Claude Mods, each shipped with the validator's own list of what it can reach

A Claude Mod is TypeScript that runs inside Claude Code's own process, hooking its events and calling its engine. Before any of that code runs, claude plugin validate prints the events it hooks and the $ calls it makes. Every mod here carries that printout in its README, with a five-line threat model beside it. Four plugins, one marketplace.

GitHub The scoreboard: every mod on GitHub, graded by reach The settings-hooks marketplace

Install

claude plugin marketplace add karanb192/claude-code-mods
claude plugin install image-peek@claude-code-mods
claude plugin install cache-tax@claude-code-mods
claude plugin install fable-pin@claude-code-mods
claude plugin install mod-builder@claude-code-mods

Mods require Claude Code 2.1.287 or later and are enabled by default. These versions ignore the old CLAUDE_CODE_ENABLE_FUNCTION_HOOKS flag. See Anthropic's mod documentation.

The mods

image-peek

mod · reach L2, local clipboard capture

Move the text cursor onto a pasted [Image #1] marker for a large preview pane, with the image centered on a dark canvas. Move away to hide it. Narrow windows use an inline preview above the prompt. Keyboard focus stays in the prompt.

For macOS and Ghostty, with experimental iTerm2 and Herdr support using the startup override in the README. It captures each new paste from the clipboard, so wait for the preview before copying another image. The large image and dark canvas have been confirmed in Ghostty. Claude's own theme controls the outer frame.

/image-peek off /image-peek on
Requires
macOS and Claude Code 2.1.287+. Ghostty, or iTerm2 3.7.3+ / local Herdr 0.9.1+ with the documented override. No separate app or browser.
Privacy
Temporary local PNG files, up to 24 per session. No network or model calls. Normal session exit removes the files.

fable-pin

mod · reach L0, draws and remembers

Pins every subagent to the fable model by rewriting the model on agent.spawn, unless the spawn is a fork. One switch, remembered across sessions.

/fable-pin on /fable-pin off /fable-pin status
Hooks
session.start, command.run{command=fable-pin}, agent.spawn
Calls
$.command.register, $.store.get, $.store.set
Reach
L0. Its own store and one command, nothing else. Sees subagent spawns.

mod-builder

skill · no hooks module

A skill that plans a mod's capability budget before a line is written, proves the result in an isolated run, and writes the threat model. It starts with a gate that checks the installed Claude Code can load mods, generates that build's type declarations with a headless load, and reports whether its own references have drifted from them. Every event and method in the plan is grepped in those types before code exists; after the validator runs, its printed calls, env names and state keys have to match the plan. A harness then copies the mod, drives a child claude under its own config dir, and leaves one evidence file per stage (validate, load, typecheck, test, command, and on request an interactive terminal stage and an install smoke test); the handoff pastes the harness's status block unchanged. It also explains what a mod is, finds existing ones on the scoreboard, migrates an early-access mod or a settings hook, reviews or debugs a mod, and brainstorms ideas against every mod already on GitHub. Both mods above were built with it.

/mod-builder "what is a mod" "find a mod for X" "build a mod that ..." "prove my mod" "review my mod" "migrate this hook"
Reach
A skill is instructions, not process code, so it has no footprint of its own. Its scripts run claude plugin validate, claude plugin test and a headless claude -p load on the mod it is building, under a config dir of their own.

Why the footprint is printed

A mod runs with the process's reach: it can read files, run commands, reach the network and drive Claude, if it asks for those verbs. The only record of what it asks for is the $ calls in its source, and Claude Code's validator lists them before any code runs. Treating that list as a budget is the whole method here: plan the smallest surface that does the job, write the code, read the validator back, and explain any call the plan did not have. The scoreboard applies the same reading to every mod on GitHub nightly, so what a mod says about itself and what the validator says about it sit next to each other.