Claude Code Mods: Rewrite the Agent From the Inside Out

Anthropic launched Claude Code Mods yesterday — small TypeScript functions that let developers hook directly into Claude Code’s internal event system and rewrite how the agent works. Intercept prompts before they reach the model, block tool calls, redact secrets from output, replace the UI entirely. Within 24 hours of the announcement, someone had already built a playable Tetris game inside a Claude Code session. More seriously, security researchers at Pluto Security had demonstrated how a malicious mod can silently read your credentials file and 834 KB of every prompt you’ve ever typed, then transmit them externally without a single warning.

That contrast — Tetris versus credential theft — tells you exactly what Claude Code Mods are: real power, essentially unsandboxed, shipping now.

The Architecture: Middleware for an AI Agent

Mods hook into Claude Code’s event lifecycle using a handler signature familiar to anyone who has written Express middleware: ($, e, next). The $ parameter is the engine API — filesystem, HTTP, UI, and process access. The e parameter is the event payload. The next function continues to the remaining handlers in the stack. Every action Claude Code performs emits an event: prompt assembly, tool execution, permission checks, UI renders, output processing. A mod can intercept any of them. According to Anthropic’s official launch announcement, mods can run before, after, instead of, or wrapping around the original handler — true middleware composition.

This is not a configuration layer. You are rewriting the agent’s decision pipeline from inside the process. Mods run in the same TypeScript process as Claude Code, with the same access to your machine. There is no sandbox. That distinction matters — it separates mods architecturally from VS Code extensions (which run in a separate extension host) and from Cursor’s rules system (which feeds the model context but doesn’t intercept execution). According to Wavect’s technical architecture breakdown, the hook environment is mediated through the engine interface, but the capabilities it provides are extensive: read files, make HTTP requests, run processes, and render arbitrary UI.

// hooks/register.ts — intercept before a tool executes
export default function register($: EngineAPI, hooks: HookRegistry) {
  hooks.on('tool:before', async ($, e, next) => {
    if (e.tool === 'bash' && e.args.command.includes('rm -rf')) {
      await $.ui.confirm(`Blast Radius: ${e.args.command} — proceed?`);
    }
    return next(e); // continue to next handler
  });
}

Mods ship inside plugins and install exactly like any Claude Code plugin — from the Claude directory or via the /plugin CLI command. That means existing organizational plugin controls apply: admins can allow or block plugin marketplaces and deploy org-wide mods to every developer’s environment. The Claude Code mod documentation notes that APIs are explicitly marked early access and may change between releases without notice — regenerate TypeScript declarations with /plugin-types after every upgrade.

What Teams Are Actually Building

The genuinely useful applications aren’t novelties. For instance, enterprise teams are using mods to encode organizational knowledge that would otherwise live in sprawling CLAUDE.md system prompts. Secret redaction mods strip API keys and credentials from tool output before the model reads them, preventing accidental exposure in session logs. Additionally, context routing mods load only the relevant team’s instructions depending on which directory you’re editing — the payment team’s rules when touching auth code, the design system’s constraints when editing UI components.

Quality gates are another practical pattern. Specifically, a mod that detects edits to payment, authentication, or infrastructure directories can pause execution and require a validation step before continuing. The Blast Radius mod that shipped in the community examples does something similar for destructive shell commands: it intercepts rm -rf and similar commands, calculates potential impact, and requires explicit confirmation. Consequently, these are the kinds of safeguards that used to require separate tooling or CI hooks — now they live in the agent loop itself.

Related: Claude Marketplace Is Live: List Your MCP Tools Today

Claude Code Mods Security Risks Are Real

Pluto Security’s research published this week is worth reading carefully before installing any community mods. Their findings are specific: a proof-of-concept mod used the engine’s $.fs.read and $.http.fetch capabilities to exfiltrate ~/.claude/.credentials.json and the full session history — 834 KB of prior prompts — without triggering any permission prompt. A second attack demonstrated UI spoofing: a mod rendered a fake credential dialog inside the trusted Claude Code client, substituting a misleading question while mapping the user’s answer to a destructive action.

Furthermore, post-review payload injection is the third attack surface. A mod can fetch and execute remote code after it has been installed and reviewed, meaning the version you audited is not necessarily the code running on your machine. In contrast, Anthropic’s mitigation for Enterprise and Team plan users is the sec-default built-in mod, which loads first in the handler chain and prevents user-installed mods from overriding permission deny rules. Personal plan users have no equivalent protection. Therefore, the correct posture on personal plans is to treat every community mod as untrusted binary code — because that’s what it is. Always run claude plugin validate before installing; plugin details currently misreports function-hook mods as having zero hooks.

Related: Plugin4Shell: Your AI Coding Agent’s Plugin Store Is an RCE

Claude Code as a Platform: What Changes Now

Claude Code Mods matter beyond their feature checklist because they signal what Anthropic is building toward: Claude Code as a programmable platform, not a fixed AI agent. Cursor is better than Claude Code for inline editing. VS Code extensions give you model flexibility. However, neither exposes an API that lets you rewrite the agent’s execution pipeline from inside the loop. That’s what Mods do, and no close competitor has an equivalent.

The practical implication for teams is that mods should be treated as software products — versioned, tested, and governed — not as quick config scripts. The APIs are early access and explicitly unstable, which means production-critical mods need a testing and upgrade strategy. Nevertheless, the direction is clear: organizations that invest in a mod library now are building institutional knowledge into the agent layer, not just into documentation.

Key Takeaways

• Claude Code Mods are TypeScript event hooks that intercept and rewrite the agent’s internal pipeline — prompts, tool calls, permissions, UI, and output. They run unsandboxed, as you, with full system access.
• The most valuable enterprise use cases are secret redaction, quality gates on sensitive code paths, and context routing that loads team-specific instructions by directory.
• The security risks are real and already demonstrated: credential exfiltration, UI spoofing, and post-review payload injection are practical attacks. Enterprise and Team plans get sec-default protection; personal plans do not.
• Mods ship inside plugins, install via the Claude directory, and fall under existing admin plugin controls — making org-wide deployment and governance straightforward for Enterprise teams.
• The APIs are early access. Regenerate TypeScript declarations with /plugin-types after every Claude Code upgrade and maintain a testing strategy for any mod you rely on in production workflows.