Claude Code Mods Run With Your Permissions: How to Check One Before You Install It (2026)

Mods landed in Claude Code on October 1, 2026, and the demo clips spread within hours: token gauges above the prompt, a pane that charts context use, a guard that holds rm -rf until you click a button.

The part the clips skip is what a mod is allowed to touch. That’s the question this page answers, one question at a time, using Anthropic’s own documentation as the reference.

If you only read one section, read the one about claude plugin validate.

Contents

• What Changed in Claude Code on October 1, 2026?
• What Can a Claude Code Mod Reach on My Machine?
• Doesn’t the Sandbox Protect Me From a Bad Mod?
• How Do I Check What a Mod Does Before Installing It?
• Which Lines in the Validate Output Should Worry Me?
• How Do I See Which Mods Are Running Right Now?
• How Do I Turn Mods Off If Something Looks Wrong?
• Is a Team or Enterprise Plan Safer for Mods?
• Tips
• Warnings
• FAQ
• Sources

What Changed in Claude Code on October 1, 2026?

On October 1, 2026, Anthropic opened Claude Code to mods: plugins built from JavaScript or TypeScript event handlers that run inside Claude Code and can watch, rewrite, or take over events such as tool calls, submitted prompts, and parts of the interface being drawn. According to the Claude Code mods overview, mods require Claude Code v2.1.287 or later and are on by default.

That last detail matters. You don’t opt in to the feature. You opt in to each mod when you install the plugin that carries it.

The older “settings hooks” you may already use are different. Those run a shell command or HTTP request you wrote into settings.json. A mod is a function that lives inside the Claude Code process, which is why it can redraw the spinner, add a pane, or hold a tool call while it asks you something.

Some of Claude Code’s own features are already mods. The /diff pane, for instance, is the built-in cc-plugin-diff.

What Can a Claude Code Mod Reach on My Machine?

A Claude Code mod can read and write any file your user account can, start programs, make network requests, read environment variables and settings files (including API keys stored there), see every prompt and tool call in the session, and approve a tool call before you are asked, according to Anthropic’s mods documentation as of October 2026.

When I checked the “What a mod can reach” list in the docs, I found that it is unusually blunt for vendor documentation. It doesn’t soften anything. Here is the full list, grouped by how much it should worry a solo developer:

Table: capabilities from Anthropic’s Claude Code mods overview and plugin security pages as of October 2, 2026; the risk column is our own judgment for a solo developer, not Anthropic’s rating.

One reassuring line in the docs: a mod can restyle much of the interface, but not the permission prompt. It can’t change what that prompt shows you.

The catch is that a mod which approves tool calls may never let the prompt appear in the first place.

Doesn’t the Sandbox Protect Me From a Bad Mod?

No. Claude Code’s sandbox isolates the Bash commands Claude runs, and a process that a mod starts runs outside it, according to the Claude Code plugin security page.

This trips a lot of people up.

If you turned on sandboxing earlier this year, it still does its job for Claude’s own shell commands. It just wasn’t built to contain code that lives inside Claude Code itself. Settings hooks, MCP servers, and anything a mod spawns all sit outside that boundary.

Permission rules have a similar gap. The docs say a mod that approves tool calls can approve one that an ask rule would prompt for, or one your own PreToolUse hook blocked.

How Do I Check What a Mod Does Before Installing It?

Run claude plugin validate on the mod’s directory before installing it: the command lists which events the mod handles and which Claude Code APIs it calls, such as reading a file or making a network request, without running any of its code.

Here’s the full routine, in order:

1. Check where the marketplace came from. Run claude plugin marketplace list and look at the source of the marketplace that lists the mod.
2. Get the files without installing. Clone the plugin’s repository to a scratch folder.
3. Validate it. Run claude plugin validate ./the-mod-folder.
4. Read the two lines that matter. hooks: is what the mod listens to. calls: is what it asks Claude Code to do.
5. List the rest of the plugin. Run claude --plugin-dir ./the-mod-folder plugin details the-mod-name to see any skills, agents, settings hooks, or MCP servers bundled with it.
6. Try it for one session first. Load it with --plugin-dir instead of installing it permanently.

Why does validate work without running the mod? The docs explain that a mod has no way to read a file, start a process, or make a network request except through the mods API. So the list of API calls is, in effect, the list of things it can do.

Honestly, that design is the best thing about the launch.

Which Lines in the Validate Output Should Worry Me?

A Claude Code mod deserves a closer look when its validate output combines a file or environment read with a network call, because that pairing is the shape of credential theft even when the stated purpose is harmless.

Ask yourself whether each call matches what the mod claims to do:

• A UI-only mod that makes network requests. A spinner tweak has no reason to talk to the internet.
• Any mod that approves permissions when its description never mentions permissions.
• A mod that starts processes but describes itself as a display or theme.
• Model calls from a mod that isn’t obviously an AI feature. Those spend your usage.
• Auto-update turned on for the marketplace. The plugin security page notes that files you reviewed can change on disk after a background update.

When I compared the three sample mods Anthropic published in its playground repository, I noticed that each one’s purpose lined up with the kind of event it hooks: blast-radius holds risky shell commands, token-weather draws above the prompt, and replay-theater adds a /replay command. That match between description and behavior is the thing to look for in any third-party mod.

How Do I See Which Mods Are Running Right Now?

Run /plugin at the Claude Code prompt: a dim line under the tabs shows the count and names of the mods the current session loaded, for example “1 mod active · first-mod”.

That line leaves out built-in mods. To see those, open the Installed tab in /plugin and look under Built-in. As of October 2026 the list includes cc-plugin-diff, cc-plugin-agents-md, cc-plugin-telemetry, and, on managed setups, cc-plugin-sec-default.

If you installed a mod from your shell while a session was open, it won’t appear until you run /reload-plugins or restart.

How Do I Turn Mods Off If Something Looks Wrong?

Claude Code gives three switches for user-installed mods: disable or uninstall one plugin from the Installed tab in /plugin, start a single session with --safe-mode, or set "disableAllHooks": true in ~/.claude/settings.json to stop every installed mod in every session.

Table: switches documented in the Claude Code mods overview and plugin security pages as of October 2, 2026. None of them stop built-in mods.

One leftover from early access to clean up: if you set CLAUDE_CODE_ENABLE_FUNCTION_HOOKS during the preview, remove it. Anthropic’s docs say v2.1.287 and later ignore it, so setting it to 0 does not keep mods off.

Uninstalling also leaves the plugin’s files in ~/.claude/plugins/cache/ for 14 days before a background sweep removes them. Delete that folder yourself if the mod was clearly malicious.

Is a Team or Enterprise Plan Safer for Mods?

Somewhat: on Team and Enterprise organizations, and on machines with managed settings, Claude Code loads a built-in guard called sec-default first, which keeps managed settings, deny rules, managed instructions, and settings hooks out of reach of user-installed mods.

It is not a firewall. The sec-default README says that everything else, including tool calls, file and network access, and UI events, “passes through untouched.”

Admins get two stronger options in managed settings. allowManagedModsOnly means only organization-deployed and built-in mods load. A separate option, allowModsToOverrideDenyRules, stays off unless it’s set to the literal value true.

On a personal Pro or Max plan, none of that exists. You are the security review.

Tips

• Keep a scratch folder just for cloning and validating mods. Never validate inside a repo that holds secrets.
• Move API keys out of plain .env files in projects where you test new mods. A mod can read environment variables and settings files.
• Prefer mods from claude-plugins-official or the community marketplace, which pins nearly every entry to a commit SHA.
• Turn off auto-update for any third-party marketplace whose mods you reviewed by hand.
• Re-run claude plugin validate after every update, not just the first install.

Warnings

• Don’t treat the sandbox as protection against mods. Processes a mod starts run outside it.
• Don’t assume a mod is harmless because it “only changes the UI.” Check its calls: line.
• Mods also run in claude -p and Agent SDK sessions, where nothing they draw is visible. A headless pipeline can be affected by a mod you forgot you installed.
• The mods API is new. Behavior described here reflects the documentation as of October 2, 2026 and may change between releases.

FAQ

Do I have to turn mods on in Claude Code?

No. Mods are on by default in Claude Code v2.1.287 and later. Nothing runs until you install a plugin that contains a mod, apart from the built-in ones like the /diff pane.

Can a Claude Code mod change the permission prompt?

No. Anthropic says a mod can restyle much of the interface but not the permission prompt. It can, however, approve some tool calls before the prompt would appear.

Does –safe-mode turn off built-in mods too?

No. The –safe-mode flag, –bare, and disableAllHooks stop the mods you installed. Built-in mods such as the diff pane keep running and are turned off individually in /plugin.

Sources

• Claude Code Docs — Mods overview
• Claude Code Docs — Plugin security and trust
• Anthropic on GitHub — sec-default README

Fact-checked against Anthropic’s Claude Code documentation (mods overview, plugin security and trust) and the sec-default source README as of October 2, 2026. Commands and defaults may change in later Claude Code releases.