What is sec-default?
sec-default is a Claude Code mod by anthropics that security default for organizations: seated outermost, it keeps the organization's classic hooks, prompt content, settings, tool policy and pinned environment out of reach of the plugins a. It is listed under Security and has no public popularity data yet.
| Type | Claude code mod |
|---|---|
| Author | anthropics |
| Repository | anthropics/claude-code |
| Popularity | no public popularity data yet |
| Category | Security |
| Security | Low risk (96/100) |
| Rank | #2,423 of 5,272 Claude Code mods; #285 in Security |
| Last commit | 2026-10-17 |
| Stars this week | +1,659 |
| Hooks | 21 events |
| Sees | classic hooks, compaction, every skill, subagent spawns, the system prompt |
| Draws on | nothing |
Is sec-default safe to install?
sec-default scores 96/100 on the MCPMods security check: Low risk. No checks raised a concern. It passed 7 of 8 checks.
Mod footprints come from claude plugin validate, which lists every event a mod hooks and every API call it makes without running it.
| Check | Result |
|---|---|
| No network access | Pass |
| Starts no processes | Pass |
| Writes no files or config | Pass |
| Doesn't read environment variables | Pass |
| Only sees the events it hooks | Pass |
| Doesn't drive Claude | Pass |
| Passes claude plugin validate | Pass |
| No license detected | Note |
API calls in its code
| Call | What it means |
|---|---|
$.settings.read | reads settings |
$.ui.log | draws interface |
How do I install sec-default?
- Check your Claude Code version. Mods need Claude Code 2.1.287 or later and are on by default.
claude --version
- Read its footprint. This lists every event it hooks and every API call it makes, without running it.
git clone https://github.com/anthropics/claude-code claude plugin validate ./claude-code/mods/sec-default
- Install it. It ships inside Claude Code. Turn it on or off from the Installed tab in /plugin.
/plugin
Or ask Claude to set it up
Paste this into Claude Code and it installs sec-default for you:
Install the "sec-default" Claude Code mod from https://github.com/anthropics/claude-code/tree/main/mods/sec-default. Run claude plugin validate on it first and show me what it can access before you enable it.
More from anthropics/claude-code
This repository has 4 Claude Code mods on MCPMods.
- agents-md: AGENTS.md as project instructions, by one option. Under claude-md-or-agents-md a project with no instruction files of it (Low risk)
- diff: The diff pane as a plugin: /diff opens the session's uncommitted changes beside the transcript, file by file with their (Review before installing)
- telemetry: Plugin analytics: hooks $.telemetry's two events, so a plugin logs an event or marks a feature's use as a first-party ro (High risk)