Claude Code Mods Explained: How Programmable Mods Work

Mods are the most powerful customisation Claude Code has had, and also the riskiest, because they run with the same access to your machine as Claude Code itself and aren’t sandboxed. I’d install only mods whose source I’ve actually read, and I’d keep the built-in security mod in place on any shared or company machine. The good news is that Anthropic publishes the source of its own built-in mods, so you can see exactly how they work.

I’ve only used Claude Code a little; most of my Claude work happens in the regular app. So this article is based on Anthropic’s announcement and the mods’ published source code, not on long use of mods myself.

Disclosure: Claude Code is made by Anthropic, which also makes Claude, the model that helped draft this article. I’ve stuck to what Anthropic’s announcement and public source code say, and I haven’t installed or run any mod myself.

What a Mod Is

On 1 October 2026 Anthropic introduced mods: small TypeScript functions that react to events inside Claude Code, such as a tool call, a permission request or something being drawn on screen. A mod can run before an event, after it, instead of it, or wrapped around it. That means it can:

• rewrite a prompt before it reaches the model;
• block, change or retry a tool call;
• approve or deny a permission request;
• strip secrets from tool output before Claude reads it;
• add buttons and inputs, or replace parts of the interface, in the terminal, the desktop app or both.

Hooks vs Mods

Claude Code already had hooks, so why mods? Anthropic’s answer is control: hooks can’t rewrite events, draw interface elements or replace features. Mods can.

Summarised from Anthropic’s announcement, not from my own testing.

Where I’d Actually Use One

• Production guardrails: require confirmation whenever Claude touches production configuration, instead of relying on a written rule.
• Secret redaction: scrub tokens and keys from tool output before the model sees them.
• Audit logging: Anthropic’s own example is a mod loaded early that records calls made by other mods.
• Workflow views: show CI status beside the conversation, or swap the built-in /diff pane for one you prefer.

You can also ask Claude Code to write a mod for you; Anthropic says it can write, install and hot-reload it in the current session. That lowers the barrier a lot, but generated code still needs a human read before you trust it.

What We Found in the Built-in Mods’ Source

Method: on 15 October 2026 we cloned Anthropic’s public claude-code repository on GitHub and read the mods folder: its README, file structure and commit history. We did not install or run any mod.

Anthropic publishes the source of the four mods that ship inside Claude Code. The README describes them as “published as it is built into the binary”, so you can read exactly what the built-in versions do.

Three things stood out to me:

• The security mod is mostly tests. More than half of sec-default’s files are tests, with names such as setting-ld-preload, setting-dyld-insert, setting-node-options and setting-proxy. That shows what Anthropic is guarding against: a plugin injecting code or rerouting traffic through environment variables.
• Telemetry is a mod too, so you can read what it does rather than rely on a privacy page alone.
• AGENTS.md support is built in. If your repository already has an AGENTS.md for other agents, Claude Code uses it by default when there’s no CLAUDE.md, so mixed-tool teams may not need two instruction files.

The history shows the first three mods were added on 9 September 2026, about three weeks before the announcement. The licence is Anthropic’s commercial terms, not open source: you can read the code, not reuse it freely.

My Checklist Before Installing a Mod

These are my suggestions, based on Anthropic’s warning that mods aren’t sandboxed; they aren’t steps from Anthropic.

1. Read the source. Mods are small. Look for network calls, file access and anything near credentials.
2. Check which events it handles. Permission requests and tool output deserve more scrutiny than drawing.
3. Be wary of auto-approval. A mod that answers permission prompts removes the human checkpoint.
4. Review mods Claude writes for you.
5. Keep sec-default. If you set your own mod list, Anthropic advises adding sec-default to keep its restrictions.
6. Try it somewhere disposable, with no production credentials.
7. Use plugin controls. Mods ship inside plugins, so admins can allow or block marketplaces.

How to Get Mods

Mods are available in the Claude Code CLI and desktop app and are distributed inside plugins, installed through the Claude directory or the /plugin command. Anthropic has published a guide to building a first mod alongside the announcement.

FAQ

Are Claude Code mods sandboxed?

No. Anthropic says they run with the same access to your machine as Claude Code itself.

Can I turn off a built-in feature like /diff?

Yes. Because /diff ships as a mod, Anthropic says you can disable it or replace it with your own.

Does Claude Code read AGENTS.md?

Yes, through the built-in agents-md mod: by default only when the project has no CLAUDE.md, with settings to load both or neither.

Related: Claude Code vs Cursor · Claude Code setup guide · AI agent safety

Sources

• Anthropic: Customize Claude Code with mods (1 October 2026)
• Anthropic’s claude-code repository on GitHub, mods folder, cloned 15 October 2026