Source: https://learn.nodegx.io/setup/staying-safe
Summary: What the NodeGX add-on and other Claude add-ons can do on your computer, and the few checks to make before you install one.

# Staying safe

Claude can be extended with add-ons other people wrote. NodeGX is one of them. Each add-on runs on your computer with the same permissions you have. Before you install any of them, make three checks.

## Install from the maker's own page only

The NodeGX add-on comes from [nodegx.io](https://nodegx.io/start/). The NodeGX editor comes from the same page, or from the NodeGX page on GitHub. Nowhere else.

Copies of popular add-ons get uploaded under similar names. A copy can contain anything. If a video or a post gives you a different link, do not use it.

## Read the warning, then decide

When you install an add-on in the Claude desktop app, Claude shows a notice. It says the add-on will have access to your computer, and that Claude has not checked who made it. That notice appears for every add-on. It is the moment to ask: did I get this from the maker's own page?

For NodeGX the answer should be yes, because you came from nodegx.io. If you cannot say where an add-on came from, do not install it.

## Keep the number small

Every add-on sends Claude its list of tools at the start of every conversation. Add many and Claude has less room to think in. The signs are a Claude that forgets things mid-task, or asks you the same thing twice.

Turn an add-on on when you need it. Turn it off when you don't. In the Claude desktop app, add-ons are under **Settings**, then **Extensions**.

## Passwords and keys

Claude does not need your passwords. Don't paste one into a conversation. The conversation is saved.

An app you build may need a key for an outside service, such as a payment company. Claude keeps that key in a file on your computer, out of GitHub. [GitHub basics](https://learn.nodegx.io/online/github-basics) has the one rule about that.

::: everything What NodeGX changes on your computer
**The Claude add-on** installs into the Claude desktop app's own extensions folder. It carries the NodeGX server, Studio's editor and its own copy of Node.js. It changes nothing else.

**Connect Claude Code** in the NodeGX editor writes one entry, named `nodegx`, into Claude Code's settings file `~/.claude.json`, after making a backup beside it. The card shows the exact change and how to remove it:

```bash
claude mcp remove --scope user nodegx
```

**A project** gets a `CLAUDE.md` and a `.mcp.json` written into its folder the first time it is opened. Neither holds a key. If you put the project on GitHub, both can go with it.

To check your whole setup, ask Claude in a new Code conversation:

```text
List every Claude Code connector and plugin set up on this computer, where each one is configured, and whether any config file holds a key or token in plain text.
```
:::

## Quick reference

- NodeGX comes from nodegx.io. Nothing from anywhere else.
- The install warning appears for every add-on. Ask where it came from.
- Few add-ons on at once. Settings, then Extensions.
- No passwords in the chat.