Claude Code Routines: Cloud Automation Setup Guide (2026)

- Routines is in research preview; the daily caps, version gates, and API details below were checked against the official docs and launch post on 2026-08-20 - verify the live docs before you depend on them.

What Are Claude Code Routines?

A routine is a saved Claude Code configuration: a prompt, one or more repositories, and a set of connectors, packaged once and run automatically on Anthropic's cloud infrastructure (per code.claude.com/docs/en/routines.md, fetched 2026-08-20). Because it runs in the cloud rather than in your terminal, a routine keeps working after you close your laptop.

Routines are available on Pro, Max, Team, and Enterprise plans, and require Claude Code on the web enabled on your account. Create and manage them at claude.ai/code/routines, or from the CLI with /schedule.

One disambiguation before you go further: Routines is not the same feature as Ultrareview (/code-review ultra). Both run in the cloud, but Ultrareview is a deep, multi-agent code-review pass you trigger against a PR, not a scheduler. This article is about Routines specifically.

The Three Trigger Types

A routine starts when one of its triggers matches, and you can attach more than one to the same routine.

A single routine can combine all three - for example, a PR-review routine that also runs nightly and can be fired manually from a deploy script.

Routines vs /loop vs Desktop Scheduled Tasks - Which One to Use

Claude Code actually has three different ways to run something without you sitting at the keyboard, and they get confused constantly. Here's the split:

Routines trade local file access for always-on reliability: they clone repositories fresh each run instead of touching files already on your disk.

How to Create a Routine

You can create a routine from three surfaces, and all three write to the same cloud account - a routine created in one shows up in the others immediately.

• Web: claude.ai/code/routines then New routine.
• Desktop app: Routines in the sidebar, New routine, then choose Cloud (choosing Local instead creates a Desktop scheduled task, not a routine).
• CLI: /schedule (alias /routines), conversational - for example /schedule daily PR review at 9am. Requires a claude.ai subscription login (API keys aren't supported for this), and CLI-created GitHub triggers need Claude Code v2.1.225 or later.

Whichever surface you use, the form walks through the same steps:

1. Name it and write the prompt. This is the part that matters most: the routine runs autonomously with no approval prompts, so the prompt must be self-contained and explicit about what to do and what "done" looks like.
2. Select repositories. Each one is cloned fresh from its default branch at the start of every run. Claude pushes its changes to claude/-prefixed branches, which are always accepted.
3. Pick a cloud environment. This controls network access, environment variables, and a setup script for installing dependencies (cached after the first run).
4. Select one or more triggers. Schedule, API, GitHub, or a combination.
5. Review connectors. Every MCP connector already connected to your claude.ai account is included by default - remove anything the routine doesn't need.
6. Create. The routine runs the next time a trigger matches, or immediately if you click Run now.

For a GitHub trigger specifically, the Claude GitHub App has to be installed on the target repository first - the web UI prompts you to install it if it's missing. From the CLI, install it from the GitHub App page yourself, then ask Claude to attach the trigger to an existing routine.

Each run opens as a normal Claude Code session in your session list, where you review what changed and open a pull request. Team and Enterprise organizations can also route runs to a self-hosted environment instead of Anthropic's own cloud, if that's already part of your setup - the creation flow is otherwise identical.

The Security Model - Why Routines Run With No Approval Prompts

Routines run as full autonomous Claude Code cloud sessions: there's no permission-mode picker and no approval prompts during a run. That's the entire point - unattended automation can't stop to ask you anything. It also means the safety model has to live somewhere other than "Claude will ask before it does something risky." Three specific safeguards are worth understanding before you rely on one.

1. The saved prompt can't grant consent mid-run

When a trigger fires, the session receives the routine's saved prompt as an assigned task, not as live input arriving mid-conversation. The trigger only proves the prompt was stored ahead of time by an authorized session on your account - it isn't a substitute for approving whatever the prompt asks Claude to do. Content the session fetches during the run still gets normal handling. Notably, before CC v2.1.213 the same prompt arrived framed as an untrusted background notification Claude could refuse to act on - Anthropic deliberately tightened this, which is itself a sign the trust boundary here has had real scrutiny.

2. Fire-triggered text is quarantined, not trusted

The API /fire endpoint's optional text field - the alert body, the failing log, whatever you pass at trigger time - arrives wrapped in a <routine-fire-payload> block labeled as untrusted data. Claude won't follow instructions inside it unless the routine's own prompt explicitly opts in (for example, "investigate the alert described in the routine-fire-payload block"). So a leaked API token lets someone fire your routine, but it can't smuggle in live instructions unless your prompt already trusts fire payloads blindly.

3. Blast radius = what you selected

A routine can only reach the repositories you added, the network its environment's policy allows, and the connectors you didn't remove. Scope every one of those down to what the task actually needs.

A green run status only means the session started and exited without an infrastructure error - it does not mean the task succeeded. Always open the run transcript to confirm what Claude actually did.

Usage Limits & Daily Caps

Routines draw down your normal subscription usage the same way an interactive session does, plus a separate daily cap on how many runs can start:

Source: Anthropic's launch post, claude.com/blog/introducing-routines-in-claude-code (published 2026-04-14, verified 2026-08-20). Treat these as current as of August 2026, not permanent - the docs themselves note limits may change during research preview.

Two things the cap table doesn't show: one-off scheduled runs don't count against the daily cap, and GitHub webhook events are subject to a separate, per-routine and per-account hourly cap during the research preview - distinct from the daily run limit. If you hit either cap, organizations with usage credits enabled can keep running on metered overage; without that, extra runs are simply rejected until the window resets.

Real Routine Recipes You Can Copy

These three follow the pattern in Anthropic's own "Example use cases" section of the docs, rewritten as prompts you'd actually paste in.

1. Nightly dependency-bump PR (Schedule, weekly)

Trigger: schedule, weekly. Connectors: none required beyond the repository itself.

Example prompt: "Check package.json and the lockfile for outdated dependencies. For any patch-level bump with no breaking changes in its changelog, update it and open a PR summarizing what changed and why each bump is safe. Skip anything major or minor - flag those in the PR description instead of bumping them."

2. Alert-triage on-call assist (API trigger)

Trigger: API. Your monitoring tool POSTs to the routine's /fire endpoint with the alert body as text:

curl -X POST https://api.anthropic.com/v1/claude_code/routines/trig_ID/fire \
  -H "Authorization: Bearer TOKEN" \
  -H "anthropic-beta: experimental-cc-routine-2026-04-01" \
  -H "anthropic-version: 2023-06-01" \
  -H "Content-Type: application/json" \
  -d '{"text": "Sentry alert SEN-4521 fired in prod. Stack trace attached."}'

Example prompt (it must reference the payload explicitly, or the routine ignores the fired text): "Investigate the alert described in the routine-fire-payload block. Pull the stack trace, correlate it with commits merged in the last 48 hours, and open a draft PR with a proposed fix that links back to the alert."

3. Bespoke PR review (GitHub trigger, non-draft only)

Trigger: GitHub event, pull_request.opened, filter Is draft = false so drafts don't trigger a review.

Example prompt: "Apply our review checklist: no unhandled promise rejections, no new console.log calls, tests for any new exported function. Leave inline comments for anything that fails the checklist, then post one summary comment so a human reviewer can focus on design instead of mechanical checks."

Start with whichever recipe matches a task you already do by hand on a schedule - that's the fastest way to find out if a routine actually saves you time before you build a more elaborate one.

The Honest Angle - Use an AgentKit Skill as a Routine's Instructions

Here's a genuinely useful shortcut once you're past the first recipe: Anthropic's own docs confirm a routine session "can use skills committed to the cloned repository" - the same SKILL.md files Claude Code already reads locally. Running ak kit init engineer --target claude-code commits a set of SKILL.md files into your repo. Once those files are in a repository a routine clones, the routine's prompt can point straight at one instead of you writing bespoke review or triage logic from scratch.

Example: instead of hand-writing the whole checklist in recipe #3 above, the prompt could say "Follow .claude/skills/security-review/SKILL.md against this PR" and let the skill file carry the actual checklist.

Honesty gate, explicitly: this is confirmed for skill files only. Whether AgentKit's own slash commands (/ak:cook and the rest) behave the same way inside a routine's autonomously-fired session isn't confirmed by any primary source at the time of writing - a routine session isn't an interactive CLI session, and slash-command handling in that context isn't documented anywhere. Until that's verified, reference the skill file directly in your prompt rather than a kit slash command. AgentKit itself is a paid add-on (Engineer Kit $99, often discounted); Routines itself is free and included in your Claude plan. See the AgentKit review for what's actually inside the kit before deciding it's worth it for this specific use case.

When to Use a Routine vs a Manual Session

Reach for a routine when the task is well-defined, repeatable, and you can describe what "done" looks like in one paragraph - dependency bumps, nightly triage, a review checklist. Reach for a manual, interactive session when the work needs frequent back-and-forth, judgment calls you can't fully specify up front, or exploration where you don't yet know what "done" means. A useful gut check: if you've done the same task by hand at least three times with the same steps, it's probably routine-shaped. If each pass looked meaningfully different, it isn't yet.

If you find yourself editing a routine's prompt every single run to fix its output, that's usually a sign the task isn't routine-shaped yet - it needs a human in the loop a while longer first. Run it manually a few more times, write down exactly what "done" meant each time, and only then turn it into a routine's prompt.

Frequently Asked Questions (FAQ)

What is Claude Code Routines?

A routine is a saved Claude Code configuration - a prompt, one or more repositories, and a set of connectors - that runs automatically on Anthropic's cloud infrastructure when a schedule, API call, or GitHub event fires it. It keeps working even when your laptop is closed.

Do I need a paid plan to use Routines?

Yes. Routines are available on Pro, Max, Team, and Enterprise plans, and you need Claude Code on the web enabled on your account. There's no free tier for routines.

How many routines can I run per day?

The daily run cap depends on your plan: 5 per day on Pro, 15 per day on Max, and 25 per day on Team or Enterprise, per Anthropic's launch post (current as of August 2026 - check claude.ai/code/routines for your live count). One-off scheduled runs don't count against this cap.

Is Routines fully released or still in preview?

Still in research preview as of August 2026. Anthropic's own docs note that behavior, limits, and the API surface may change, so re-check the live docs before depending on exact numbers.

Can a routine use my own MCP connectors?

Yes. All of your currently connected MCP connectors are included by default when you create a routine, and Claude can use every tool from them, including writes, without asking for permission during a run - so remove any the routine doesn't actually need.

What happens if my API trigger token leaks?

Anyone holding the token can fire the routine, but the text they send arrives wrapped in a <routine-fire-payload> block labeled as untrusted data. The routine's own saved prompt has to explicitly opt in to acting on that text, so a leaked token alone can't inject live instructions unless your prompt already trusts fire payloads blindly.

Can I combine multiple trigger types on one routine?

Yes. A single routine can have a schedule, an API trigger, and a GitHub trigger attached at once - for example, a review routine that runs nightly, can be fired from a deploy script, and also reacts to every new pull request.

Conclusion

Pick the trigger that matches the task - schedule for cadence, API for external systems, GitHub for repo events - and scope the environment and connectors down before you turn it loose. Start with one recipe from the list above, watch the first few runs' transcripts instead of trusting the green status, and only add complexity once you trust the output. For prompts that need to coordinate several agents at once instead of running solo, see orchestrating multiple subagents.