Anthropic shipped mods for Claude Code on October 1, giving users a way to change both the interface and the behavior of the coding agent by describing what they want in plain language. Claude then writes the code. The important shift is from asking to enforcing: an instruction in a prompt is a request the model can occasionally ignore, while a mod is code that steps in right before Claude acts and makes a rule stick every time. That power comes with a catch. Mods run without a sandbox, an isolated environment that limits what code can touch, so they carry the full permissions of the user who installs them.
What mods can change
Boris Cherny, who created Claude Code, said developers can now customize its interface and behavior through natural language prompting alone. Anthropic’s official announcement passed 4 million views, and Cherny’s post passed 800,000. A Claude Code engineer at Anthropic described the idea as software becoming malleable: users can reshape interfaces and behaviors to fit how they work.
One way to picture the change is renting an office versus owning the building. As a tenant, you can bring in files and write rules on a whiteboard, but you cannot knock down walls or add locks without the landlord’s permission. Mods move users closer to owning the building. They do three broad things:
- Add to the screen: draw status lines, panels or widgets around the prompt box.
- Change outgoing requests: adjust what Claude is about to do before it runs.
- Hold actions back: stop risky operations until the user approves them.
Early examples show the range. One mod puts a bar above the prompt showing how much of the context window, the amount of conversation the model can hold at once, has been used, along with token usage per turn. Another stops an rm -rf build command and lists the files that would be deleted before anything happens. Someone even made a mod that runs Doom in the terminal while Claude works.
Prompts, skills and mods are different layers
All three tell Claude what to do, but they work at different levels.
| Layer | What it does | How firmly it applies |
|---|---|---|
| Prompt | A one-time instruction | Only for that request |
| Skill | Reference instructions and domain knowledge, such as how to style a proposal draft, that Claude consults when relevant | The model decides whether to follow it |
| Mod | Changes the Claude Code client itself and intercepts actions in code | Hook code runs automatically every time |
Anthropic’s documentation makes the point directly: system prompt instructions are requests, not guarantees. A rule such as “never send an email without asking” can slip. Mods rely on hooks, code that runs automatically at set moments, so the rule is enforced by the program rather than by the model’s compliance.
Mods work only in the Claude Code terminal app and the Claude Code tab of the desktop app, and they require Claude Code version 2.1.287 or later. They do not work in the regular Claude web chat.
▲ How prompts, skills and mods differ
Start with your own session history
Generic lists of community mods may not match how you work. A more useful starting point appears to be your own usage. Claude Code saves every session as local JSON files in the hidden .claude/projects directory. You can ask Claude to analyze the last 14 days of those sessions and look for three patterns:
- Prompts you repeat across sessions
- Risky or irreversible commands, such as deletions and sends
- Requests where you asked for manual review
For each pattern it finds, Claude decides whether a mod, a skill or a single instruction line is the right fix, then ranks the options by time saved and usefulness before writing any code. Because the analysis starts from real behavior, the recommendations fit the individual.
Three mods worth building
A guard that asks before deleting
The first mod catches file deletions. The request is simple: make a mod that holds any delete command and asks first with two buttons, Run it and Cancel. Claude writes the TypeScript plugin hooks, writes test cases, runs them and then hands the mod over. It also offers to turn on hot reloading, which applies new code inside the current session without a restart, so the mod can be tried right away.
In a test, asking Claude to delete a folder of old drafts on the desktop brought up a confirmation box above the prompt with Run it, Cancel and Other. Choosing Cancel blocked the command entirely. The folder stayed where it was, and Claude recorded that the deletion had been declined.
A guard that asks before sending
The second mod requires approval before anything goes out. Telling Claude to only draft emails in Gmail is still just a request. This mod holds any tool call whose name contains send, reply, forward or publish, shows a confirmation dialog and falls back to saving a draft if the user cancels.
When asked to send a test email to a second Gmail account, Claude did not send it. Instead, a dialog showed the app, the recipient, the subject and the choice to send or cancel. Choosing Send it delivered the message. Because the mod matches verbs in tool names, the same guard covers Slack, Microsoft Teams and social publishing tools.
A receipt line that shows what Claude looked at
The third mod adds a line above the input box after every turn, counting web pages visited, searches run, files read and other tool calls. Asked to check the Claude Code mods documentation and summarize it in three lines, the receipt showed one web page (docs.claude.com), one search, zero files read and zero other tool calls. Asked what 12 times 12 is, it reported that nothing was opened and that the answer came from memory or from earlier in the chat. That makes it easy to tell at a glance where an answer came from.
From one session to every session
A mod built in a conversation loads only in that session by default. To keep one, tell Claude: “Keep this mod so that it loads in every new session, not just this one.” Claude then updates the global hook configuration, and the mod loads in every new workspace tab.
Redrawing the interface and adding a second agent
Anthropic’s documentation shows that mods can go well beyond guards.
- Interface changes: redesign the thinking spinner and action banners, or add side panes and input widgets.
- Routing: step in before execution to send light queries to a cheaper model and complex work to a frontier model.
- Slash commands: run terminal code or a predefined workflow immediately, without waiting for Claude to process the request.
- Second agents: run an agent alongside Claude. Anthropic released one called You Should Know that watches Claude’s code as it is written. When Claude added automatic retries to a payment call, it inserted a warning that retries could charge a customer twice.
Some of Claude Code’s own features, including the diff viewer and the AGENTS.md instruction loader, are built as native mods. Anthropic plans to turn more built-in features into modules over time so developers and IT administrators can switch components on and off and apply company policies centrally.
▲ The risk of mods running with user permissions
Why third-party mods deserve caution
Mods are riskier than skills. A skill is guidance Claude reads. A mod is executable code that runs inside Claude Code with the user’s system privileges. Without a sandbox, a malicious mod could:
- Read environment variables, API keys and private files, and send data over the internet
- Launch arbitrary programs
- Alter chat sessions or quietly rewrite prompts
- Approve tool actions on the user’s behalf or use up API quotas unnoticed
Mods cannot change Claude Code’s built-in permission prompts, but they can draw convincing buttons and text boxes above the prompt area. Never type passwords, API credentials or private access keys into any box a mod draws.
The skills ecosystem offers a warning. When security company Snyk analyzed nearly 4,000 publicly shared skills, more than one-third contained serious vulnerabilities or code designed to steal credentials. Mods could follow the same path, with higher stakes.
Even a well-built delete guard is a safety net, not a firewall. Anthropic notes that these mods parse command patterns, so a deletion written in unusual command syntax might slip past the hook.
How to start with mods safely
Mods appear to fill a real gap: they turn rules that prompts could only request into rules the software enforces. Because they run with your permissions, the safest default is to build your own.
- Update Claude Code to version 2.1.287 or later.
- Ask Claude to analyze the last 14 days of sessions in .claude/projects and flag repeated work and risky commands.
- Describe the mod you need, such as a delete or send guard, and ask Claude to write and run tests before handing it over.
- Turn on hot reloading, try the mod in the current session, then ask Claude to keep it for every new session.
- Before installing anyone else’s mod, run claude plugin validate with the mod’s path in the terminal. It lists the events the mod listens for and the capabilities it calls without running the code, but it checks only the manifest and hook declarations and cannot catch separate scripts bundled in a download. Use mods only from creators you trust.
- If a mod misbehaves, open the plugin menu, select it under Installed and press Space to turn it off. To troubleshoot, start Claude Code in safe mode, which disables all mods, external skills and connected tools for that session.
The most reliable approach is to have Claude generate the mod and explain each line of its code, rather than importing files you have not reviewed.