Tool Tips · For engineers

What can a Claude Code mod reach once you install it?

A Claude Code mod runs as you. The docs give one command that lists what it hooks, writes and sends without running it. Here is how to read it.

25 Oct 2026 · 6 min read · sources read up to 25 Oct 2026

Seen on Instagram: the post this article goes with.

What can a mod reach once you install it?

A mod is code that runs inside Claude Code (Anthropic's AI coding agent), packaged in a plugin, an add-on bundle. Claude Code's docs say a mod "runs with your permissions" ^[1]. It can read and write files, start processes and make network requests ^[1]. It can read environment variables and settings, which can hold API keys, and see every prompt you type and every action Claude takes ^[1].

A sandbox, the fence around Claude's shell commands, does not cover a mod: the docs say mods aren't sandboxed, and a mod's own processes run outside it ^[1][2]. A catalog (a marketplace) is a list Claude Code installs plugins from, and anyone can publish one. Its name says who publishes it, not what a plugin does, and Anthropic says it cannot verify what third-party plugins contain ^[6].

Example, not a real incident: a teammate shares a small helper in the team chat. It counts how much usage each task burns, and the name sounds harmless. Once you install it, it runs as you, next to your repo and your keys.

The habit fits in one sentence: before you install an agent mod, list what it hooks, writes and sends. This article covers Claude Code only.

The three questions in plain words

• What does it hook? A hook is a function a mod runs when something happens in Claude Code, such as you submitting a prompt ^[3]. The hooks a mod registers decide what it gets to see.
• What does it write? The files it saves, plus its own stored data, which stays between sessions on your machine ^[4].
• What does it send? Anything it passes on: network requests, programs it starts, and messages or prompts submitted as you ^[1][2].

These are mod hooks. Claude Code also has hooks you set in settings; those are shell commands, a separate thing ^[9].

One command lists all three

The docs give a command that prints a mod's hooks and calls without running the mod ^[1][2]. Clone the mod's repository, then point the command at the folder:

git clone <the mod's repository> some-mod
claude plugin validate ./some-mod

Cloning only downloads the files. In an interactive session, Claude Code loads no mod from a folder you haven't trusted until you answer its trust prompt ^[2]. The command prints a hooks: line, a calls: line and an env reads: line ^[2]. Read hooks: for the first question and calls: for the other two.

Can you trust those lines to be complete? The docs say a mod reaches files, processes and the network only through the mods API, and Claude Code refuses to load a mod whose use validate can't read ^[2][4]. That is the docs' claim. We have not run the command, so we cannot say how its output reads in practice.

What to look for on each line

Match each line to a question. These are the entries the docs say to look for ^[2].

A prompt.submit hook reads every prompt you type, word for word ^[3]. A tool.call hook sees each command's arguments before it runs, and what comes back ^[3]. Neither is suspicious on its own: a mod that watches your session has to hook them.

Does the answer fit the job?

The lines tell you what a mod can do, not whether it should. Compare them with the job it advertises. A usage counter has a reason to see every prompt and action, because that is what it counts, and to keep its own stored data. It has little reason to call http.fetch. A call you cannot explain from the job is a question for the author, or a reason not to install.

Example: a public usage guard, read but not run

agent-usage-guard is a public, MIT-licensed Claude Code mod, published through its own catalog ^[10]. It is a usage guard: it can ask before, or refuse, new agents when your usage runs high ^[10]. We use it to show the questions being asked, not to review it.

We read its README and, as of its 24 October code, the file that registers its hooks and eight of its thirteen core files ^[10][11][12]. We read them on the web. We did not clone, install or run it, and we did not run validate on it.

• Hooks: its code registers hooks for every action Claude takes and every prompt, plus several more ^[11]. A guard watching usage has a reason to hook those two.
• Writes: the files we read show no file writes. In the files we read, it writes only to its own stored data, and its README says the journal holds the time, the rule, the tool name and your answer, never prompt text ^[10][12].
• Sends: its README says it makes no network requests and starts no processes ^[10]. The files we read show neither ^[11][12]. Its code can also resubmit or refill a prompt you typed (prompt.submit), which the table above counts as a send; a guard that holds and retries prompts has a reason to ^[11].

Those are answers to hold against its job, nothing more. They come from the author's README and a partial read of its code, not from a check of everything. Five core files stay unread, and we did not run it ^[12]. We are not telling you to install it, and we are not telling you to avoid it.

What to do with the answers

1. If an answer does not fit the job, do not install the mod.
2. Read the plugin's hooks/hooks.json file and bin/ folder too; the docs list them among the files to review before you install ^[6].
3. Install from inside Claude Code with /plugin install. It opens a details pane first, and the docs say to read the pane before you install ^[7].
4. Check again after every update. With auto-update on, the files you reviewed can change on disk; it is off by default for third-party catalogs ^[6][7].
5. Already installed? Disable it in /plugin, or start Claude Code with claude --safe-mode to work without mods ^[1][6].

What we left out

• Other tools. We read nothing about extensions in other AI coding tools, so this is Claude Code only.
• Your permission rules. How your own allow and deny rules relate to a mod is a separate question; the permissions page covers it ^[8].
• Whether a mod is trustworthy. The lines list what a mod can do. They do not say who wrote it or why.

How we checked

We read every source in the list below on 25 October 2026, and each entry shows its read date. Everything about Claude Code comes from Anthropic's own docs ^[1][2]. Everything about the example comes from its public README and code as of 24 October ^[10][11]. We ran nothing, so nothing here is tested: no mod was installed or loaded, and validate was not run.