work in cloud environments and Projects
- [BUG] "Failed to save changes" error when enabling unrestricted git push permission
- [BUG] MCP tool write operations fail silently with "requires approval" - no prompt shown (remote execution environment)
- MCP connector tools fail with "requires approval" in routine remote execution sessions
- [BUG] `AskUserQuestion` breaks after a web/async session resume - either aborts instantly ("Tool permission stream closed before response received") or must be answered 2–7× before it registers
- [BUG] Remote routine fails with "MCP tool call requires approval" despite remote routine settings and MCP tools marked always allow
- Cowork scheduled tasks: permission classifier refuses owner-authorized email sends ("Real-World Transactions"); same send succeeds in an attended session; no per-task allow
- [BUG] Routine cloud sessions resolve a different Gmail MCP server registration than interactive sessions on the same account, causing 100% draft-creation failure since ~2026-05-20 23:00 UTC.
- [BUG] Scheduled routines fail all MCP connector calls with "MCP tool call requires approval"
- [BUG] Claude Routine permission bug
- [BUG] Routine sessions: Slack MCP tools fail with "MCP tool call requires approval" despite "Always allow" being set
- [BUG] Scheduled/automated Claude Code sessions don't load write-capable Slack MCP tools, even when the connector is connected and enabled
- Remote triggers with MCP connections prompt for tool approval despite always-allow setting
- Routine MCP Connectors permission grant not honored at scheduled cron-fire
- Cloud IDE sessions ignore permissions.allow rules from .claude/settings.json
- Connector tool permission "Needs approval" is ignored in Projects (beta) cloud thread sessions
- [BUG] Cloud routine hangs on a permission prompt for the built-in Artifact tool, contradicting "routines run autonomously"
- [BUG] Web interface: tool calls (file writes) intermittently return "user rejected" without the user acting, and the session then stalls silently
- Remote routines cannot bypass MCP tool approval gate (CreateSessionRequest has no permission_mode field)
- claude.ai cloud session: auto mode classifier labels the user's own typed approval a "cross-session message" and blocks the approved action
- [BUG] Web (cloud) session, Auto mode: classifier denies an explicitly user-requested add_repo(push); UI/mode guidance from the assistant was wrong
- [BUG] Child sessions: claude-code-remote MCP "Allow once" approvals are orphaned — calls fail before the prompt renders, grants never bind (11 calls, every prompt approved, 0 executions)
- [BUG] "MCP tool call requires approval" in an INTERACTIVE remote session — the approval is clicked and ignored, and the refusal is per-tool on one connector
- [BUG] Cloud session resume after MCP disconnect re-prompts for MCP tools already allowed in committed .claude/settings.json (unattended routine runs hang forever)
- [FEATURE] Per-routine connector permission scoping (e.g. read-only vs. read-write)
- [BUG] Bug: MCP tools require approval despite being in settings.json allowlist
- [BUG] Capabilities settings don't enforce file and code execution restrictions on web client
- Auto mode classifier blocks reading a file from the user's own installed skill as "Containment Escape"
- Auto mode classifier blocks editing an email draft the user approved in the same conversation ("Unrequested Commit in a Connected App")
- no way to change permissions, to go into don't ask mode when in project threads
- [BUG] Claude Code on the web (claude.ai/code): MCP connector prompts offer only "Allow once", so read-only tools ask on every call
- Web sessions: add a mode "write access to every repo the GitHub token allows" (single source of truth for permissions)
- [BUG] Permission "Allow" prompt appeared during an unattended Cloud Routine run
- [BUG] hangs indefinitely
- [BUG] Cloud scheduled tasks: "Always allow" for WebFetch not persisted — re-prompts and stalls on every run
- [Bug] Scheduled routines hang on Slack MCP connector approval prompt in headless mode
- [BUG] claude.ai self-authorises actions "The AskUserQuestion tool is failing ... so I'll make the call myself"
- [BUG] Subagent permission prompts are invisible in remote/web sessions
- PWA: Cannot approve/deny permission prompts (Allow/Deny buttons missing)
- Auto mode classifier blocks grep of the user's own installed skill file as "Instruction Poisoning"
- Auto mode classifier blocks a user-directed procedure on the user's own server as "Auto-Mode Bypass"
- Here is the draft. Paste it into the feedback form or a GitHub issue.
- Auto mode classifier blocks a read-only reachability check of the user's own remote browser endpoint as "Containment Escape"
- I can't see the prompt which should be shown to ask for my approval
- claude.ai cloud session: auto mode classifier blocks building (not running) a script that replaces a stale project doc with its updated copy
- claude.ai cloud session: auto mode classifier blocks a WhatsApp send the user approved in the same conversation ("Approved" judged as no user intent)
- [BUG] GitHub connector create_pull_request shows a form to the user instead of creating the PR, even when the owner told Claude to act
- [BUG] Claude on claude.ai (agentic chat): owner who has granted standing permission still gets approval cards for routine actions (create scheduled task), with no "always allow" option
- i see sometime there is a communication drop between the coordinator and thread…
- Project threads ignore the permission rules in my repository's .claude/settings…
- We keep hitting permissions issues pushing work to hosted git repos or deployin…
- no approval move in projects means i am stuck here when claude auto mode cannot…
- Im Projekt-Thread wartet die Session auf eine Freigabe (Artifact: Claude Doc löschen)
- [BUG] [BUG] Web session: the assistant's built-in documentation has no page on permission modes, so it gives ineffective advice
- New cloud Projects is good, with some limitations
- Cowork (cloud): routine sandbox Bash commands keep stopping for "Allow once" approval mid-task, despite user granting blanket permission
- [BUG] Unattended CCR routine sessions hang indefinitely on an unanswerable permission-mode prompt; run status disagrees across surfaces
- Allow session archive/pin/move actions to be permission-scoped (not per-call approval)
- "Always allow" permission checkbox does not persist in Chrome (claude.ai)
- [BUG] Routines cannot run fully unattended when the task publishes an Artifact — publish always requires manual approval
- [BUG] Custom remote MCP connector - all tools show "Auto-Allow disabled by your admin" in routine, despite org-wide Always Allow