Claude Code Can Now Be Modded. The Mods Run With Everything You’ve Got.

TL;DR: Anthropic shipped Claude Code mods on 1 October — small TypeScript functions, delivered inside plugins, that can rewrite prompts, replace built-in features and redraw the interface. They’re genuinely useful and you can ask Claude to write one for you. The sentence to read twice is Anthropic’s own: “Mods run with the same access to your machine as Claude Code itself. They aren’t sandboxed.” One day later, Apple said it’s tightening macOS Full Disk Access because of AI agents. Those two things are the same story.

What Claude Code mods are

Anthropic announced mods on 1 October, describing them as “small TypeScript functions that change how Claude Code works.”

A mod can “rewrite a prompt, add new UI, replace a built-in feature, or add entirely new functionality.” In practice that means intercepting what happens inside the tool: rewriting prompts, blocking or retrying tool calls, approving or denying permissions, redacting secrets, redrawing parts of the interface.

They arrive the way everything else does: “Mods ship inside plugins, so you install and share them like any plugin. They work in the Claude Code CLI and desktop app.” The CHANGELOG puts them at v2.1.287 — “Added Claude Mods: plugins may now modify deeper behavior” — alongside a built-in example called “You should know”, described as “a side agent watches your back and flags things you or Claude might miss.”

Anthropic is eating its own cooking: it moved the `/diff` feature into a mod and says more built-ins will follow, so Claude Code mods are not a side feature bolted on — they are becoming how the tool is built.

And you don’t have to write TypeScript to get one. Anthropic’s own line: “You can write a mod yourself, or ask Claude Code to write one for you.” Which is the bit that turns this from a developer feature into something our readers will actually end up using.

The Claude Code mods sentence to read twice

Here it is in full, from Anthropic, unedited:

“Mods run with the same access to your machine as Claude Code itself. They aren’t sandboxed, and you should only install mods from sources you trust, the same way you’d install any code on your computer.”

Credit where it’s due: that’s about as plain as a vendor gets. No burying it in a FAQ, no “we take security seriously”. It’s in the launch post.

But plain language only helps if you understand what it means, so: Claude Code mods inherit everything you’ve given Claude Code. Not a subset. Not a sandbox with holes in it. The same reach.

If Claude Code can read your files, a mod can read your files. If it can run commands, so can a mod. If your environment holds API keys, those are in scope too. “The same way you’d install any code on your computer” is the correct mental model, and it is a much higher bar than most people apply to installing a plugin.

There is one guardrail worth knowing: a mod can restyle most of Claude Code’s interface, but not the permission prompt itself. That’s a deliberate and sensible line — the thing that asks “can I do this?” can’t be redrawn by the thing asking.

One day later, Apple moved

This is why Claude Code mods are a bigger story than one tool’s plugin system.

On 2 October, Apple told developers it is introducing “additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action.”

The access in question is Full Disk Access — which, as TechCrunch notes, covers your files, messages, mail and browsing history. Apple’s stated reason is not subtle:

“As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially.”

And on why now: “some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems… without users’ full knowledge and understanding.”

Apple did not say which macOS version, or when. That’s a real gap in the announcement and worth knowing before you plan around it.

But the timing tells you something on its own. In the same week, one company made its AI tool more extensible and another made the operating system underneath it more suspicious. Both are responding to the same fact: these tools now reach a long way into your computer, and the number of things running inside them is going up.

Who this is actually for

Honest answer: mostly not you, yet — and that’s fine.

Writing a mod means writing a TypeScript function that hooks into internal events. If that sentence means nothing to you, you are not the target audience for authoring one, and no amount of “ask Claude to write it” changes the fact that you’d be installing code you can’t read.

Installing one is a different matter, and that’s where this touches our readers. Plugins are easy to install, they’ll start appearing in lists and threads with screenshots of clever things they do, and the install step will feel like adding a browser extension. It isn’t. A browser extension is sandboxed. Claude Code mods are not.

Claude Code mods make that distinction matter. The useful parallel is our piece on an AI coding tool that uploaded entire projects — the problem there wasn’t malice, it was that the tool’s reach was wider than anyone assumed. Same shape here, one layer up.

What to do today

1. Audit what you’ve granted Full Disk Access to. On a Mac: System Settings → Privacy & Security → Full Disk Access. Most people have never looked. Some of what’s in there will surprise you.
2. Revoke anything you don’t recognise or no longer use. You can always grant it again when something breaks. That’s a better default than leaving it on for an app you installed in March.
3. Treat Claude Code mods like installing software, not like adding a setting. Who wrote it? Can you see the source? Would you run their script on your laptop? If the answer to the last one is no, don’t install their mod.
4. Try the built-in one first. `claude plugin enable cc-plugin-you-should-know@builtin` gets you Anthropic’s own “You should know” mod — a safe way to see what the category does before trusting a stranger’s.
5. If you’re on a Mac, expect the prompts to change. Apple hasn’t said when, but when a tool suddenly asks again for access it used to have, that’s this — not a bug.

Who should care (and who shouldn’t)

• Using Claude Code daily: this is a genuine capability upgrade and worth exploring. Start with the built-in mod, and apply the “would I run their script” test before anything else.
• Tempted by a clever mod you saw someone post: that’s exactly the moment to remember Claude Code mods aren’t sandboxed.
• On a Mac and running any AI tool locally: do the Full Disk Access audit regardless of whether you care about mods. It takes two minutes and it’s overdue.
• Using a browser-based builder like Lovable or Replit: none of this reaches you directly — your tool runs on their machines, not yours. The trade-off is the one we wrote about when a framework flaw hit hosted apps: less reach into your computer, less control over the stack.
• Running vibe coding tools on a work machine: check your employer’s policy before installing anything that isn’t sandboxed. This is the kind of thing IT departments have opinions about.

Our take

We think Claude Code mods are good, and we think the warning attached to them is doing a lot of work.

Good, because the alternative to extensibility is a tool that does what one company thought you’d want. Claude Code mods are the natural next step after Projects made it run work in parallel — the tool is becoming a platform, and platforms need to be shapeable.

But “only install from sources you trust” is advice that has failed in every ecosystem that has ever tried it. Browser extensions, npm packages, app stores — the pattern is always the same: it works until the thing you trust gets bought, compromised or abandoned. Anthropic is being straight with people; it just isn’t a solution, and nobody should read that sentence as one.

The honest read is that this is a trade, and it’s a reasonable one to accept with your eyes open. You get a tool you can reshape. You accept that anything you install into it has your permissions. Apple’s announcement a day later is the platform owner quietly agreeing that this trade is becoming a big deal.

What we’d actually do: use the built-in mod, write your own if you’re able, and treat anyone else’s as software rather than as a setting. Then go and look at that Full Disk Access list, because whatever you decide about Claude Code mods, that list is already longer than you remember.

Not sure which AI tool fits what you’re building — on your machine or in a browser? Take the 60-second Vibe Coding Tool Finder quiz →

FAQ