Claude Code Mods: What They Are and the Risks to Check

A mod in Claude Code is a plugin that runs small programs inside the tool itself, so it can change what Claude Code shows and does. Anthropic kept extending mods in October 2026. Because a mod acts with the permissions of the person who installs it, any team using Claude Code should decide who may install one. This article explains what mods are, what changed in the last two weeks, and what to settle before someone on your team adds one.

What is a Claude Code mod?

Anthropic's documentation describes a mod as a plugin that changes how Claude Code looks and behaves. A plugin is a bundle of add-ons for Claude Code. Other add-ons work from outside the tool: skills give Claude text instructions to read, and MCP servers (separate programs that give Claude extra tools) give it new tools to call. A mod is different. It is made of JavaScript or TypeScript event handlers, small pieces of code that Claude Code calls when something happens: a tool call, a submitted prompt, or part of the screen being drawn.

For each event, a handler can do one of three things:

• Watch it and let it continue unchanged.
• Rewrite it before it continues.
• Take it over and answer it, so the normal behaviour does not run. A refused command is an example.

Anthropic shares three sample mods, with no support. One draws a forecast of your context window (the amount of text Claude can hold in mind at once) above the prompt. One holds a risky shell command, such as rm -rf or a force push, and shows what it would change, with buttons to proceed or cancel. One adds a /replay command that steps through the file edits Claude made in the last turn. Some of Claude Code's own features are mods too, including the /diff pane and the loading of AGENTS.md as project instructions.

Mods work in the terminal, the Code tab of the Claude desktop app and the VS Code extension. Their handlers also run in claude -p (the mode used in automation) and the Agent SDK, but nothing is drawn there.

What changed in the last two weeks?

The Claude Code changelog shows mods getting more capable through October:

• 14 October (version 2.1.300): mods gained a prompt.change hook, which fires when the text in the prompt box changes without typing, for example when an earlier entry is recalled, the box is cleared or an edit is undone. The same release changed exit so that background commands still running 1.5 seconds after being asked to stop are force-killed.
• 15 October (2.1.301): a mod's text field can have several lines.
• 19 October (2.1.304): a mod's tool.check answer can carry decider: "person". Then only the permission dialog, or a host program's callback, can approve the request, and it is refused with the mod's reason where nobody can be asked.
• VS Code: the documentation says what a mod draws appears in the extension's chat panel from extension version 2.1.299, or 2.1.304 for sessions that do not fetch feature flags, such as those on Amazon Bedrock.

Mods themselves arrived slightly earlier. The documentation says they are on by default in Claude Code 2.1.287 and later in the terminal, and from 2.1.286 in the desktop app. If your team updated Claude Code recently, mods are probably already switched on for you.

Why should a non-engineer care?

Because of one sentence in the documentation: a mod is "code that runs with your permissions." It can read and write any file your user account can reach, start programs and make network requests. Anthropic lists what a loaded mod can do:

• Read secrets held in environment variables (named settings that programs inherit) and in settings files, including an API key.
• See every prompt you send and every tool call Claude makes.
• Rewrite a prompt or a tool call, submit a prompt as if you had typed it, or send a message to another of your sessions.
• Approve a tool call before you are asked.
• Spend your usage by calling a model on your plan or API key.

Mods are not sandboxed. A sandbox is a walled-off area that limits what a program can touch. If you turn on Claude Code's sandboxing, it isolates the shell commands Claude runs, but a process that a mod starts runs outside it.

None of this means mods are dangerous by nature. It means a mod is closer to installing an app than to adding a note to a prompt. The risk is the one you already manage with any software: where it came from and who vetted it.

What protections already exist?

Anthropic's guides describe several layers.

A built-in guard. Claude Code loads a built-in mod called the guard ahead of every mod a user installs, when the machine has managed settings (settings an administrator deploys and users cannot change) or when the session uses a Team or Enterprise login. Users cannot turn it off. With the guard loaded, by default a user's mod cannot approve a call that a deny rule refuses, that an ask rule prompts for, or that a pre-tool-use hook blocked. A pre-tool-use hook is a script that runs before a tool does.

One option to keep users' mods out. An administrator sets allowManagedModsOnly to true as an option on the guard, under pluginConfigs in managed settings. Then no mod a user brings runs its hooks, including one loaded from a folder with --plugin-dir or one that Claude wrote during a session. The organisation's own mods and the mods built into Claude Code still run. Users' ordinary settings hooks and status lines keep working. Because the guard reads the option from managed settings only, a user cannot undo it in their own files.

A way to look before installing. Running claude plugin validate on a mod's folder lists, without running the mod, which events it handles (a hooks: line) and which actions it asks Claude Code to perform (a calls: line). Reading and writing files, starting programs, making network requests, reading environment variables and settings, and using your model plan each show up by name. Claude Code refuses to load a mod that uses its interface in a way this command cannot read.

A switch for a single session. Starting Claude Code with --safe-mode turns off all installed mods, and also your other customisations, which helps when you suspect one caused a problem. Built-in mods stay on.

There are limits. The guard's rules apply to Claude's own tool calls, not to a mod's own file and process calls. The documentation gives the example that with reading of .env denied, a mod can still read that file itself. To limit those, keep the mod from loading or write a policy mod of your own.

What should a team decide this week?

You do not need to write a mod to act on this. Four decisions are enough.

1. Who may install mods? If the answer is "anyone", say so on purpose. If the answer is "no one yet", ask whoever manages your settings about allowManagedModsOnly.
2. Who reviews a mod first? Make the claude plugin validate output part of the review. Anything that reads environment variables, starts programs or reaches the network deserves a human question about why.
3. Where do secrets live? A mod can read environment variables and settings files, so keep long-lived keys out of them where you can.
4. Which updates reach people? A mod is a plugin, so the controls for restricting which plugins users can install, and when a reviewed plugin may update, apply to mods too.

For a pilot, the safe default is the plain one: start with no user-installed mods, and open the door for a named mod when someone can say what it does and who checked it.

How does Atlas fit?

Atlas is a team of AI engineers built on Claude Code, and each engineer is its own Claude Code session. Atlas's published feature list says nothing about showing or managing mods, so treat that as outside what it does today. The controls above are yours to set in Claude Code's own settings. Atlas is an independent product. You can see how the team works on the Atlas home page.

Conclusion

Mods make Claude Code programmable from the inside, and Anthropic extended them again between 14 and 19 October 2026. The upside is real: custom panes, guards and commands. The cost is that each mod is trusted code. Decide who installs mods, review what they ask for before they load, and use the managed option if you want none from users at all.