Claude Plugins (Official)

Why it's ranked here

Apache 2.0 licensing sits at the root, and the maintenance machinery is real rather than aspirational: nightly automated pin updates, a daily probe of listed endpoints, license enforcement, and three required status checks that bot-opened pull requests must clear the same way human ones do. The workflow comments document concrete past failure modes, which reads like a system someone actually operates. For anyone on Claude Code this is also the default install surface, so the practical case for starting here is strong.

What's good

The security policy is specific enough to audit. It defines credential theft as a concrete cross-service hop, not a vibe: a token named for one vendor sent to a different vendor's servers fails, while the same token sent to its own vendor passes. It also forces the reviewer to list every hook a plugin ships and mark each one gated or ungated, network or no network. The gate on outside contributions is equally hard-nosed: it trusts source repositories rather than submitter identities, never runs submitted code while checking it, and rejects any pull request that touches more than the manifest or edits an existing entry.

Tradeoffs

Review happens against a frozen commit, so the guarantee attaches to a snapshot of the code rather than to the repository behind it; the nightly pin refresh and rescan narrow that window without closing it, and the project's own readme says plainly that Anthropic cannot verify plugins will not change. The daily endpoint probe only covers entries vendored in the repo, so most listed server endpoints are never liveness-checked. Some validation invariants still pass as warnings, with fifteen known unresolved naming and path issues. And the pass or fail verdict comes from a language model, not a deterministic check.

How to use it well

Before installing, open the plugin's manifest entry and check where the code comes from. If it is vendored in this repository, the license check covers it; if it points elsewhere, you are cloning a third party's repository at a fixed commit, and the listed homepage is where you judge that third party. If you are publishing a plugin, read the policy prompt first: the review inspects the entire shipped payload including hidden directories, fails hooks that fire on every prompt or before every tool call without gating, and fails undisclosed telemetry. Treat your entry name as permanent; a documented renames map is the only safe migration path.

Observed

License

Apache License 2.0 at the repository root; plugin-level licensing is deferred to each linked plugin

Interface

Installed through Claude Code's plugin install command; the whole catalog lives in a single JSON manifest

Pinning

External entries reference third-party repositories at exact commit hashes, enforced as a hard error

Security review

An LLM policy review of each plugin's payload, with output constrained to a nine-field JSON schema

External contributions

Non-member pull requests may only add entries backed by an already-listed source repository and may touch no file other than the manifest