)
Last updated: November 9, 2026
What is a Claude Code plugin? A Claude Code plugin is a directory of skills, agents, hooks, MCP servers and other components that Claude Code installs and loads as one unit. One command gives you a ready-made setup, and the marketplace it came from supplies updates. The trade-off is trust: a plugin runs with your user privileges, so it is code you install, not only a prompt.
TL;DR: Key Takeaways
- Anthropic's documentation warns that an installed plugin can execute arbitrary code with your user privileges, and 3 kinds of content (hooks, monitors and server processes) run outside the sandbox (Claude Code Docs, 2026).
- On November 9, 2026 the official marketplace listed 317 plugins, and 263 of them point to external sources, 262 with a pinned commit SHA (claude-plugins-official, GitHub).
- Plugin4Shell, disclosed on September 18, 2026, let a repository owner swap pinned plugin code in 4 coding agents, and Anthropic fixed Claude Code in version 2.1.179 (Cloud Security Alliance, 2026).
- Administrators have 13 plugin policy settings in managed settings, and an empty strictKnownMarketplaces list blocks every marketplace, the official one included (Claude Code Docs, 2026).
- On October 29, 2026, 2 trojanized versions of the Claude Code IDE extension were live in Cursor's marketplace for about 11 hours. They were extensions, not plugins (Cursor, 2026).
- Red Hat's August 18, 2026 guide offers a 5-minute repository audit for third-party plugins (Red Hat Developer, 2026).
At a glance: Claude Code plugins in 60 seconds
Quick Answer
What does a Claude Code plugin contain, and what can it run?
A plugin packages several kinds of components under one manifest. Skills, commands and agents shape what Claude does with its tools. Hooks, monitors, MCP servers and LSP servers are code that runs as you, and Anthropic's documentation says permission rules and the sandbox do not cover it.
| Component | What it adds | How it runs | Permission rules and sandbox |
|---|---|---|---|
| Skills, commands, agents | Instructions and workflows Claude loads | Text in Claude's context | Cover the tool calls they trigger |
| Hooks | Commands at lifecycle events, such as after an edit | Shell commands with your full permissions | Do not apply |
| Monitors | Background commands that report to Claude | Shell commands started with the session | Do not apply |
| MCP servers | Tools from an external system | A process Claude Code starts | Cover tool calls, not the process |
| LSP servers | Diagnostics and code navigation | A language server process | Do not apply |
| bin/ executables | Commands on the Bash tool's PATH | Run when Claude calls them in Bash | Cover the Bash call |
How we researched
On November 9, 2026 we read Anthropic's Claude Code documentation on plugins, marketplaces, policy and security. We counted the entries in the official marketplace.json and reviewed write-ups from the Cloud Security Alliance, Cursor and Red Hat. Catalog counts change often.
What is a Claude Code plugin and when do you need one?
A Claude Code plugin is a directory of components that Claude Code installs and loads as one unit, usually described by a manifest at .claude-plugin/plugin.json. Skills, subagents, hooks and MCP servers all work on their own. A plugin matters when you want several of them packaged, versioned and updated together.
According to Claude Code Docs (2026), you install a plugin to get a setup someone else built, and you make one to share yours with teammates. For the skill format itself, read our Claude Code skills guide. The VS Code extension and the JetBrains plugin are not plugins in this sense.
| Approach | Best for | How it updates |
|---|---|---|
| Standalone skill in ~/.claude/skills/ | One skill for yourself, available in every project on the machine | You edit the file |
| Plugin from a marketplace | A packaged setup someone else built | From its marketplace, if auto-update is on |
| Your own plugin | Sharing with teammates or many projects | You publish versioned releases |
)
How to install a Claude Code plugin
Run /plugin install with the plugin name and its marketplace, such as commit-commands@claude-plugins-official. In a session the command does not install at once. It opens the plugin's details so you can review what it adds and choose a scope. Claude Code adds Anthropic's official marketplace the first time you start an interactive terminal session.
The terminal flow has four steps:
- Open the details with /plugin install, or run /plugin to browse the Discover tab.
- Read the Will install section, which lists the commands, agents, skills, hooks and MCP and LSP servers the plugin adds.
- Choose a scope: user, project or local.
- Confirm it works by typing / and looking for the plugin's skills, or by running claude plugin list in your shell.
For scripts, claude plugin install name@marketplace works without a session and takes --scope. For a plugin outside the official marketplace, add that marketplace first with /plugin marketplace add owner/repo.
| Scope | Who gets the plugin | Where it is recorded |
|---|---|---|
| User | You, in every project on the machine | ~/.claude/settings.json |
| Project | Everyone who works in the repository | .claude/settings.json, committed |
| Local | You, in this repository only | .claude/settings.local.json |
Project scope switches the plugin on for collaborators, but each person still runs the install once.
Official, community and third-party marketplaces
A marketplace is a catalog, not a hosted store: a repository with a .claude-plugin/marketplace.json file that lists plugins and where to fetch each one. Anthropic publishes two, official and community, and every other marketplace is third-party. The Claude Marketplace website is separate and is not added with /plugin.
| Tier | Marketplace name | What it holds | Auto-update by default |
|---|---|---|---|
| Official | claude-plugins-official | Plugins Anthropic maintains, plus partner and author plugins | On |
| Community | claude-community | Third-party plugins that authors submitted to Anthropic | Off |
| Third-party | Any other name | Whatever the publisher lists, unreviewed by Anthropic | Off |
According to the official catalog on GitHub (November 9, 2026), 317 plugins are listed. 54 are stored in Anthropic's repository, and 40 of those name Anthropic as author. The other 263 point to external git repositories or, in one case, a command, and 262 of them pin a commit SHA.
What a Claude Code plugin costs in context and processes
An enabled plugin is part of every session, not only the ones where you use it. The names and descriptions of its skills, agents and commands sit in Claude's context on every turn, and its MCP servers and hooks run alongside the session.
According to Claude Code Docs (2026), those tokens count toward your usage even when nothing from the plugin runs. Official-marketplace plugins show a Context cost estimate in /plugin. For any other plugin, run claude plugin details with its name and read the Always-on line.
Which Claude Code plugins to start with
Start with plugins that name Anthropic as author, and treat the list below as a snapshot of November 9, 2026. The catalog changes often, so confirm each entry in the Discover tab. Every plugin still adds context cost and may bring hooks, so read the details pane first.
| Plugin | What the catalog says it adds | Category |
|---|---|---|
| commit-commands | Commands for git commit, push and pull request creation | Productivity |
| code-review | Automated pull request review with multiple agents and confidence scoring | Productivity |
| feature-dev | A feature development workflow with agents for exploration, architecture and quality review | Development |
| security-guidance | Security review for Claude-generated code, with warnings on edits and a diff review | Security |
| plugin-dev | A toolkit for building Claude Code plugins, with 7 skills | Development |
Build and test your own Claude Code plugin
A plugin needs only a directory, and the manifest requires just a name. Add a .claude-plugin/plugin.json file, drop in skills, hooks or an .mcp.json, and load it for one session with the --plugin-dir flag. You do not need a marketplace while developing, and claude plugin validate checks the files.
A skill at skills/review/SKILL.md becomes /my-plugin:review, hooks go in hooks/hooks.json, servers in .mcp.json and executables in bin/. To share the plugin, publish a marketplace.json in a git repository or submit it to Anthropic's directory. That makes you part of every user's supply chain. According to Red Hat Developer (2026), plugin security is really repository security.
How to review a Claude Code plugin before you install it
Review a Claude Code plugin the way you review a dependency that runs as you. Check where the marketplace comes from, read what the plugin will install, then open the files that execute: hooks, MCP server definitions and bin/ scripts. Anthropic's trust warning says it cannot verify that plugin contents will work as intended or stay unchanged.
- Run claude plugin marketplace list to see the source each marketplace was added from.
- Open the plugin in /plugin and read the Will install section.
- Open the plugin's repository and read hooks/hooks.json, .mcp.json and every file in bin/. The details pane shows that a hook exists, not what it runs.
- Read skill files as instructions that act with your authority. Ask whether any line reaches toward a file, a credential or the network without a stated reason.
- Pin what you can: /plugin marketplace add your-org/plugins#v1.2.0 pins a tag.
According to Red Hat Developer (2026), a 5-minute audit of the repository also checks branch protection, tagged releases, a SECURITY.md file and contributor history. A plugin with one contributor and no reviews has one account standing between you and a compromise.
Claude Code plugin security incidents in 2026
The 2026 incidents share one pattern: trust given at install time was reused later without a fresh check. Plugin4Shell broke a commit-hash pin, a flaw in an official-marketplace plugin turned project files into instructions, and a trojanized IDE extension spread through a marketplace. Each ran with the developer's permissions.
| Date | What happened | Impact | Status |
|---|---|---|---|
| Described August 18, 2026 | Researchers found that Hookify, an official-marketplace plugin, fed project rule files into the hook subsystem's trusted channel | In tests on Claude Opus 4.6, 5 payloads leaked environment variables and secrets | Anthropic closed it as working as designed: the directory-trust dialog is the boundary |
| September 18, 2026 | Plugin4Shell: 4 coding agents checked out a pinned commit without verifying the checkout landed on it | Zero-click code execution through background plugin updates | Fixed in Claude Code 2.1.179 and Codex 0.146.0 |
| October 29, 2026 | Trojanized Claude Code IDE extension, versions 2.1.312 and 2.1.313, in Cursor's extension marketplace | Host data sent out, attacker SSH key added, persistence attempted | Removed by Cursor, attacker server taken offline |
According to the Cloud Security Alliance (2026), the attack works when a repository owner names a branch after the pinned 40-character hash and makes it the default. Git can then prefer the branch, so the agent installs attacker code while it reports the expected pin. Background updates removed the need for any user action. Our Claude Code security guide covers the wider 2026 flaw list.
The Cursor notice describes an IDE extension, which Anthropic's docs distinguish from a plugin. It shows the same marketplace trust problem one layer over. Cursor advised checking for an SSH key labeled svc-telemetry and rotating credentials, because removing the extension may not remove the persistence scripts. For how the two tools compare, see our Claude Code vs Cursor benchmark.
Security and governance: control Claude Code plugins in production
Managed settings decide which plugins can load. They do not watch what a loaded plugin's tools and instructions do at runtime. Close both gaps: lock down marketplaces and hooks with Claude Code's policy settings, then inspect and govern agent and MCP traffic with a runtime layer that you control.
| Goal | Managed setting | What it cannot do |
|---|---|---|
| Allow only approved marketplaces | strictKnownMarketplaces | Restrict entries inside an allowed marketplace or block --plugin-dir |
| Pre-install or block plugins | enabledPlugins, set to true or false | Install a plugin whose marketplace is not registered or allowed |
| Stop sideloading | disableSideloadFlags | Restrict .mcp.json or claude mcp add |
| Limit which hooks run | allowManagedHooksOnly | Trust hooks from plugins users enable themselves |
| Stop claude.ai synced plugins | syncClaudeAiPlugins set to false | Turn off a single synced plugin |
According to Claude Code Docs (2026), you deliver these settings through server-managed settings, MDM or a managed-settings.json file. Audit with the claude_code.plugin_installed and claude_code.plugin_loaded OpenTelemetry events. Third-party plugin names are redacted unless you set OTEL_LOG_TOOL_DETAILS=1.
Policy leaves a runtime gap. Skill files are natural language, so static analysis cannot flag a hostile instruction, and an MCP server can change what it returns without a new commit. Our guides to MCP tool poisoning and MCP security best practices cover both.
NeuralTrust treats this as a runtime problem. Agent Runtime Security (TrustGuard) inspects agent interactions as they happen, tracks context across turns and can allow, block or transform them in flight. The MCP Gateway in the Agent Gateway (TrustGate) lets you decide which tools each agent can use, applies role-based permissions and tracks which LLM accessed which tool. A gateway sees only the traffic routed through it, so keep the managed settings above for hooks and local processes.
Where should you start?
Start with visibility, then restriction, then runtime control. You cannot allowlist what you have not inventoried, and an allowlist alone does not tell you what an approved plugin does once it runs. Review comes before approval, and runtime control comes last.
| Phase | Goal | Key actions |
|---|---|---|
| 1. Visibility | Know which plugins run | Run claude plugin list, export the OpenTelemetry plugin events, set OTEL_LOG_TOOL_DETAILS=1 for real names |
| 2. Restriction | Limit what can load | Allowlist the official marketplace and your own, set disableSideloadFlags, pin to tags |
| 3. Review | Vet what you approve | Apply the 5-step review, read hooks and .mcp.json, assign an owner per plugin |
| 4. Runtime control | Govern what plugins do | Route MCP traffic through a gateway, apply tool-level permissions, inspect agent interactions |
Conclusion
A Claude Code plugin is the quickest way to share a setup of skills, agents, hooks and MCP servers, and it is also code that runs as you. Install from marketplaces you can name, read the hooks, MCP definitions and bin/ files first, and keep versions pinned. Administrators should allowlist marketplaces and block sideloading in managed settings. Then add runtime inspection, because policy decides what loads, not what a loaded plugin does.
Secure Claude Code Plugins in Production with NeuralTrust
Govern agent and MCP traffic from Claude Code plugins with runtime inspection and tool-level access control.
)
Related Comparisons
- Claude Code Skills: The Complete Guide
- Claude Code Security: Enterprise Guide
- Claude Code MCP and Cursor MCP Security
FAQs about Claude Code Plugins
1. What is a Claude Code plugin?
A Claude Code plugin is a directory of skills, agents, hooks, MCP servers and other components that Claude Code installs and loads as one unit. Most come from a marketplace, which is a catalog of plugins, and a manifest at .claude-plugin/plugin.json names the plugin. Once installed, its components are part of every session.
2. How do I install a Claude Code plugin?
Run /plugin install name@marketplace in a session, for example commit-commands@claude-plugins-official, then review the details pane and choose a user, project or local scope. From a shell, run claude plugin install name@marketplace with an optional --scope flag. Run /reload-plugins if the install summary says a reload is needed.
3. What is the difference between a Claude Code plugin and a skill?
A skill is a single SKILL.md instruction file that works on its own, for example from ~/.claude/skills/. A plugin packages several skills, agents, hooks or MCP servers as one installable and updatable unit. Skills only shape how Claude behaves, while a plugin can also bring hooks and servers that run code.
4. Are Claude Code plugins safe?
Not by default. Anthropic's documentation says an installed plugin can execute arbitrary code with your user privileges, and Anthropic cannot verify that plugin contents will work as intended or stay unchanged. Review hooks, MCP definitions and bin/ files first, prefer pinned sources and use managed settings in organizations.
5. How can an organization control Claude Code plugins?
Use managed settings. The strictKnownMarketplaces allowlist limits marketplace sources, enabledPlugins force-enables or blocks plugins and disableSideloadFlags rejects --plugin-dir. Deliver them through server-managed settings, MDM or a managed-settings.json file, then audit installs with the plugin_installed and plugin_loaded OpenTelemetry events, which redact third-party names by default.
6. How do I uninstall a Claude Code plugin?
Run claude plugin uninstall with the plugin name and the --scope you installed it at. Uninstalling the last scope also deletes the plugin's persistent data directory by default, but cached files stay under ~/.claude/plugins/cache for 14 days. Remove the marketplace too if you no longer trust its owner.
About the Author
Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specializes in AI-powered search, content strategy, and SEM. Connect on LinkedIn.
NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognized across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.
Sources
Accessed on November 9, 2026.
- Anthropic, "Plugins overview", Claude Code Docs, 2026.
- Anthropic, "Install and manage plugins", Claude Code Docs, 2026.
- Anthropic, "Anthropic's marketplaces", Claude Code Docs, 2026.
- Anthropic, "Plugin security and trust", Claude Code Docs, 2026.
- Anthropic, "Manage Claude Code plugins for your organization", Claude Code Docs, 2026.
- Anthropic, "Add components to a plugin", Claude Code Docs, 2026.
- Anthropic, "claude-plugins-official marketplace.json", GitHub, read on November 9, 2026.
- Cloud Security Alliance AI Safety Initiative, "Plugin4Shell: SHA-Pinning Bypass Enables AI Coding Agent RCE", September 19, 2026.
- Cursor, "Security notice: malicious Anthropic.claude-code versions 2.1.312 and 2.1.313", October 29, 2026, updated October 30, 2026.
- Red Hat Developer, "Securing Claude Code plug-ins: Best practices for repository security", August 18, 2026.
)
)
)
)