Claude Code Adds mods: TypeScript Functions in Plugins Change Its Behavior and Interface

On October 1, 2026, Anthropic introduced mods (small programs that change how Claude Code behaves and looks): functions written in TypeScript or JavaScript that ship inside a plugin and run inside the Claude Code process. Anthropic says they work in both the CLI and the desktop app.

The information in this article was checked on October 4, 2026, against Anthropic's blog and three documentation pages. This site has not installed or run any mod; the features and limits below are Anthropic's account.

What mods are: functions inside a plugin that run in the Claude Code process

Anthropic says Claude Code emits an event each time it does something, and a mod is a function hooked onto an event that runs before it, after it or instead of it. The documentation says a small mod has three files: .claude-plugin/plugin.json, hooks/hooks.json and hooks/register.js; the modules key in hooks.json points to the code file, and having it is what makes the plugin a mod.

The documentation says Claude Code calls both kinds hooks: a shell command, HTTP request or prompt in a settings file, called a settings hook below, and a handler function that runs inside Claude Code, called a mod's event handler.

When a mod loads, Claude Code calls register(on), and the mod uses on to register event handlers; each handler receives $ (the mods API), e (the event data) and next (which passes the event on to the other mods and then to Claude Code's original behavior). The documentation lists three ways to handle an event: observe, rewrite, and answer (the mod handles the event itself, and the usual behavior does not run).

What they can do: rewrite prompts, manage tool calls, draw interface, add commands

Anthropic lists these abilities: rewrite a prompt before it reaches the model; block, rewrite or retry a tool call; approve or deny a permission request; redact secrets from tool output before Claude reads it; and edit or replace part of the interface and add buttons and inputs. The documentation adds that a mod can draw a pane or a band above the prompt and add a /command that runs without a Claude turn.

When several mods hook the same event, they run in the order they load; the first mod to load sees the event first and the result last. The built-in /diff is now a mod: it can be turned off in /plugin or replaced with your own version, and the documentation says /diff stays after it is disabled, with the built-in version answering it. Anthropic says settings hooks can't rewrite events, draw new interface or replace features, while mods can; the documentation says settings hooks keep running and none of them is deprecated. Of the four in the table below, only a mod can draw interface.

Where they fit: team controls and example mods

The blog gives three examples of what teams can build with mods themselves: show CI/CD status in a pane beside the conversation; require confirmation before any command touches production config; and have the mod that loads first record every call that every other mod makes.

The documentation's three example mods are in the claude-code-playground repository, shared as they are without support: token-weather draws a forecast of the context window above the prompt; blast-radius holds a risky command such as rm -rf or a force push and shows what it would change; replay-theater adds a /replay command that steps through the file edits Claude made in the last turn.

Built-in mods are listed under Built-in on the Installed tab of /plugin, for example cc-plugin-diff, which takes over /diff, and cc-plugin-sec-default, covered in the last section; cc-plugin-you-should-know is disabled by default, and the documentation says it is listed only "if available for your org".

Getting started: version, installation, asking Claude to write one or writing your own

The documentation says mods require Claude Code v2.1.287 or later and are on by default; check with claude --version. The blog says you can install a plugin that includes mods from the Claude directory or by running /plugin in the CLI; the documentation gives the format /plugin install name@marketplace.

Writing one yourself needs no Node.js or build step; claude --plugin-dir with a directory loads it for one session only and hot-reloads when a file changes. When you ask Claude to write one, the documentation says it follows the built-in plugin-authoring skill, writes the mod in the session's folder under ~/.claude/dev-mods/, and loads it only after you approve; Claude Code deletes that folder once it is older than cleanupPeriodDays.

Before installing someone else's mod, you can get the plugin's files and run claude plugin validate, which lists the events it handles and the methods it calls without running the mod.

The documentation says a mod's interface is drawn in the terminal and in the Code tab of the Desktop app (the Code tab cannot draw elements that are terminal-only); a WSL session in the Desktop app cannot use plugins, so event handlers do not run; in the VS Code extension's chat panel, claude -p, the Agent SDK and cloud sessions (only for a plugin that reaches the cloud session), event handlers run but nothing is drawn; with Remote Control, event handlers run in the session on your computer and draw in the terminal on your computer.

Security and enterprise controls: no sandbox, and what administrators can do

The documentation says mods are not sandboxed and run with your permissions: they can read environment variables and settings files (including an API key in either), approve a tool call before you are asked, and call a model on your plan or API key, but they cannot change the permission prompt itself; with sandboxing on, only the Bash commands Claude runs are isolated, and a process that a mod starts runs outside the sandbox.

The built-in sec-default loads when the machine has managed settings or when the user is signed in with a Team or Enterprise plan; for someone using an API key or Amazon Bedrock, Google Cloud or Microsoft Foundry, it loads only on a machine with managed settings. It only stops a user's mod from changing what administrators manage (for example what managed settings hooks receive and decide, and the system prompt) and from approving a tool call that a deny rule refuses, and allows everything else; deny rules also do not cover a mod's own $.fs and $.process calls.

Administrators' switches include: allowManagedModsOnly blocks mods that users bring; disableSideloadFlags rejects --plugin-dir, --plugin-url and mods Claude writes in a session; prependPlugins and appendPlugins set the order of the organization's mods, and setting prependPlugins requires listing sec-default@builtin to keep the built-in guard; disableAllHooks in managed settings stops even the organization's mods and managed settings hooks.

Individuals can disable a single mod on the Installed tab of /plugin, use --safe-mode to turn off installed mods for one session (other customizations stop too), or set disableAllHooks in ~/.claude/settings.json (settings hooks and a custom status line stop too, while what the organization manages keeps running); the last two do not stop built-in mods.

2026 AI News Roundup: Highlights and Daily Life Applications from January to September

Claude Sonnet 5.5 Launches: Same List Price as Sonnet 5, Available in the API, on Cloud Platforms and in Claude.ai

• AI tools
• Apps & software
• AI news