Mods – Claude Code on your own terms

A few days ago, Claude Code got a new feature I just had to try right away: mods.
What got me started was a question everyone using AI tools at work should ask:
“How do I make sure confidential stuff (e.g. API tokens) never accidentally ends up with the AI?”

🧩 What is a mod?

A mod is a plugin made of JavaScript or TypeScript functions that run right inside Claude Code. They react to events such as a submitted prompt or a tool call, and they can observe them, rewrite them (!), or answer them on their own. You can even extend the interface with them.

🔍 How they differ from classic hooks

Hooks are scripts that react to events from the outside. They can block a prompt or add context to it, but they can’t rewrite it. A mod sits in the middle of the processing chain and can do exactly that.

🛠️ My hands-on example

I built a small mod that strips DigitalOcean tokens (dop_v1_…, doo_v1_…, dor_v1_…) from every prompt before it reaches Claude. All Claude sees is “[DO-TOKEN REMOVED]”. The core is about 20 lines of code. With claude plugin validate and claude plugin test, you can check the mod without even starting a session.

⚠️ Good to know

The mod only cleans what’s in the prompt. If Claude reads a .env file on its own, you need an additional hook on tool calls. Security doesn’t come from a single tool, but from a well-thought-out overall approach.

My rule of thumb:

• Just need to check or block something? Classic hook.
• Want to change content or extend Claude Code? Mod.

Mods are available from Claude Code 2.1.287 onwards.

If you want the code example, just ping me on LinkedIn :-)

Which rules would you teach Claude Code with a mod? I’d love to hear your ideas in the comments

Join the discussion on LinkedIn →