Are Claude Code mods sandboxed?
No. A mod runs inside Claude Code with the permissions of the user who installed it. It can read and write files, start processes, make network requests, read environment variables (where API keys often live), see every prompt and tool call, and approve a tool call before you are asked. Claude Code's sandbox only isolates the Bash commands Claude runs, not code a mod starts.
How do I check what a mod can access?
Clone the mod's repository and run claude plugin validate ./mod-folder. The hooks: line lists every event it handles and the calls: line lists every API call it makes, read from the source without running it. Look for $.process.run, $.http.fetch, $.env.get and $.fs.write. Every mod on MCPMods shows this footprint on its page.
What makes a mod risky?
Reach that doesn't fit the job. A status line that also runs processes or sends network requests deserves a question. So does a mod that downloads code at runtime, because it can change after you reviewed it. Prefer mods with a licence, a clear author and recent commits.
What does the MCPMods security score mean?
Each mod is scored out of 100 from its footprint: network access, starting processes, writing files, reading environment variables, watching every prompt, driving Claude, passing the validator and having a licence. 80 or more is low risk, 60 to 79 means review before installing, below 60 is high risk. The score describes reach, not intent.