Staying safe

Claude can be extended with add-ons other people wrote. NodeGX is one of them. Each add-on runs on your computer with the same permissions you have. Before you install any of them, make three checks.

Install from the maker's own page only

The NodeGX add-on comes from nodegx.io. The NodeGX editor comes from the same page, or from the NodeGX page on GitHub. Nowhere else.

Copies of popular add-ons get uploaded under similar names. A copy can contain anything. If a video or a post gives you a different link, do not use it.

Read the warning, then decide

When you install an add-on in the Claude desktop app, Claude shows a notice. It says the add-on will have access to your computer, and that Claude has not checked who made it. That notice appears for every add-on. It is the moment to ask: did I get this from the maker's own page?

For NodeGX the answer should be yes, because you came from nodegx.io. If you cannot say where an add-on came from, do not install it.

Keep the number small

Every add-on sends Claude its list of tools at the start of every conversation. Add many and Claude has less room to think in. The signs are a Claude that forgets things mid-task, or asks you the same thing twice.

Turn an add-on on when you need it. Turn it off when you don't. In the Claude desktop app, add-ons are under Settings, then Extensions.

Passwords and keys

Claude does not need your passwords. Don't paste one into a conversation. The conversation is saved.

An app you build may need a key for an outside service, such as a payment company. Claude keeps that key in a file on your computer, out of GitHub. GitHub basics has the one rule about that.

What NodeGX changes on your computer

The Claude add-on installs into the Claude desktop app's own extensions folder. It carries the NodeGX server, Studio's editor and its own copy of Node.js. It changes nothing else.

Connect Claude Code in the NodeGX editor writes one entry, named nodegx, into Claude Code's settings file ~/.claude.json, after making a backup beside it. The card shows the exact change and how to remove it:

claude mcp remove --scope user nodegx

A project gets a CLAUDE.md and a .mcp.json written into its folder the first time it is opened. Neither holds a key. If you put the project on GitHub, both can go with it.

To check your whole setup, ask Claude in a new Code conversation:

List every Claude Code connector and plugin set up on this computer, where each one is configured, and whether any config file holds a key or token in plain text.

Quick reference

• NodeGX comes from nodegx.io. Nothing from anywhere else.
• The install warning appears for every add-on. Ask where it came from.
• Few add-ons on at once. Settings, then Extensions.
• No passwords in the chat.