Evidence Checked October 12, 2026
Landscape, October 2026
Mods shipped on October 1 in Claude Code 2.1.287. In the eleven days since, nine more releases have come out and most of them changed something a mod author touches. Community scanners now index about 3,500 public mods. This page covers what changed, which fixes matter if you write a guard, and how far to trust a catalog.
Provenance. Release lines are quoted from the GitHub release notes and were checked with gh release view on October 12. The event count comes from the type declarations bundled with 2.1.296. Catalog numbers come from each catalog's own README on October 12, and claims a catalog makes about its own testing are marked as self-reported. Our own experiments are on Field tests.
Releases 2.1.287 to 2.1.296
2.1.296 (October 9) is the newest release as of October 12. Only lines that touch mods are listed. Every row was checked against the release notes on 10/12.
| Version | Date | What changed for mod authors |
|---|---|---|
| 2.1.287 | Oct 1 | "Added Claude Mods: plugins may now modify deeper behavior." 43 engine events. |
| 2.1.288 | Oct 2 | $.ui.selection(): the text last selected in fullscreen mode. Fixed a mod's tool.call hook breaking Bash and file search in subagents running in a worktree. |
| 2.1.289 | Oct 3 | agent.spawn fires for teammates. One agent id across hook events. Idle and waiting states in $.agent.list(). Fixed installed mods not loading in the first session after an upgrade. A deny or ask rule on part of a compound shell command now holds over a user mod's approval on managed machines. |
| 2.1.290 | Oct 5 | tool.check gains agentId and ceiling. turn.step gains serverToolUses. ThemeKey and Color types. claude plugin validate lists every hook at a gating site and whether it has a .catch. |
| 2.1.291 | Oct 6 | Nothing mod-specific (two regression fixes). |
| 2.1.292 | Oct 6 | New event prompt.autocomplete. Prompt caching for $.model.complete (cache: true on a block). agent.spawn covers workflow agents. claude plugin install --marketplace <source> adds and installs in one step. |
| 2.1.293 | Oct 7 | $.tool.register takes isDeferred: false to list a schema up front. mock.session in the test kit. Fixed a mod's classic.* hooks being skipped while the hooks worker restarted. |
| 2.1.294 | Oct 8 | Settings-hook fixes only. Instruction-style prompt and agent hooks had been allowing what they should block. |
| 2.1.295 | Oct 8 | $.ui.notify (native notification through the user's own channel). Button takes children. Fixed a hook being handed a deeply nested tool input cut short, with no error. New events prompt.mention and ui.fault in the declarations, 46 in all. |
| 2.1.296 | Oct 9 | Fixed Esc during a prompt.submit hook letting the unchecked prompt through. Served $ methods now run in the calling agent's working directory. $.agent.register is refused from a hook still running after its mod was reloaded or removed. $.http.fetch accepts HEAD on large responses. /plugin notes a plugin whose hooks were dropped because another enabled plugin has the same name. --debug now logs each command hook's plugin, outcome and duration. |
Event count: still 46 in 2.1.296. We counted the keys of EngineEventOf in the 2.1.296 bundled claude-code.d.ts (21,473 lines), the same way we got 43 for 2.1.287 and 46 for 2.1.295. The set is identical to 2.1.295's. The other 2.1.296 type changes are small. A registered tool's description now reaches the model up to 4,096 characters, where it was 2,048. Registered agents take an autoCompactWindow. $.mcp.connect now says plainly that listing a server defers nothing, so to hold its tools back you refuse their calls at tool.check. (checked 10/12)
Fixes that matter if you write a guard
A guard is a mod that stops things: a tool.call hook that denies a command, a prompt.submit hook that drops a prompt. Each of these fixes closed a way past one.
- 2.1.295: truncated nested input. A hook could be handed a deeply nested tool input that had been cut short, with no error, so a guard could pass content it never saw. If you tested a guard before 2.1.295 on large or deeply nested inputs, such as an MCP tool with a big JSON argument or a long multi-edit, test it again.
- 2.1.296: Esc during
prompt.submit. Pressing Esc or interrupting while a mod'sprompt.submithook ran could let the unchecked prompt through, end a headless session, or clear the typed prompt. The same fix covers settingsUserPromptSubmithooks. - 2.1.295:
prompt.mention. This one is a new event rather than a fix. A file named after@in a prompt is read without raisingtool.call, so a secrets guard that hooks onlytool.callnever sees it. Hook both, and give theprompt.mentionhook a.catch, because a guard there that fails is skipped and the file is read. - 2.1.290:
.catchmade visible.claude plugin validatenow printsgating hook without .catchfor each guard-shaped hook that would fail open. The reference calls this "a fact, never a warning." For a real guard, add.catch(($, e, next) => next.called ? next(e) : { deny: 'why' }). Also in 2.1.290: a hook with a.catchcould be unloaded and its.catchskipped when it kept the hooks worker busy. That's fixed. - 2.1.289: compound commands on managed machines. A deny or ask rule on one part of
a && bnow holds over a user mod's approval. - 2.1.293:
classic.*hooks during a worker restart. They were skipped. A mod that reloads its state inclassic.SessionStartafter/clearcould miss the reload while this bug was live.
The pattern
Most guard bugs on this list weren't logic errors in the guard. The guard was never asked: the input was cut short, the file came in through another event, the hook was skipped during a restart, or the prompt got past during an interrupt. Write the guard to fail closed, hook every event the protected thing can arrive by, and re-run your tests after each Claude Code release. See Mods meet the cascade for a guard laid out that way.
The built-in mods
From the official overview, checked 10/12. /plugin lists them under Built-in. disableAllHooks, --bare and --safe-mode don't stop them.
Name in /plugin | What it does | Source public? |
|---|---|---|
cc-plugin-agents-md | Loads AGENTS.md as project instructions | Yes |
cc-plugin-diff | Takes over /diff and draws its pane | Yes |
cc-plugin-plugin-authoring | The skill Claude uses to write mods (a skill only, no mod code) | No |
cc-plugin-sec-default | Guards what an organization manages from the mods a user installs | Yes |
cc-plugin-telemetry | Sends Claude Code's analytics records; adds $ methods other mods can call | Yes |
cc-plugin-you-should-know | A side agent that leaves notes above the prompt on long tasks. Off by default | No |
sec-default grew on October 11
The public source in anthropics/claude-code/mods has had three commits since October 2. One, on October 7, fixed how the diff pane docks. The other two are bulk updates, on October 8 and October 11. The October 11 update changed only sec-default, and its README went from 188 to 270 lines. Compared row by row, the guard now also holds these events out of a user mod's reach (checked 10/12):
env.getandenv.set, with a new idea of pinned variables. A variable that managed settings set inenv, plus nine that move where policy and sign-in are read from (CLAUDE_CONFIG_DIR,CLAUDE_CODE_MANAGED_SETTINGS_PATHand others), can't be set or unset by a user mod.prompt.attachment,session.appendfor rows the engine injects, andui.loglines from an organization's own mods.session.compact, entirely. A user mod's compaction hook doesn't run where the guard is seated. The guard is seated on any machine with managed settings, and for anyone signed in on a Team or Enterprise plan.
Its README is still the best worked example of a policy mod. It uses three moves and nothing else: continue past the user tier with next.to(e, 'append'), refuse by name, or pass. Its policy reads fail closed.
Anthropic's sample mods
The claude-code/mods folder of anthropics/claude-code-playground still holds the same three samples it launched with on October 1, and nothing in it has changed since (checked 10/12):
- token-weather draws a forecast of your context window above the prompt.
- blast-radius holds a risky shell command and shows what it would change, with buttons to proceed or cancel.
- replay-theater adds
/replay, which steps through the last turn's file edits.
Community catalogs
Counts are from each catalog's README on October 12. Treat "tested" and "reviewed" as the catalog's own description of itself.
| Catalog | Stars | Size | What it does | Notes |
|---|---|---|---|---|
| karanb192/awesome-claude-code-mods | 516 | 3,561 mods, last scanned 10/12 | Scans public GitHub repos and records what the validator reports each mod can read, write, run or send over the network. Browse at mods.aidojo.si. Ships a mod-finder plugin. | CC0. Independent, not an Anthropic directory. Was 2,692 on 10/6 and 376 stars on 10/8. |
| Singh-AP/awesome-claude-mods | 2 | 20 built there, 96 listed, 44 one-command installs; daily index of 3,454 mods across 1,967 repos | A marketplace of its own mods plus community mods "reviewed and pinned to a commit." A scheduled Claude Code run fixes breakage, curates and builds one new mod a day. | MIT. Testing is self-reported. The index was 2,902 across 1,597 repos on 10/8. |
| whyashthakker/awesome-claude-code-mods | 51 | 70 bundled mods (50 general, 20 for the Desktop Code tab) | Each with source, tests, an access description and a screenshot. | States MIT for the bundled mods. "Tested with 2.1.288" and no push since 10/3. |
The Claude directory also takes plugins that contain mods, with submissions at claude.ai/directory/manage, according to the launch post and the getting-started post. We didn't open the portal itself, so the review tracking and usage stats it reportedly offers are unverified.
Before you install a mod from any catalog
A mod runs with your permissions and isn't sandboxed. It can read your files and secrets, approve tool calls and spend your usage. Clone it and run claude plugin validate ./the-mod. Read the hooks: and calls: lines, because static analysis lists every $ call the module can make, and Claude Code refuses to load a module whose calls it can't read. A catalog's access badge is that same validator output at scan time, so it can go stale once the author pushes.
Guard mods such as bash-guard, secret-shield or guardrails fail open unless they register .catch. They lower risk in permission-skipping modes. They don't remove it. validate on 2.1.290+ tells you which hooks lack a .catch.
What to watch
- The release cadence. Ten releases between October 1 and October 9, most of them touching mods. Pin the Claude Code version you test against, and re-run
claude plugin teston every upgrade. The 2.1.289 bug that kept installed mods from loading in the first session after an upgrade is a reminder that "it did nothing" can be the engine's fault. - Drawing beyond the terminal. The declarations still type
mobileandvscoderender surfaces that the docs don't list as drawing. In 2.1.296, mods draw only in the terminal and the Desktop Code tab. sec-default's reach. It took five more events on October 11. If your mod rewrites compaction, environment variables or injected rows, test it on a managed machine or a Team plan, where the guard is seated.- Catalog consolidation. Two scanners, karanb192 and Singh-AP, now index roughly the same 3,500 public mods every day. Neither is official, and both rely on the validator's static analysis, which shows what a mod can call, not what it does.
- Unused API. On 10/8 no official sample used
$.model,$.agent,$.audioor$.tool. Those are the parts of the API with the fewest worked examples, and probably where the next surprises are.