Claude Code plugins and marketplaces: sharing a team's setup safely

A Claude Code plugin is a package that bundles skills, subagents, hooks, MCP server connections and other pieces into one installable unit. A marketplace is a catalog of plugins that Claude Code can install from by name. Together they are how a website team gives everyone the same setup: the same SEO check, the same pre-deploy hook, the same review subagent, installed with one command and updated in one place.

You may not need one. A skill or hook committed to your site's repository already reaches everyone who works in that repository. Plugins earn their keep when you want the same setup across many sites, when you want versioned releases, or when you want to install something a vendor or Anthropic built. They also carry a real risk: Anthropic says a plugin "can execute arbitrary code on your machine with your user privileges." This guide covers how plugins work as of October 2026, how to share a team setup, and how to check a plugin before you trust it.

What a plugin is, and whether you need one

Anthropic's overview lists what a plugin can hold:

• Skills: SKILL.md instructions Claude loads when relevant, also runnable as a command
• Agents: subagent definitions Claude can delegate to
• Hooks: commands that run at points in Claude Code's lifecycle, such as after every edit
• MCP servers: tool servers Claude connects to while the plugin is enabled

Anthropic's own rule of thumb: skills, subagents, hooks and MCP servers "all work on their own, without a plugin." Use a plugin "when you want several skills, subagents, hooks, or MCP servers packaged as one unit."

If you haven't set up the basics, start with our guides to writing a CLAUDE.md for a website and Claude Code skills. A plugin packages those pieces; it doesn't replace them.

Anthropic's marketplaces, and everyone else's

Claude Code adds Anthropic's official marketplace "the first time you start an interactive terminal session, unless a managed policy blocks it." What's in it may surprise you: "Most of what it lists comes from partners and other authors rather than from Anthropic." You can browse it on the web at Claude Marketplace, "which shows install counts and marks some plugins Anthropic verified."

• Official (claude-plugins-official): added automatically; doesn't take submissions through the directory portal.
• Community (claude-community): you add it yourself. Where it pins a plugin to a specific commit, "which it does for nearly every entry, Claude Code refuses to install a different commit."
• Demo (claude-code-plugins): example plugins. Anthropic warns that older instructions telling you to run /plugin marketplace add anthropics/claude-code add the demo marketplace, which "isn't the official marketplace."
• Third-party: every other marketplace, including your own team's. Claude Code accepts the official and community names only from Anthropic's own GitHub repositories, "so a third-party marketplace can't present itself as an Anthropic one."

Don't confuse a plugin marketplace with Claude Marketplace, the website at claude.com/marketplace. Anthropic notes that the website "isn't a marketplace you add with /plugin marketplace add."

Installing plugins: commands and scopes

1. Browse. Run /plugin in a terminal session and open the Discover tab. In the desktop app, use the + button next to the prompt box and choose Plugins. VS Code has its own plugin manager.
2. Review before installing. The details pane lists what the plugin will install. For official-marketplace plugins, opening it by name, as in /plugin install name@claude-plugins-official, also shows a "Context cost" estimate.
3. Install with a scope. Run /plugin install name@marketplace, or from your shell, for example, claude plugin install formatter@your-org --scope project.
4. Check it loaded. Run claude plugin list, then try one of the plugin's skills. Plugin skills are namespaced, such as /plugin-name:skill-name.

A user-scope plugin installed in the terminal also appears in the desktop app's local sessions and VS Code on the same computer. Cloud sessions are different: a cloud session "has no plugin browser" and doesn't load your locally installed plugins or the ones your repository's settings turn on. Plan cloud and routine work around committed skills instead.

Sharing a website team's setup

A plugin for a website team might bundle a skill that checks titles, meta descriptions and structured data on changed pages, a hook that runs the build after edits, a review subagent with read-only tools, and the MCP connection to your CMS. To share it:

1. Build the plugin as a folder with its manifest and components. While developing, load it straight from the folder with --plugin-dir; no marketplace is needed yet.
2. Create a marketplace by adding a .claude-plugin/marketplace.json catalog to a git repository your team controls.
3. Add the marketplace on each machine with /plugin marketplace add, which accepts a GitHub repository, another git host, a local path or a hosted marketplace.json.
4. Enable it per repository. Put extraKnownMarketplaces and enabledPlugins in a site repository's .claude/settings.json. Anthropic notes these marketplace entries "apply only in a folder the contributor has trusted."
5. Test it before rollout. Anthropic's tooling includes claude plugin eval for testing plugins with eval suites.

Treat a team plugin like code: review changes in pull requests, version releases, and write down what each component does. Our Claude Code templates include an SEO-check skill and settings file you could package this way, and our team rollout plan covers sequencing the change.

Admin controls for companies

Through managed settings, admins decide which plugins Claude Code installs and allows on every machine, and "Users can't override them." They can be delivered as server-managed settings from claude.ai (Organization settings, Claude Code, Managed settings, which needs the Owner role) or through device management.

• extraKnownMarketplaces plus enabledPlugins: register your marketplace and turn plugins on for everyone.
• strictKnownMarketplaces: an allowlist of marketplace sources. An empty list blocks every source, including the official one.
• blockedMarketplaces: a blocklist of sources.

On the claude.ai side, skill and plugin scanning is available on Enterprise plans for Claude, Cowork and Enterprise plugin marketplaces, with pass, warn or fail results. It doesn't scan MCP servers or hooks "at this time," and Anthropic's support article doesn't say whether it covers Claude Code installs from marketplaces, so don't rely on it as your Claude Code review. Our guide to managed settings and admin controls covers the wider policy setup.

Security: review a plugin like software you install

Anthropic's plugin security page is direct about the risk. A plugin runs as you, and "Claude Code runs hooks, monitors, MCP servers, LSP servers, and the processes a mod starts outside the sandbox." With auto-update on, "the files you reviewed can change on disk."

Context is a cost too. "An enabled plugin is part of every session." Each skill and agent the plugin lets Claude invoke adds its name and description to every turn, even when unused. Disable plugins you aren't using with /plugin or claude plugin disable. For background on what MCP connections can reach, see our guide to MCP servers for website teams, and for hook design, our guide to hooks for website projects.

Publishing a plugin more widely

To reach people beyond your team, you can publish your own marketplace, or submit to Anthropic's directory, where one listing "reaches people on claude.ai, in Cowork, and in Claude Code." Submitting "requires a paid claude.ai plan." The official marketplace doesn't take submissions through the directory portal. Whatever you publish, others will run it with their own privileges, so document what it does and keep it small.

Conclusion

Plugins and marketplaces let a website team package its Claude Code setup once and install it everywhere, and let admins control which sources are allowed. For a single site, committed skills and settings are often enough. When you do use plugins, prefer your own reviewed marketplace or verified sources, read every hook and server before installing, watch context cost, and remember that cloud sessions don't load them. If you want a shared plugin, marketplace and policy designed for your team, our Claude Code consulting covers that setup. More guides are in our Claude Code Guide.

Frequently asked questions