A mod that judges mods.
modwall hooks the moment another mod loads, reads what Claude Code's own scanner found in its code, and turns it into reach labels such as prompts, tool-gate, network and processes, with a risk level.
← All work
modwall: A firewall for mods.
See what each Claude Code mod can reach as it loads, and audit, hold or refuse it by your own policy.
37 testsClaude Code 2.1.287+MIT
/plugin marketplace add RadTech-Solutions/modwall /plugin install modwall@modwall $ /modwall scan agent-pager HIGH network · prompts · tool-gate status-band LOW screen only new-mod HELD needs /modwall allow
Mods run with your permissions.
A mod can read every prompt, approve tool calls and reach the network, and nothing on screen tells you which ones do. Within a week of launch there were well over a hundred, most barely reviewed.
Audit, then allowlist.
- Install it and run
/modwall scanto see every mod's footprint. - Start in
auditmode for a week. - Move to
allowlistand approve the mods you rely on with/modwall allow.
An allowlist, not a blocklist.
Anything modwall does not recognise counts as high risk, so a new API in next week's release is treated as dangerous until someone looks at it. It even rates itself high, and says so.
Mods treated like dependencies.
Teams can adopt mods without guessing: a clear footprint for each one, and a policy that decides what loads.