Anthropic shipped Claude Code 2.1.287 this week, and the headline feature is Claude Mods: a plugin architecture that goes substantially deeper than anything the tool has offered before. This is not a themes-and-snippets extension system. Mods can intercept events before and after they fire, replace built-in behavior entirely, rewrite prompts before they reach the model, block or retry tool calls, approve or deny permission requests, redact tool output, and modify interface elements. That is a full orchestration layer sitting on top of an autonomous coding agent. Engineering leaders need to understand what they're actually looking at here before they let their teams start installing things.

The same release adds a "You should know" built-in mod that deploys a side agent to monitor active sessions and surface issues the primary agent or the user might miss. And a smaller but immediately useful quality-of-life addition: an `n:` filter in the agents view that matches session names and tasks across collapsed sections, making it meaningfully easier to navigate parallel workstreams. Let's go through each of these in order of importance to your team.

The framing of "plugins" undersells what Anthropic has shipped. Most plugin systems in developer tools let you add commands, change syntax highlighting, or trigger webhooks. Claude Mods can do all of that, but they can also sit between the user and the model and change what the model sees, or sit between the model and the filesystem and change what the model is allowed to do. Specifically, a mod can:

This is the kind of extensibility that lets Claude Code become organization-specific infrastructure rather than a generic tool everyone uses the same way. A fintech team could install a mod that enforces regulatory constraints on every tool call. A platform team could build a mod that routes certain operations through internal approval queues. That's genuinely new territory for AI coding assistants. The Korean security analysis from TokenPost that catalogued the initial mod ecosystem found 31 available capabilities across early mods: 14 that could execute local commands, 4 with network access, and 13 able to observe all tool calls. That breakdown matters because it tells you exactly how to think about mod risk classification: local execution access, network access, and observability access are three distinct threat vectors that need separate evaluation criteria.

Anthropic's own documentation warns explicitly that mods are not sandboxed and run with the same machine access as Claude Code itself. That is a significant disclosure, and it's the right call to be upfront about it. A malicious or poorly reviewed mod does not need to find a privilege escalation path; it already has one. This puts Claude Mods in the same risk category as shell scripts from the internet, which is exactly how your team should treat them. The governance framework is not complicated, but it has to exist before anyone installs anything:

If your team already has a process for approving third-party developer tools, fold mod review into that process. If you don't have that process, this is the moment to build it, because Claude Code's capabilities are now large enough that informal "someone on the team tried it and it seemed fine" governance is genuinely insufficient.

The built-in "You should know" mod, enabled through `/plugin`, is the most strategically interesting part of this release. It deploys a separate agent to watch a Claude Code session in parallel and flag things the primary agent or the user might miss: missing test coverage, overlooked edge cases, risky assumptions in the implementation approach. The instinct to treat this as "free second opinion from Claude" is understandable and wrong. A side agent is a quality-control system with a precision and recall profile that you need to measure, not assume. It consumes additional model calls on every session where it's active. It will produce some alerts that are genuinely useful and some that are noise. The ratio of those two outcomes determines whether "You should know" improves your team's velocity or degrades it. The right way to deploy this is as a controlled pilot on high-risk repositories. Pick three to five codebases where escaped defects are expensive: your payments service, your auth layer, your data pipeline. Enable "You should know" for a defined period, log every alert it surfaces, and track:

That's the data you need before expanding deployment. Alert fatigue is a real failure mode here. If "You should know" surfaces 40 alerts per session and engineers learn to dismiss them automatically, you've consumed model budget and degraded attention simultaneously. Treat it like you'd treat any monitoring system: it needs tuning, it needs ownership, and it needs a feedback loop.

Community comparisons between Cursor and Claude Code consistently land in the same place: Cursor is an editor-integrated tool built around visual diffs and inline assistance, while Claude Code is a terminal-based autonomous agent built for multi-file implementation and test execution. That distinction remains accurate after 2.1.287, but the gap in architectural ambition has widened.

Cursor and GitHub Copilot can respond to this by offering safer, more constrained extension APIs, and that's a legitimate competitive position. Many engineering teams will prefer a shallower extension surface that carries lower governance overhead. But for teams already running Claude Code in production at scale, Anthropic has just handed them the ability to make the tool behave like internal platform infrastructure rather than a vendor product they use as-is. The deeper competitive significance is that Anthropic is exposing policy and orchestration layers that other vendors keep fixed. If reliable security, compliance, and workflow mods emerge from the community and the enterprise ecosystem, Claude Code stops being a coding assistant and starts being an agent platform on which organizations build their own AI engineering workflows. That's a different product category, and it's one where the switching costs are much higher.

The `n:` filter in the agents view is easy to overlook next to Mods, but teams running multiple parallel Claude Code sessions will feel this immediately. Filtering by session name and task across collapsed sections means you can actually navigate a busy multi-agent workstream without scrolling through everything. This is the kind of UX detail that signals the tool is being used seriously in production; the feedback loop that produces it is a good sign.

If your team is already using Claude Code in production:

If your team is evaluating Claude Code against Cursor or Copilot: The Mods architecture makes this a more complex evaluation than it was six months ago. Claude Code now has a larger potential upside and a larger governance surface. Teams with mature internal developer platform functions will get more from Mods than teams that are still standardizing basic tooling. Be honest about where your organization sits on that spectrum. The teams that will extract the most value from 2.1.287 are not the ones that install every available mod immediately. They're the ones that treat the orchestration layer with the same discipline they apply to production infrastructure: review, pin, isolate, audit, and iterate.

Claude Code adding a control plane is consistent with where AI engineering tooling is heading at the frontier. The question stops being "which tool writes better code" and starts being "which tool can be made to behave like a reliable, governable system inside our specific engineering organization." That's a question that rewards engineering leaders who think in terms of systems and incentives rather than benchmark scores. The elite engineering teams being built right now are not just the ones with access to the best models. They're the ones building the organizational infrastructure to deploy those models with discipline. Claude Mods, used correctly, is a surface on which that infrastructure can be built. That's worth taking seriously, even if it means doing the governance work first.