Claude Code Adds Mods to Rewrite the Agent's Behavior and UI

Anthropic has added a "mods" system to Claude Code that lets developers change how the coding agent behaves and looks by writing small TypeScript functions. Shipped in version 2.1.287 on October 1, 2026, mods go further than the tool's existing plugins and hooks: they can rewrite prompts, block or retry tool calls, and replace parts of the interface. That makes Claude Code more of an extensible platform, and it also puts unsandboxed third-party code inside a tool that has access to source code and credentials.

What Anthropic shipped

According to Anthropic's announcement, mods are small TypeScript functions that can rewrite a prompt, add new UI, replace a built-in feature, or add entirely new functionality. The company lists several concrete capabilities: modifying prompts before they reach the model, blocking, rewriting, or retrying tool calls, approving or denying permission requests, redacting sensitive data from tool output before the model sees it, and editing or replacing elements of the interface.

Mods are distributed inside plugins, so they use the existing plugin installation flow. The feature is available in the Claude Code command-line interface and the desktop app, and developers can find mods through the Claude directory or write their own using the getting-started guide. The Decoder, which also covered the launch, describes them as middleware that hooks into events such as tool calls, user prompts, and rendering, and reports that they work across the CLI and desktop app and only partially in the VS Code extension. It adds that organizations can control which mods are allowed to load.

First-party examples

Anthropic says some existing features, including the /diff command, are already built as mods. The first official mod plugin, called "You should know," runs a separate agent that watches the conversation and flags information the user may have missed; per the product changelog, it is enabled with the command /plugin enable cc-plugin-you-should-know@builtin and requires telemetry to be on for first-party sessions. A commentary piece on DEV Community lists four built-in mods (/diff, sec-default, telemetry and a test framework); that list comes from the author of that post, not from Anthropic's announcement, so treat it as secondary.

Follow-up releases

The system has already been extended. Version 2.1.288 on October 2 added a $.ui.selection() method for mods, which returns the text last selected in fullscreen mode and, when the selection falls within one transcript row, that row. The same release added agent.spawn for teammates, a single agent identifier across plugin hook events, and idle and waiting states in $.agent.list(), according to the changelog. Version 2.1.289 followed on October 4 with fixes, including one concerning how deny or ask rules on nested parts of compound shell commands interact with a user-installed mod's approval on managed machines.

That last fix is a reminder that the interaction between mods and permission rules is an active area of work. The fix landed within days of launch, which is worth noting for teams that depend on those rules.

Why it matters

Until now, customizing a coding agent mostly meant adding instructions, tools, or event hooks around the edges. Mods put developers closer to the agent loop itself. A team could, for example, redact secrets from command output before it reaches the model, or enforce a house policy on which tool calls are retried. Individual developers can change the interface to suit their workflow, and, as Anthropic's own /diff example shows, the company is willing to build core features on the same mechanism it exposes to everyone else.

The DEV Community post argues that this turns the agent into a platform, with the surrounding harness mattering as much as the underlying model. That is the author's interpretation, not a claim made by Anthropic.

The security trade-off

The more consequential detail is the security model. Anthropic states that mods run with full system access and are not sandboxed, and advises installing them only from trusted sources. The Decoder quotes the same warning in similar terms: mods run with the user's permissions. In practical terms, a mod can see prompts and tool calls and act as the user does on that machine.

For enterprise plans, Anthropic says a built-in security mod named sec-default loads first and is meant to stop user-installed mods from doing risky things, such as overriding permission deny rules. The announcement describes its purpose in those words; it does not publish a full list of what the mod blocks, so organizations will need to consult the documentation to know exactly what is covered.

The DEV Community author compares the model to a browser extension rather than an app store, noting that the post found no signing requirement or formal review process for third-party mods, while validation options such as a plugin validation command and a safe mode exist. Those observations come from that post, and the editor should verify them against Anthropic's documentation before relying on them. The comparison is nonetheless a fair framing of the risk: an extension ecosystem that grows quickly can accumulate low-quality or malicious entries faster than review can keep pace.

What to watch next

Three questions will shape how this plays out. First, how the directory is curated: whether Anthropic reviews listed mods, and how it handles reports of harmful ones. Second, how well the managed-environment controls hold up. The 2.1.289 fix suggests the boundary between mod approvals and administrator rules is still being tested. Third, how many core features migrate onto mods, since each one that does gives third-party authors a supported way to replace it.

Teams already using Claude Code should decide before adoption who may install mods, whether to restrict them to an allow-list, and how to audit what a mod does with prompts and tool output. For individual developers, Anthropic's own guidance is to install mods only from trusted sources, and a mod deserves the same caution as any program that runs with your permissions.