What probably matters to youSection of the release
Unclear Whether the mod-building plugin, and with it this scan and the sharing offer, is available to ordinary users is not clear.
What
Claude Code has a built-in plugin for building mods (add-ons you create with Claude's help). That plugin gains a new tool, mcp__plugin-authoring__scan_secrets. It looks through a mod's folder for known formats of keys and tokens, such as passwords for online services, before the mod is shared.
It reads the files as they are on disk, skips the .git folder, and reports only which files hold a secret and what kind it is. It never shows the secret itself.
Before scanning, it checks your Read permission rules. Then it asks you in a dialog headed "Secret scan", with the choices "Scan it" and "Don't scan". A yes lasts until you run /clear or restart Claude Code.
The tool refuses to scan:
folders on network paths
when managed hooks for reading files are set, or managed settings cannot be read
when your organization's HIPAA or ZDR compliance settings are on
The instructions for building mods also gain a sharing step. Once a mod has loaded and worked, Claude offers once to share it as a GitHub repository and asks whether it should be public or private.
Why
The scan aims to catch a key or token left in a mod before you publish it. It runs only with your consent and stays off where an organization's settings could interfere with how files are read.
Read from
Names in the bundlemcp__plugin-authoring__scan_secrets
How sure we are
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubtWhether the mod-building plugin, and with it this scan and the sharing offer, is available to ordinary users is not clear.
Anthropic's release notes agreeImproved mod sharing in the built-in plugin-authoring skill: Claude scans a mod's files for keys before opening them, and asks before…
