Mods for Claude Code: Anthropic Lets You Under the Hood
What has always annoyed me about Claude Code is how it prints colorful diffs while it works, diffs I don’t want to read. But there was no way to hide them. Until now: Anthropic has introduced mods, which let you properly rebuild the interface.
On October 1, Anthropic launched mods (the name is borrowed from computer games). They are small TypeScript or JavaScript functions that run right inside Claude Code and can change almost anything the program does or draws on screen. They work in the command line and in the desktop app as of version 2.1.287, and they are enabled out of the box, with nothing to switch on.
What a mod can do
A mod can rewrite your prompt before it reaches the model. It can stop a dangerous command, ask you, and only then let it through. It can scrub passwords and keys from a tool’s output before the model reads them. It can approve a permission request for you. And it can draw: a panel next to the conversation, a strip above the prompt, buttons, text fields.
The most interesting part is that it can also redraw what Claude Code itself draws. The line with a tool call, the spinner, the dialog in which Claude asks you something. In the discussion of the proposal, Anthropic showed a mod that hides sensitive values in the desktop app until you hover over them with the mouse. Anyone who shares their screen with client data in a training session will appreciate that immediately.
The existing hooks couldn’t do this. They ran a shell script, sent it JSON, and waited for a response. They could block or log an event, but rewriting it, drawing an interface, or replacing a built-in feature was out of reach. The documentation now calls them “settings hooks” so they don’t get confused with mods.
| Mod | Settings hook | Skill | MCP server | |
|---|---|---|---|---|
| Where it runs | inside the Claude Code process | as an external script | text the model reads | separate process or service |
| What it changes | tool calls, prompts, commands, interface | allows, blocks, or logs an event | what the model knows and does | which tools the model has |
| Draws to the interface | yes | no | no | no |
| Written in | JS or TS | anything + an entry in settings.json | Markdown | anything |
A mod is distributed as a plugin, so it is installed and shared the same way: from a marketplace with the command /plugin install. A single plugin can carry a mod, a skill, and an MCP server all at once.
How it works
In plain terms: every Claude Code action fires an event. A tool call, a submitted prompt, the start and end of a turn, a slash command, the rendering of a piece of the screen. A mod hangs a function on the event of its choice.
Functions are chained like middleware in the Express or Koa web frameworks. Your hook receives the event and, by calling next(e), passes it on to the next mod and finally to Claude Code itself. It has three options.
Observe. Let the event pass through unchanged and just look at what happened. That’s how a context-fill meter or a log of all file edits works.
Rewrite. Pass along a modified version, such as a safer command or a prompt extended with company conventions.
Respond. Never call next at all and handle the matter itself. It rejects the command, or answers a slash command with its own code without involving the model.
Everything a mod does outside its own code (reading files, launching processes, calling the network, drawing, calling the model) goes through a single object named $ (the author of the proposal admits in the discussion that he was inspired by jQuery and declares the dollar sign non-negotiable). Thanks to this, the command claude plugin validate lists which events a mod responds to and what it calls, without you running it. Before installing someone else’s mod, that’s the first thing you should do.
You don’t even have to write a mod yourself. Claude Code has a built-in skill for writing mods, so it’s enough to describe what you want to see. For example, I said I didn’t want to see those diffs, and just to be safe I took a screenshot of them for it. Claude Code then writes the mod, installs it, and reloads it at runtime. Every subsequent save of the file takes effect immediately, with no restart.
This mod of mine shows me which phase of its run Claude Code is in and how fast my token consumption is… that I threw out the diffs, you can’t see, because they’re simply not there :)
This isn’t something you bolt on on the side
Now to what interested me most about the whole thing. Mods look like a rebuild of the program so that it can be reached into from the outside.
For a mod to redraw a spinner or the line with a tool’s result, every such part of the interface has to fire an event when it renders and let others have a say in it. Claude Code is written in React, and the author of the proposal cites that as the reason they went this way. But the fact that a program uses React doesn’t mean every component can hand its rendering over to foreign code. That is done component by component. One of the users in the discussion counted that the type declarations for mods already had over 10,000 lines and 84 different events in version 2.1.272.
Second: all side effects have to flow through $. Otherwise the validator wouldn’t know what a mod does, and admins at companies couldn’t take individual capabilities away from mods. Reading files, launching processes, the network, and calling the model all had to be squeezed through one bottleneck.
Third: Anthropic is converting its own features into mods. Loading AGENTS.md, the /diff panel, telemetry, and the sec-default security guard are already mods, and their source code is on GitHub along with tests. The company says it wants to eventually shrink Claude Code down to a small core to which you add only what you want.
The details reveal that this is a construction site still in progress. When you turn off the built-in mod for /diff, the command doesn’t disappear: the original, hard-wired version answers it. So the two live side by side for now. Careful, this is a different feature from what I wanted to build; this panel simply shows on the right which files have changed.
Users in the discussion also found parts of the interface that fire no event at all (for example, the notification about finished background tasks or the list of running sessions), so a mod can’t reach them. And between the publication of the proposal in early September and the release, more than twenty versions went by, with the first week bringing a lot of breaking changes, according to the author.
Anthropic nowhere says it rewrote half the program. That’s my guess based on what’s visible from the outside. But this isn’t something you do in an afternoon.
What to watch out for
A mod runs with your permissions. The documentation says it bluntly: it can read and write files, launch programs, send data over the network, read environment variables including API keys, see every prompt of yours, approve a tool call before Claude Code asks you, and spend your plan. The mod’s code does run in an isolated environment without Node.js, but through $ it gets everything it needs. And if you enable the sandbox for commands that Claude runs, a process launched by a mod runs outside it.
Installing someone else’s mod is therefore the same as installing someone else’s npm package with access to everything. One developer put a scanner on GitHub: of 31 mods found, 14 can launch processes on your computer. That doesn’t mean anything bad by itself; a pull request tracker simply has to call gh. But reading the code beforehand is worth it.
A slow guard lets everything through. A hook has a limit of 10 seconds of its own runtime per event. If it exceeds that or crashes on an error, Claude Code skips it and the event passes through as if the hook weren’t there. The documentation admits this openly, and for the sample mod that holds a dangerous command it states outright that after the timeout expires, the command is executed. A security mod can thus be knocked out simply by being slow. A defense exists: a rescue function can be attached to the hook, which has one second to return a rejection instead of letting the event through. But the mod’s author has to remember to do that himself; the default behavior is to let it through.
One thing, on the other hand, is handled well: a mod must not redraw the permission request dialog, so it can’t slip you different text than what you are actually approving. On top of that, companies on the Team and Enterprise plans get sec-default, which loads first and forbids user mods from, for example, bypassing deny rules in permissions.
Drawing works only in the terminal and in the desktop app. In the VS Code extension or in non-interactive claude -p, hooks run, but you won’t see anything a mod draws.
What to take away from this
The community has already had its fun. Someone got the 1993 Doom running above the prompt, so you can play with other vibecoders while your prompt finishes; another stuffed into a mod a language model with 260 thousand parameters that writes fairy tales about whatever Claude is currently working on. Nice toys. What interests me is something else.
With this step Claude Code turns from a finished product into a platform. For a vibecoder, it means that a minor annoyance that has bugged him for months can be fixed by himself with a one-sentence prompt. For a company, it is finally a place to enforce its own rules: confirmation before touching production configuration, a log of everything the agent does, customer data hidden during screen sharing.
The price is an ecosystem of add-ons with full rights to your computer. We’ve been through this once before with browser extensions, and it didn’t always end well. On top of that, the API is still going to move (the type declarations are generated for a specific version of Claude Code), so whoever writes a mod today should expect to maintain it.
For me, a good direction. I would just install other people’s mods as carefully as other people’s code from anywhere else.
Sources: Anthropic’s announcement and the guide to building your first mod from October 1, 2026, the mods documentation, the discussion of the proposal on GitHub. The hook limit and the behavior after it is exceeded come from the official reference. The event count and the size of the type declarations come from users’ measurements on the demo version 2.1.272. Status as of October 2, 2026, Claude Code 2.1.287. The mods API changes with every version.