Magic Tools
Claude GuidesBy CooconJuly 28, 2026171 views4 min read

Claude Code Plan Mode: Research First, Code Later, Rework Less

The most expensive thing about Claude Code is not tokens — it is rework. Claude confidently edits eight files, you read the diff, and the whole approach was wrong. Roll back, start over. Plan Mode is the switch built for exactly this: Claude researches read-only and proposes a plan, and only after you approve does it touch code.

What Plan Mode is: read-only research plus an approval gate

In Plan Mode, Claude's behavior splits into two phases:

  1. Research (read-only): it can read files, search code, and analyze structure — but it cannot edit files or run commands that change system state
  2. Approval: it distills the research into an implementation plan and presents it; approve and it exits Plan Mode to execute, or push back and it revises the plan

The key value is separating "think it through" from "do the work" at the mechanism level. Without Plan Mode you can always write "don't change code yet" in your prompt, but that is a verbal agreement. Plan Mode is a hard constraint: during research, file edits are blocked even if attempted.

How to enter: cycle with Shift+Tab

Press Shift+Tab during a session to cycle through three permission modes:

  • Normal: every sensitive action asks for confirmation
  • Auto-accept: file edits go through automatically — good for mechanical tasks you trust
  • Plan Mode: read-only planning, all modifications blocked

You can also start a session directly in it: claude --permission-mode plan. If your team has a "big changes need a plan first" convention, write it into the project's CLAUDE.md — Claude will then proactively start non-trivial tasks in a planning flow.

Which tasks deserve Plan Mode

A practical threshold: if the change takes more than 3 steps, or more than one reasonable approach exists, plan first. Concretely:

Turn it on for:

  • Multi-file refactors ("extract the auth logic into middleware")
  • First changes in an unfamiliar codebase — the research phase doubles as your codebase tour
  • Features with architectural forks ("add real-time notifications" — WebSocket or polling?)
  • Bugs with an unknown root cause: let it investigate read-only and present a diagnosis, instead of guess-and-edit contaminating the scene

Skip it for:

  • Typo fixes and one-line style tweaks
  • Tasks where you have already specified the exact change and only execution remains
  • Pure lookup questions ("where is this function called?") — just ask; planning adds a detour

The cost of using Plan Mode on a small task is one extra round trip. The cost of skipping it on a large task is wholesale rework. When unsure, err toward planning.

Four techniques that make planning actually improve quality

1. Make it ask questions before proposing. Add "if the requirements are ambiguous, ask me first" to your planning prompt. Every question surfaced during planning is one rework avoided during execution.

2. Require verification steps in the plan. A good plan lists not just "which files change" but "how we prove it worked" — which test to run, which log to check. Acceptance criteria written into the plan give you something to audit against after execution.

3. Persist the plan to a file. Have Claude write the approved plan into something like tasks/todo.md and check items off as it executes. If the session is interrupted or the context gets compacted, that file is the anchor for resuming exactly where things stood.

4. When execution drifts, go back to planning. If a premise turns out wrong mid-execution, do not let Claude "adjust as it goes" — switch back to Plan Mode and re-evaluate. Pushing through after a wrong turn almost always costs more than stopping to re-plan.

How it composes with the rest of Claude Code

Plan Mode is not an island. During research it pairs naturally with subagents — send them to investigate different subsystems in parallel while the main context receives only conclusions. During execution, the approved plan pairs with auto-accept so mechanical edits stop asking for confirmation one by one. And the team rule about when planning is mandatory belongs in CLAUDE.md, where every future session inherits it automatically.

In one sentence: Plan Mode turns AI coding from "give an order, gamble on the result" into "review the approach, then release the brakes." The bigger the task, the more rework that one approval round saves.

Related reading on this site: the "Claude Code Quickstart Guide" if you are still building your basic workflow, and "10 Advanced Claude Code Techniques" for session recovery, checkpoint rewind, and other capabilities that complement Plan Mode.

Related Articles

Reproducing an Injection Chain That Cracks Claude Code Auto Mode: the Model Refuses the Malicious Binary, Then Writes Code That Pwns Itself

In late August embracethered published an attack chain where a plain 'summarize this page' request drags auto-mode Claude Code to a 60–80% code-execution rate — while Anthropic's commissioned third-party test reported 0.00%. I took the chain apart and tested it stage by stage in an isolated environment: the endpoint that nudges the model from WebFetch to curl, and the crux — the model's own 'safe' decision to refuse the unknown binary and write its own Python decoder instead lands straight on a same-name struct.py planted in the extracted directory. The deterministic parts (branching + module-shadow poison + mitigation controls) reproduce fully on my machine with real evidence; the live end couldn't complete a full RCE here because the classifier rate-limited and failed closed — flagged honestly. Ends with mitigations that actually help.

claude-codeauto-mode+5
hands-onAug 31, 20269 min
116

Cracking Open Claude Code's Auto-Mode Classifier: A 116K-Char System Prompt, Dissected Line by Line

My earlier retest confirmed auto mode calls the session model as a classifier before each risky Bash — but what it receives stayed a black box. This time I captured the full request: a 116,879-char system prompt opening 'You are a security monitor for autonomous AI coding agents.' I quote it verbatim to dissect the threat model, two-tier rules (1 HARD BLOCK / 68 SOFT BLOCK / 17 ALLOW), and two-stage evaluation — stage 1 grades harm only, stage 2 layers intent on top. Every number read out this session.

claude-codepermissions+5
hands-onAug 30, 202612 min
171
Turn a Home Mac mini Into an Always-On Claude Code Workstation: claudecodeui + SSH Reverse Tunnel, Take Over Sessions From Any Browser

Turn a Home Mac mini Into an Always-On Claude Code Workstation: claudecodeui + SSH Reverse Tunnel, Take Over Sessions From Any Browser

A Mac mini at home runs Claude Code around the clock — but how do you take over a session from a browser when you're away? This is a real setup that has been live for a week and in daily use: claudecodeui as the web UI (chosen over the official web version, ttyd, and code-server), an SSH reverse tunnel pushing it to a VPS, and nginx adding TLS plus login rate limiting to turn it into an ordinary URL. Includes full configs, real operating numbers (five days of tunnel uptime with zero drops, 170MB RSS), a <synthetic> placeholder bug hit and fixed within the first week, and an honest for-and-against on why not Tailscale.

claude-codeclaude-code-lab+7
claudeAug 29, 202612 min
166

You Set ANTHROPIC_BASE_URL. Claude Code Ignored It.

I exported ANTHROPIC_BASE_URL in .zshrc to point at a self-hosted API gateway, and Claude Code kept talking to Google Vertex anyway. On the same machine, a launchd-managed web UI insisted it wasn't authenticated at all. Neither bug was in the gateway — both were in the gap between 'I set the env var' and 'the process actually has it.'

claude-codebug-postmortem+2
pitfallsAug 24, 20264 min
244

Published by Magic Tools