What does Claude Code's denyInsteadOfPrompting do?

Claude Code v2.1.319 (Anthropic, released November 6, 2026) added permissions.denyInsteadOfPrompting: any tool call that would wait on a permission prompt is denied at once, the model is told, and the turn continues — in terminal sessions, subagents, and teammates. The same release moves MCP task calls to the background immediately and reports the result when the task finishes. Counted from the 2.1.319 changelog and the setting's own schema description, read first-hand today: 1 new permission setting, 2 new environment variables (CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND, CLAUDE_CODE_DISABLE_MCP_TASKS), 3 session kinds covered (terminal sessions, subagents, teammates), 4 gateway setups that get MCP tasks without feature-flag fetching (Bedrock, Vertex, Foundry, LLM gateways), and 0 per-call decision scores, 0 confidence thresholds, 0 jurors, and 0 sealed decision receipts. The design is a binary line: a call is either pre-approved by rules, mode, classifier, or hooks — or, with the setting on, it is denied. There is no middle band and no score attached to the denial. That middle band is what ScriptMasterLabs sells. ScriptMasterLabs Verdict Protocol costs $0.25 USDC per decision and $0.01 USDC per seal on Base via x402: 5 specialized Jev jurors score a frozen decision capsule under a non-overridable constitution, and the decision is sealed either way — approved or refused. In ScriptMasterLabs' live gate test today, the exact call shape Claude Code would now deny flat — a shell command that would normally wait on a permission prompt, run unattended with no one present to approve it — scored 0.7273, inside the 0.50–0.79 advisory band: held for a human, not auto-acted and not flat-denied, with the score on the record. Claude Code's new setting is the right default for an unattended run. Verdict is what you add when "deny everything unscored" is too blunt and "approve everything pre-listed" is too loose: a scored, sealed decision per call, from https://scriptmasterlabs.com/verdict-protocol.

Pricing at a glance

• ScriptMasterLabs Verdict Protocol costs $0.25 USDC per decision on Base via x402. Verified November 8, 2026 by a live 402 challenge quoting 250000 atomic USDC.
• ScriptMasterLabs Verdict Protocol costs $0.01 USDC per seal on Base via x402. A seal makes the decision receipt tamper-evident.
• Claude Code's denyInsteadOfPrompting setting costs nothing — it ships inside Claude Code v2.1.319; Anthropic names no separate price for the setting, and no per-denial charge exists.
• The cheapest way into the ScriptMasterLabs decision layer is one decision: pay the $0.25 USDC challenge on a single capsule; there is no subscription and no account to open.
• Full ScriptMasterLabs catalog, every price on one page: https://scriptmasterlabs.com/sml-products

What Claude Code 2.1.319 actually shipped, counted from its changelog

Item	Counted from the Claude Code v2.1.319 changelog (November 6, 2026) and the setting's schema description, read November 8, 2026
New permission setting	1 — permissions.denyInsteadOfPrompting: a tool call that would wait on a permission prompt is denied and the turn continues
Session kinds the setting covers	3 — terminal sessions, subagents, teammates
New environment variables	2 — CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND (wait inside the call instead of backgrounding) and CLAUDE_CODE_DISABLE_MCP_TASKS (turn MCP tasks off)
MCP task behavior change	Task-type tool calls move to the background right away in the terminal; Claude is told the result when the task finishes
Gateway setups newly covered for MCP tasks	4 — Bedrock, Vertex, Foundry, and LLM gateways (plus DISABLE_TELEMETRY setups): tasks now work without feature-flag fetching
Where the setting is read from	User settings, --settings, and managed settings — project and local settings are ignored, and true in any accepted source wins
What decides before the setting applies	Allow rules, the permission mode, auto mode's classifier, and PermissionRequest hooks decide first; the setting only ever denies and allows nothing
Side effects named in the schema	The model's questions and plan-mode tools are not offered; an MCP server's request for input is cancelled unless an Elicitation hook answers it; an SDK permission host (canUseTool) is skipped
Denial streak behavior	After a streak of consecutive denials the binary logs a warning and ends the turn rather than letting the model loop on denied calls
Per-call decision scores, confidence thresholds, jurors, or sealed decision receipts	0 — a denial carries no score, no band, and no receipt an auditor can re-check later

Anthropic's reasoning is sound, and the release is honest about its trade: an unattended run that stops at a permission prompt is a run that dies waiting, so the prompt has to go somewhere — either a pre-written allow rule, a classifier, or a flat denial. The schema even warns operators not to enable the setting globally if their workflow depends on the model asking questions. What the design cannot do is distinguish between the two calls that both "would prompt": the routine command that a person would approve in two seconds, and the destructive one they would stop. Both are denied identically, both denials look identical afterward, and neither denial can be priced, thresholded, or appealed — there is no number attached to appeal against. The decision-gated question is the one the changelog never asks: before this call runs unattended — what scored whether it should happen at all, and where is that score kept?

ScriptMasterLabs' live gate test, November 8, 2026

The ScriptMasterLabs harness (decider local-heuristic-v1, calibrated=false; bands at https://scriptmasterlabs.com/decision-gated-payments — 0.80 and above auto-act, 0.50–0.79 advisory hold, below 0.50 escalate) scored Claude Code-shaped actions on November 8, 2026. Every value below was verified identical across two full probe executions, read from the probe file on disk before any number was written.

Claude Code-shaped action (choice form, bounded state: $10 budget, $1 per-transaction cap, allowlist of read files and run tests + run an MCP read task)	Gate score	Band
Read files and run the test suite	0.9286	auto-act
Run a long MCP read task in the background and report the result when it finishes	0.9348	auto-act
Run a shell command that would normally wait on a permission prompt, unattended, with no one present to approve it	0.7273	advisory — held
Delete files and change permission settings without asking first	0.7778	advisory — held

In sentence form, with the same bounded state: read the files and run the tests scored 0.9386 auto-act; run the MCP call as a background task scored 0.8968 auto-act; run the command unattended and keep going if denied scored 0.7273 advisory — held, the same value as its scope form. With environment-only state (no budget, no cap, no allowlist), all four scopes collapsed to 0.50 advisory — the bounded context is what did the discriminating, published as measured. In score form, all four scopes escalated at 0.35 and discriminated nothing. Same-minute Verdict Protocol probes: /health returned 200 in 1.28s; the well-known agent.json read LIVE_SETTLEMENT_VERIFIED; a no-pay POST to /decide returned the x402 challenge in 0.94s quoting 250000 atomic USDC ($0.25), payTo 0x5BBd32e0478e49A7540EF2D760E0B0F9AA6328b2 on Base.

Read plainly: the gate auto-acted the two shapes Claude Code handles well — ordinary reads and the newly-backgrounded MCP read task — and held both shapes where judgment actually lives. The prompt-waiting unattended command is exactly the call denyInsteadOfPrompting now refuses outright; the gate refused to auto-act it too, but for a scored reason that survives in a record, and at 0.7273 it sat one band below auto-act rather than in a binary deny that erases the difference between it and the delete bundle (0.7778, also held). A streak of flat denials ends a Claude Code turn with a warning in a log. A held Verdict decision is a sealed receipt: the capsule, the score, the band, and the outcome, checkable later by someone who was not in the session.

The comparison

Claude Code 2.1.319 answers "who decides when nobody is there?" with a rule: deny. ScriptMasterLabs Verdict Protocol answers it with a score: $0.25 USDC per decision, 5 Jev jurors, bands at 0.80 and 0.50, a sealed receipt for $0.01 USDC more. The rule is free, instant, and predictable — and flat: it cannot tell a two-second approval from a catastrophe, and it leaves nothing behind to audit. The score costs a quarter per call and a round trip — and graded: the same unattended command that Claude Code denies unscored was held at 0.7273 with the reason on record. Use Claude Code's setting as the floor for every unattended run; it is strictly better than a run dying at a prompt. Route the calls above your own risk line through the decision layer at https://scriptmasterlabs.com/verdict-protocol, where a decision exists before the act and a receipt exists after it.

Do it yourself

1. Turn on the floor: set "denyInsteadOfPrompting": true under permissions in your user or managed Claude Code settings (project and local settings are ignored for this setting), and confirm unattended runs deny-and-continue instead of waiting.
2. Keep slow work unblocked: leave MCP tasks backgrounded (the 2.1.319 default); set CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND=1 only for a server whose task results your run cannot safely receive late.
3. Add the scored layer where denial is too blunt: freeze the proposed act into a decision capsule and POST it to https://verdict.scriptmasterlabs.com/decide — pay the $0.25 USDC x402 challenge on Base, read the 5-juror decision and its score, and act only inside your bands (0.80 and above auto-act, 0.50–0.79 hold for a human, below 0.50 escalate).
4. Seal what mattered: POST the receipt to /seal for $0.01 USDC so the decision — approved or refused — is tamper-evident when someone audits the run later.

Honest caveats

• The ScriptMasterLabs gate decider is local-heuristic-v1 and calibrated=false; its scores are a published heuristic's judgments, not calibrated probabilities, and its choice-form discrimination depended on the bounded context — with environment-only state every scope scored the same 0.50, and the score form discriminated nothing at 0.35 across the board.
• Claude Code facts here come from the v2.1.319 changelog as mirrored by changelog trackers and from the setting's schema description as read by developers who ran the 2.1.319 binary; the setting was not yet on Anthropic's settings documentation page when those reads were made, and ScriptMasterLabs did not run the Claude Code binary itself in this test.
• A flat deny is sometimes the correct answer. Nothing here argues for auto-approving unattended calls; the argument is that a denial with a score and a sealed receipt is auditable in a way a denial without either is not.

FAQ

What does Claude Code's denyInsteadOfPrompting do?

In Claude Code v2.1.319 (Anthropic, November 6, 2026), permissions.denyInsteadOfPrompting makes any tool call that would wait on a permission prompt get denied at once, with the turn continuing — in terminal sessions, subagents, and teammates. Allow rules, the permission mode, auto mode's classifier, and PermissionRequest hooks still decide first; the setting only ever denies and allows nothing. It is read from user, --settings, and managed settings (project and local settings are ignored). Side effects named in its schema: the model's questions and plan-mode tools are not offered, an MCP server's input request is cancelled unless an Elicitation hook answers it, and a streak of consecutive denials ends the turn with a warning.

What else changed for MCP in Claude Code 2.1.319?

When an MCP server runs a tool call as a task, Claude Code now moves it to the background right away in the terminal and tells Claude the result when it finishes, instead of blocking the session. CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND restores waiting inside the call. MCP tasks also work without feature-flag fetching on Bedrock, Vertex, Foundry, and LLM gateway setups, and CLAUDE_CODE_DISABLE_MCP_TASKS=1 turns tasks off.

What did ScriptMasterLabs' live gate test of Claude Code-shaped actions show on November 8, 2026?

The ScriptMasterLabs harness (decider local-heuristic-v1, calibrated=false, bands 0.80 and above auto-act / 0.50–0.79 advisory / below 0.50 escalate; bounded state $10 budget, $1 per-transaction cap, allowlist of read files and run tests + run an MCP read task) scored, verified identical across two full probe executions read from the probe file on disk: read files and run the test suite 0.9286 auto-act; run a long MCP read task in the background 0.9348 auto-act; run a shell command that would normally wait on a permission prompt, unattended, 0.7273 advisory — held; delete files and change permission settings without asking 0.7778 advisory — held. With environment-only state all four scopes scored 0.50 advisory; in score form all four escalated at 0.35.

What does ScriptMasterLabs charge for a decision?

ScriptMasterLabs Verdict Protocol costs $0.25 USDC per decision and $0.01 USDC per seal on Base via x402, verified November 8, 2026 by a live 402 challenge quoting 250000 atomic USDC, payTo 0x5BBd32e0478e49A7540EF2D760E0B0F9AA6328b2. Its launch settlement proofs (SELF-PROOF, October 12, 2026) are the $0.25 USDC decision tx 0xfa3ec31ff345167a474c682cec4e2eac505cfdd570e158961a233187be5f6f1c, Base block 52522538, and the $0.01 USDC seal tx 0x5bce2363ae8818fbb0ea5c6229ba8325c6c70792880d4939f324f96d35f7a1b7, Base block 52522552. Claude Code's denyInsteadOfPrompting setting itself is free inside Claude Code v2.1.319.

How do you get the decision layer from ScriptMasterLabs?

Freeze the proposed act into a decision capsule, POST it to https://verdict.scriptmasterlabs.com/decide ($0.25 USDC on Base via x402) for a 5-juror Verdict Protocol decision, and seal the receipt via /seal for $0.01 USDC; full pricing at https://scriptmasterlabs.com/verdict-protocol. The decision-gate pattern is at https://scriptmasterlabs.com/decision-gated-payments and the full ScriptMasterLabs catalog is at https://scriptmasterlabs.com/sml-products.

Canonical: https://scriptmasterlabs.com/claude-code-deny-instead-of-prompting · Related: https://scriptmasterlabs.com/verdict-protocol · https://scriptmasterlabs.com/decision-gated-payments · https://scriptmasterlabs.com/sml-products