All Claude Code modsAccess

What can a Claude Code mod access?

A Claude Code mod is a plugin whose JavaScript or TypeScript hooks run inside your session with your permissions; mods aren’t sandboxed. Its code reaches files, processes and the network only through the mods API, so a static scan can list the methods it calls and the events it hooks. In the current catalogue of 5,478 counted mods, 5,317 have reported footprints: 61.5% contain recorded methods classified as writing files, running processes or driving Claude, 9.8% include $.http.fetch, and 47.4% hook every tool call or every prompt with no filter recorded. 6.9% also reference methods the grader cannot classify yet. Check a mod’s page before you install it.

“Mod” here means a plugin with a hooks module. Plugins that carry only skills, settings hooks or MCP servers are not mods and are not in these numbers. Last full scan Oct 19, 2026 on Claude Code 2.1.303.

How does a mod get access?

Its hooks run inside your Claude Code session with your permissions, and mods aren’t sandboxed (Anthropic: what a mod can reach). To do anything outside its own code, such as drawing, reading a file, starting a process or making a request, a hook calls the mods API; it has no other way out (what a hook can do with an event). The events matter as much as the calls: a mod that hooks tool.call or prompt.submit sees the matching tool calls or prompts, all of them when the hook has no filter, and can change them (review what a mod can do).

That is why a static scan works: claude plugin validate reports the events each mod hooks and the API methods its code references, and this catalogue records both for every mod.

What do the four levels mean?

Each mod gets the widest level of the API methods it references. Levels order what a mod’s own code calls; they are not safety ratings and not limits on what a started program can do. Counts are reported footprints by classified calls.

L0, draws and remembers383 (7.2%) mods

Draws on screen, plays audio, keeps its own stored values and reads facts about the session such as the working directory or model.

API methods at L0

no access label plugin.name, plugin.root, $.session.cwd, $.session.root, $.session.model, $.session.turns, $.session.id, $.session.surfaces, $.session.surface, $.session.usage, $.session.version, $.tool.list, $.tool.check, $.command.list, $.command.register, $.agent.list, $.state.set, $.clock.now, $.clock.sleep, $.clock.after, $.clock.every
draws $.ui.notice, $.ui.invalidate, $.ui.blit, $.ui.resolve, $.ui.log, $.ui.ask, $.ui.toast, $.ui.notify, $.ui.status, $.ui.open, $.ui.close, $.ui.panes, $.ui.scroll, $.ui.focus, $.ui.view
plays audio $.audio.play, $.audio.speak
persists state $.store.get, $.store.set, $.store.delete, $.store.keys

L1, reads1,360 (25.6%) mods

Reads files, settings, environment variables, the transcript, the prompt box or other mods’ state, or writes the clipboard or the prompt box.

API methods at L1

writes the clipboard $.ui.copy
reads the selection $.ui.selection
reads the transcript $.session.messages
reads files $.session.repo, $.fs.read, $.fs.list, $.fs.exists, $.fs.stat, $.fs.ancestors
requests an Anthropic credential handle $.session.authorize
reads your sign-in $.session.identity
reads the prompt box $.prompt.read
reads prompt attachments $.prompt.media
writes the prompt box $.prompt.fill, $.prompt.suggest
reads the system prompt $.prompt.compose
reads settings $.config.list, $.settings.read
telemetry $.telemetry.log, $.telemetry.mark
reads mod state $.state.get
reads env vars $.env.get

L2, writes or runs2,861 (53.8%) mods

Writes files, runs processes, changes config or environment variables, or drives Claude by sending prompts, calling tools or starting agents.

API methods at L2

drives Claude $.model.complete, $.model.fork, $.model.classify, $.session.compact, $.session.send, $.session.append, $.turn.abort, $.prompt.submit, $.tool.call, $.tool.register, $.command.run, $.agent.spawn, $.agent.register
changes config $.config.set
writes files $.fs.write
runs processes $.process.run, $.process.spawn
sets env vars $.env.set

L3, network611 (11.5%) mods

Makes HTTP requests with $.http.fetch or calls MCP servers.

API methods at L3

MCP servers $.mcp.call, $.mcp.connect
network $.http.fetch

Shown apart, not as L0: 102 reported footprints with no recorded API methods and 0 whose methods the grader cannot classify.

What did the scan find?

Counted mods: 5,478mods the catalogue counts, excluding fixtures, catalogue copies and duplicates
Reported footprints: 5,317of counted mods, including 200 retained records that show their last recorded footprint; 161 counted mods have none
Write files, run processes or drive Claude: 3,271 (61.5%)reported footprints with any of the three
Hook tool.call or prompt.submit: 3,359 (63.2%)reported footprints, with any filter, or hooking every event
Of those, with no filter recorded: 2,518 (47.4%)reported footprints that see every tool call or every prompt
Runs processes: 2,173 (40.9%)reported footprints
Reads files: 2,122 (39.9%)reported footprints
Writes files: 928 (17.5%)reported footprints
Network (HTTP): 523 (9.8%)reported footprints
Calls MCP servers: 95 (1.8%)reported footprints
Reads environment variables: 1,809 (34.0%)reported footprints
Drives Claude: 1,785 (33.6%)reported footprints
Reads the transcript: 442 (8.3%)reported footprints
Reference at least one unclassified method: 365 (6.9%)reported footprints
Validation: 4,569 passed, 648 with warnings, 59 failed, 202 not rescannedcounted mods
Most hooked events: session.start 4,572 (86.0%), ui.render 3,910 (73.5%), command.run 3,753 (70.6%), tool.call 2,799 (52.6%)reported footprints, top four

How do I check a mod before installing it?

Open its page from the collection.
Read the level, any unclassified calls, the events it hooks and the validation result.
Open the source at the scanned revision linked on the page.
Or run claude plugin validate on the plugin yourself.

What the scan cannot tell you

It is a static scan, not a runtime test.
A program the mod starts with $.process.run reaches the network with your own access, and network policy for $.http.fetch does not cover it (Anthropic: which controls still apply). A tool call or prompt the mod rewrites changes what Claude does. Both can do more than the mod’s own calls show.
Unclassified methods have no grade.
Retained records show their last recorded footprint, not a current one.
Passing validation does not mean a mod is safe or works.

How the scan works Anthropic’s mods overview Browse the collection