Claude Code mod permissions and safety
Mods are not sandboxed. The repository says a mod runs with your permissions and can see your prompts and tool calls. The badges tell you what each one reaches before you install it.
Where the badges come from
The repository's catalogue script runs claude plugin validate --json on every mod and maps what the validator reports the mod calls and hooks to plain badges. If validation fails, the mod gets unverified. A mod with none of the listed calls or gating hooks is labelled display only. The same report fills the reach data this site shows on each mod page.
So the badges describe what the code can call, as Claude Code's own validator sees it. They do not describe how often a mod uses a capability or what it sends.
What each badge means
| Badge | Validator signal | What it means for you |
|---|---|---|
writes files | $.fs.write | Can create or change files with your permissions. |
reads files | $.fs.read, list, stat, exists, ancestors | Can read file contents or inspect paths. |
runs commands | process.run, process.spawn | Can start processes on your machine. |
network | http.fetch | Can make HTTP requests off your machine. |
calls a model | model.complete, classify, fork | Makes model calls on your account, which use tokens. |
sends messages | session.send | Can send messages into the session. |
uses MCP | mcp.call, mcp.connect | Can call MCP servers. |
plays sound | audio.play, audio.speak | Can play audio. |
hooks tool calls | a gating tool.call hook | Registered where Claude's tool calls can be intercepted. |
hooks prompts | a gating prompt.submit hook | Registered where your prompts can be intercepted. |
In the site's bundled catalogue snapshot of 17 public mods, separate from the pinned source review in the footer: 1 can use the network, 4 call a model, 4 run commands, and 1 can write files.
A hook is not automatically a block
A gating hook means the mod registered on an event that Claude Code lets mods intercept. Whether it ever holds anything depends on its code. Redline is labelled display only, yet its reach data lists the hook session.compact; its README describes it as observing the session and drawing a gauge, not holding work. By contrast, Last Look is described as holding destructive commands until you approve. Read the README's "What it can touch" section to learn what a hook is used for.
What happens when a mod breaks
The repository states a policy that guards which can stop an action fail safe: if the guard itself breaks, it does not silently let the action through. That is the repository's stated rule, not a guarantee we tested for each guard.
For a display mod the right failure is different. In Redline's source, gauge work runs inside a safely helper that logs the error to the debug log and lets the turn continue, and its detail command shows a toast if the view cannot open. Read the relevant source before relying on a specific mod's failure behavior.
Before you install
- Does it call a model? Then it uses tokens on your account. The README says how often.
- Does it use the network or run commands? Check the README for why and where.
- Does it hook tool calls or prompts? Check whether it observes, warns or holds.
- Does it write files? Check which ones.
- Keep Claude Code's own permission settings. The repository calls safety mods a safety net, not a permission system.
The mod list can filter to mods with no network and no model calls.
Report a security problem
Per SECURITY.md, report privately on GitHub under Security > Report a vulnerability on the repository, not in a public issue. It counts a mod reaching what its badges and README do not disclose, a guard letting through what it says it holds, a mod leaking prompts, files, secrets or tokens off your machine, and repository scripts or CI that could run untrusted code. A bypass of Claude Code itself belongs with Anthropic. The repository says it aims to respond within 72 hours.
Sources
Source-reviewed on against modmyclaude/claude-code-mods at commit 8628e8f. This page describes what the repository files say and do. We did not run the repository's tests or a new live Claude Code session for it.