Claude Mods, each shipped with the validator's own list of what it can reach

A Claude Mod is TypeScript that runs inside Claude Code's own process, hooking its events and calling its engine. Before any of that code runs, claude plugin validate prints the events it hooks and the $ calls it makes. Every mod here carries that printout in its README, unedited, with a five-line threat model beside it. Three plugins, one marketplace.

GitHub The scoreboard: every mod on GitHub, graded by reach The hooks marketplace, for plugins that need no flag

Install

claude plugin marketplace add karanb192/claude-code-mods
claude plugin install cache-tax@claude-code-mods
claude plugin install fable-pin@claude-code-mods
claude plugin install mod-builder@claude-code-mods

Mods are early access. No hooks module loads unless CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1 is set, and the API can change between releases. The mod-builder skill is instructions only and needs no flag. To turn it on for every session, merge { "env": { "CLAUDE_CODE_ENABLE_FUNCTION_HOOKS": "1" } } into ~/.claude/settings.json; that loads the hooks module of every installed plugin that ships one. For one session, prefix the command: CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1 claude.

The mods

fable-pin

mod · reach L0, draws and remembers

Pins every subagent to the fable model by rewriting the model on agent.spawn, unless the spawn is a fork. One switch, remembered across sessions.

/fable-pin on /fable-pin off /fable-pin status
Hooks
session.start, command.run{command=fable-pin}, agent.spawn
Calls
$.command.register, $.store.get, $.store.set
Reach
L0. Its own store and one command, nothing else. Sees subagent spawns.

mod-builder

skill · no hooks module

A skill that plans a mod's capability budget before a line is written, then validates the result and writes the threat model. Every idea must justify each process, file, network, model or UI capability it asks for; the plan states the reach level before code exists, and after the validator runs its printed calls line has to match the plan. It also explains what a Mod is, finds existing ones on the scoreboard, migrates a settings hook, reviews or debugs a mod, and brainstorms ideas against every mod already on GitHub. Both mods above were built with it.

/mod-builder "what is a Mod" "find a Mod for X" "build a Mod that ..." "review my Mod" "migrate this hook"
Reach
A skill is instructions, not process code, so it has no footprint of its own. It runs claude plugin validate and the bundled footprint.mjs on the mod it is building.

Why the footprint is printed

A mod runs with the process's reach: it can read files, run commands, reach the network and drive Claude, if it asks for those verbs. The only record of what it asks for is the $ calls in its source, and Claude Code's validator lists them before any code runs. Treating that list as a budget is the whole method here: plan the smallest surface that does the job, write the code, read the validator back, and explain any call the plan did not have. The scoreboard applies the same reading to every mod on GitHub nightly, so what a mod says about itself and what the validator says about it sit next to each other.