Claude Code 2.1.287 adds mods, and Anthropic says they can read your API key
Anthropic published Claude Code 2.1.287 to npm on October 1 at 16:59 UTC, and the new thing in it is Claude Mods: plugins written in JavaScript or TypeScript that run inside Claude Code itself. Anthropic’s documentation lists what one of them can do once it loads, including "read your secrets: environment variables and settings files, including an API key you keep in either".
Claude Mods arrived in Claude Code 2.1.287, published to npm on October 1. Image: Anthropic
Anthropic’s changelog entry reads "Added Claude Mods: plugins may now modify deeper behavior". A mod is built from event handlers that Claude Code calls "when an event happens, such as a tool call, a submitted prompt, or a part of the interface being drawn", and a handler "can watch the event, change it, or take it over".
Anthropic prints the warning itself
"A mod is code that runs with your permissions," the documentation says. "It can read and write your files, start processes, and make network requests. Install mods only from authors and marketplaces you trust."
Sandboxing does not fence it off. "Mods aren’t sandboxed," Anthropic writes. "If you turn on sandboxing, the sandbox isolates the Bash commands Claude runs, and a process that a mod starts runs outside it." A mod that approves tool calls can approve one "that an ask rule would prompt for, or that one of your own PreToolUse hooks blocked".
One boundary is drawn hard: "A mod can restyle much of Claude Code’s interface, but not the permission prompt. It can’t change what a prompt shows you." The dialogue asking you to approve a command stays Claude Code’s own, whatever else a mod redraws.
You can list what a mod does before you load it
There is a dry run for that. Running claude plugin validate on a plugin’s directory lists the events the mod handles and what it asks Claude Code to do, such as read a file or make a network request, without any of the code running.
Turning mods off comes at three widths: disable or uninstall a single plugin from the Installed tab in /plugin, start a session with --safe-mode, which also switches off your other customisations, or set "disableAllHooks" to true in ~/.claude/settings.json. Organisations have a separate control, allowManagedModsOnly, which stops the mods a user installed from loading while the rest of each plugin, its skills, commands, agents and MCP servers, keeps working.
The stable npm tag is still on 2.1.285
Anthropic says mods "require Claude Code v2.1.287 or later, and they’re on by default". Checked on October 2, the npm registry still pointed its stable tag at 2.1.285, with latest and next on 2.1.287, so a machine following the stable channel does not have mods yet.
Hooks run wherever a session loads the plugin, including the VS Code extension’s chat panel, claude -p and the Agent SDK, and a cloud session for a plugin that reaches one. Only a terminal and the Desktop app’s Code tab draw a mod’s panes and bands. A WSL session in the Desktop app runs neither, because plugins are not available there. Version 2.1.286, which brought a set of fixes to how Claude Code redacts secrets, went out a day earlier on September 30.
Anthropic also ships three sample mods in its claude-code-playground repository, shared "as they are, without support": token-weather draws a forecast of your context window above the prompt, blast-radius holds a risky shell command such as rm -rf or a force push and shows what it would change, and replay-theater adds a /replay command that steps through the file edits Claude made in the last turn.
Those three run with your permissions as well, which is why the documentation tells you to list a mod’s hooks before you install it rather than after.
