Claude Code Mods: Guardrails You Can Ask For

Claude Code mods are small TypeScript functions that change how Claude Code behaves. A mod can rewrite a prompt, block a tool call, approve or deny a permission request, or redact secrets before Claude reads them. Anthropic introduced them October 1, 2026, and they ship inside plugins.

What can a mod change?

Every time Claude Code does something, it emits an event, and a mod is a function attached to one. It can run before the event, after it, or in its place.

A mod can rewrite a prompt, block or retry a tool call, answer a permission request, or scrub secrets from tool output. It can also change the screen: replace a tool result, add a button or input, or draw a status pane beside the conversation.

Mods stack. When several hook the same event, they run in load order.

Can an owner who does not code use mods?

Yes, because the one who writes the TypeScript can be Claude. Anthropic says you can ask Claude Code to create a mod, and it can write the code, install it and hot reload it in your session. That applies to mods Claude Code writes for you in that session. You describe the rule in plain English, then test it before you trust it.

We run Claude Code every day in our own company. The mods worth having in a small shop are guardrails that slow the AI down on purpose where speed costs money.

Which mods fit an AV or trades shop?

Anthropic's own examples include a gate that asks first before a command changes production settings, and a log that records every mod call. Two of the ideas below are ours, not Anthropic features. Nothing ships ready-made for them, so you would ask Claude Code to build each one.

• Ask before it ships (our example). A mod that holds a proposal email until a person clicks approve, so nothing reaches a client on the AI's say-so alone.
• Hide what it should not see (our example). Anthropic's page covers scrubbing secrets from tool output. Asking for the same treatment on client names and addresses is our idea, and you would build and test it yourself.
• Keep a record you can read. This one is from Anthropic's page: a mod that loads first and logs every call. When something looks off, you check the log instead of guessing.

What are the risks?

The risk is the code itself. Mods are not sandboxed, so a mod can reach whatever Claude Code can reach on your computer. Treat it like any software on a work computer.

On Team and Enterprise plans, and on any machine with managed settings, sec-default loads first and stops user-installed mods from doing risky things like overriding your permission deny rules. Admins can load their own mods first, and if they do, they add sec-default to the list to keep those limits.

What to do this week

1. Run /plugin in Claude Code to see what is installed.
2. Pick one guardrail, such as no outgoing proposal or invoice email without a person's click, and ask Claude Code to write it.
3. Test it on a harmless example before it touches a real client thread.
4. Install mods only from authors you know.