Plugin marketplaces and distribution

Plugins package skills, agents, hooks, MCP, LSP, and executables for reuse. A marketplace handles discovery, installation, versioning, and governance. For package structure, see Plugins and skills.

#Marketplace model

First add a marketplace, then install selected plugins. Adding the catalog does not install everything.

#Official, community, and internal catalogs

Install an official plugin:

/plugin install github@claude-plugins-official

Update the catalog:

/plugin marketplace update claude-plugins-official

Add the community catalog:

/plugin marketplace add anthropics/claude-plugins-community

#Plugin categories

LSP plugins commonly need a local language-server binary. If the Errors tab reports executable not found, install that binary.

#Create an internal catalog

company-marketplace/
├── .claude-plugin/
│   └── marketplace.json
└── plugins/
    └── quality-review-plugin/
        ├── .claude-plugin/
        │   └── plugin.json
        └── skills/
            └── quality-review/
                └── SKILL.md

Marketplace manifest:

{
  "name": "company-tools",
  "owner": {
    "name": "DevTools Team",
    "email": "[email protected]"
  },
  "plugins": [
    {
      "name": "quality-review-plugin",
      "source": "./plugins/quality-review-plugin",
      "description": "Review code for bugs, security, and performance",
      "version": "1.0.0"
    }
  ]
}

Install:

/plugin marketplace add ./company-marketplace
/plugin install quality-review-plugin@company-tools

Plugins are copied into an installation cache. Do not depend on paths outside the package such as ../shared-utils; those files are not automatically included.

#Versions and dependencies

Constrain plugin dependencies so upstream breaking changes do not unexpectedly alter team workflows.

#Recommendations

Recommendations do not force installation. Use enabledPlugins/managed settings for enforced deployment.

#Security guidance

/plugin install security-guidance@claude-plugins-official
/reload-plugins

Project enablement:

{
  "enabledPlugins": {
    "security-guidance@claude-plugins-official": true
  }
}

Custom rules:

# .claude/claude-security-guidance.md

- Do not log customer_id or account_number at INFO level.
- Check the admin role before every /admin route.
- Use timing-safe token comparison.

Pattern rules:

patterns:
  - rule_name: internal_api_key
    substrings: ["sk_live_", "AKIA"]
    reminder: "Possible hard-coded credential; use the secret manager."

This supplements human review, SAST, and blocking hooks; it does not replace them.

#Enterprise governance

Treat hooks and executables as software supply-chain code: review, pin, record changes, and restrict publication.

#Cache effects

Monitor persistent cache-creation growth when many plugins are enabled.

#Official references

• Discover plugins
• Marketplaces
• Dependencies
• Hints
• Relevance
• Reference
• Security guidance