How to find a plugin, read it before you install it, check what it costs in
context, then publish your own. Plus what shipped in September and October
2026: Claude Marketplace, mods, claude plugin eval.
What a plugin actually is
A package you install with one command that adds skills, commands, subagents, hooks or MCP servers to Claude Code in one go. It comes from a marketplace, a repo that lists several of them. For you, it means picking up someone else's workflow without copying their files, and also running their code on your machine.
Technically, a plugin is a Git repo (or a zip archive) that can contain slash commands, skills (domain instructions loaded at the right moment), hooks (scripts triggered on SessionStart, PreToolUse, etc.), preconfigured MCP servers and sub-agents. Claude Code handles updates, enabling and disabling. Since October 1, 2026, it can also ship a mod, code that runs inside Claude Code itself (more on that below, and chapter 20 is all about it).
Before plugins, you had to copy-paste markdown files between projects and explain to each person how to install your workflow. Now one command does it.
Where to find plugins
| Source | What it is |
|---|---|
| Claude Marketplace | Anthropic's catalog launched September 23, 2026, connectors and plugins in one place |
claude-plugins-official (anthropics/claude-plugins-official) | Anthropic's official marketplace |
claude-community (anthropics/claude-plugins-community) | The community directory: 2,282 plugins as of September 21, 2026 |
| claude.ai | Skills enabled on your claude.ai account sync down to the terminal |
Skill sync only goes one way, from claude.ai to your machine, and only when you're logged in with your subscription. /skills lists them under claude.ai sync. Handy if you've already built skills in the app. If you don't want them in every project, set "syncClaudeAiSkills": false in your user settings. Plugins you uploaded to claude.ai don't come down on their own: claude plugin marketplace list shows that marketplace ("My Uploads") with the claude plugin marketplace add --claudeai ... command to add it.
You add a marketplace from a GitHub repo, a git URL or a local path. The community directory is open: a plugin being listed there doesn't mean Anthropic audited it.
Install and manage your plugins
From Claude Code, type /plugin. You get the catalog, the descriptions and the install button.
From the terminal, if you already know what you want:
# add a marketplace (once)
claude plugin marketplace add anthropics/claude-plugins-community
# install: name@marketplace
claude plugin install superpowers@claude-plugins-official
# see what's installed, and the configured marketplaces
claude plugin list
claude plugin marketplace list
# a plugin's inventory and projected token cost, before or after install
claude plugin details superpowers
# disable without uninstalling
claude plugin disable superpowers@claude-plugins-official
# update (restart required), uninstall
claude plugin update superpowers@claude-plugins-official
claude plugin uninstall superpowers@claude-plugins-official
# remove auto-installed dependencies you no longer need
claude plugin prune
claude plugins (plural) works too, it's an alias.
Security: read before you install
A plugin runs code on your machine, with your permissions. A hook is a shell script triggered on every event. A mod is JavaScript running inside Claude Code. In mid-September 2026, a flaw called "Plugin4Shell" was disclosed: a plugin could run remote code by getting around SHA pinning. It's fixed in Claude Code, as long as you're up to date.
The routine before every install:
- Update Claude Code. Security fixes only help if you have them.
- Read the plugin.
claude plugin details <name>for the inventory, then open the repo:hooks/hooks.jsonand the scripts it calls first, since those run without asking you. - Pin a version. In a marketplace, an entry can point to a specific commit (
sha). Plugin4Shell showed that isn't enough on its own, but it keeps you from silently receiving an update you haven't read. - Install one plugin at a time, and watch what it changes in your session before adding another. Stack five plugins at once and too many skills fire in parallel, you lose track of who does what.
What a plugin costs in context
Every installed skill adds its description to your context, every session. Ten plugins with fifteen skills each add up.
/skill-doctorlists your skills with their context cost and actual usage (the report opens in the Stats tab of/plugin, v2.1.252 or later). Whatever you haven't used in a month goes.claude plugin details <name>gives a plugin's projected cost before you install it. On my machine,claude plugin details superpowersreports 15 skills, oneSessionStarthook and about 840 tokens added to every session./usagebreaks down the session's consumption by skill, plugin, subagent and MCP server.
The levers are covered in detail in chapter 19.
Four plugins to install first
| Plugin | Marketplace | Value in one line |
|---|---|---|
superpowers | claude-plugins-official | Brainstorming, plans, TDD, systematic debugging, review |
commit-commands | claude-plugins-official | /commit, /commit-push-pr, /clean_gone |
claude-seo | claude-community | Full SEO audit with a health score out of 100 |
claude-blog | claude-community | Article writing pipeline (Google + AI citations) |
ralph-loop is off this list. It makes Claude rework the same task in a loop until it's done, and Claude Code now does that on its own with /goal and /loop (chapter 18).
superpowers
About fifteen method skills, in the official marketplace: brainstorming, writing-plans, executing-plans, systematic-debugging, test-driven-development, verification-before-completion, requesting-code-review, subagent-driven-development, using-git-worktrees.
Typical use case: before writing code for a fuzzy feature, the brainstorming skill kicks in (or you ask for it). It pins down intent, requirements and design before the first line, instead of jumping on the first idea.
claude plugin install superpowers@claude-plugins-official
commit-commands
Anthropic's plugin that provides /commit. Lots of people think the command is built in. It isn't. You also get /commit-push-pr (commit, push and open the PR in one go) and /clean_gone (cleans up local branches deleted on the remote).
claude plugin install commit-commands@claude-plugins-official
claude-seo
It comes from the community directory and audits the site in your repo. It checks the technical side (crawlability, Core Web Vitals, security), content (E-E-A-T), JSON-LD schema, images, sitemap and hreflang, plus visibility in AI engines (AI Overviews, ChatGPT, Perplexity). It ships 17 skills and 11 agents, and outputs a health score from 0 to 100.
Use case: you're working on a Next.js site, you run the audit before a deploy, you get the score and a list of priority fixes.
claude plugin install claude-seo@claude-community
claude-blog
Same author as claude-seo, on the writing side: 20 commands and 4 agents that take an article from outline to rewrite, with a score out of 100. It reads MDX, markdown and HTML.
Use case: /blog outline for a structure drawn from Google results, /blog write for the draft with cited sources, then an SEO check before publishing.
claude plugin install claude-blog@claude-community
Mine, if you care about CO2
Outside the ranking, because I wrote it. I code all day with Claude Code and had no idea what it emitted. claude-carbon estimates your session's CO2 and cost locally from your tokens, and shows them in the status line. Every session is stored in a local SQLite database, so the history survives the 30-day transcript purge. It adds /carbon-report (text report), /carbon-card (PNG card) and /carbon-pr (a pull request's footprint).
npx claude-carbon
Or through the marketplace: claude plugin marketplace add gwittebolle/claude-carbon then claude plugin install claude-carbon@claude-carbon. Restart Claude Code afterwards.
Mods: code that runs inside Claude Code
A plugin that ships a JavaScript or TypeScript file that Claude Code calls in its own process, on events (a tool call, a sent prompt, part of the interface being rendered). It runs with your permissions, outside any sandbox.
Available since October 1, 2026 (Claude Code v2.1.287 in the terminal), in the CLI and the Code tab of the desktop app. A mod can draw a panel or a banner, pin its own line under the prompt, intercept tool calls and add commands that answer without a Claude turn. Some Claude Code features are mods themselves, like /diff. To write one, describe it in a session or run /plugin-authoring. Before installing someone else's, run claude plugin validate on its folder: it lists what the mod listens to and what it calls. All the details, with two complete, tested mods, are in chapter 20.
A mod has more power than a skill. A badly written skill gives a bad answer, a malicious mod runs whatever it wants on your machine. The security routine above applies twice over.
Build and publish your plugin
Getting started
claude plugin init my-plugin
The command creates the skeleton in ~/.claude/skills/my-plugin/. It loads on its own in the next session, as my-plugin@skills-dir. You iterate locally before publishing anything. For a mod, init isn't needed: you write its three files directly (chapter 20).
Typical structure
my-plugin/
.claude-plugin/
plugin.json # plugin manifest
commands/ # slash commands
skills/ # skills (one folder per skill, with SKILL.md)
agents/ # sub-agents
hooks/
hooks.json # loaded automatically
.mcp.json # MCP servers (optional)
README.md
Minimal plugin.json
{
"name": "my-plugin",
"version": "1.0.0",
"description": "What the plugin does in one sentence",
"author": { "name": "your-name" },
"homepage": "https://github.com/your-handle/my-plugin"
}
Don't declare hooks/hooks.json again in plugin.json. Claude Code loads
it automatically. Declaring it a second time breaks plugin loading ("Duplicate
hooks file detected").
Test before publishing
# checks the manifest, skills, agents, commands and a mod's code
claude plugin validate ./my-plugin
# runs the plugin's graded test suite (evals/ folder by default)
claude plugin eval ./my-plugin
claude plugin eval runs test cases (a prompt and grading criteria) against your plugin, and compares them with a session without the plugin. It tells you whether your skill improves the result or not. It runs the plugin on your machine: only use it on plugins you trust.
Publish
- Push the repo to GitHub (public)
- If your repo also serves as a marketplace, add a
.claude-plugin/marketplace.jsonthat lists your plugins - Users add it with
claude plugin marketplace add your-handle/my-pluginthen install it - To show up in the community directory, check the README of the anthropics/claude-plugins-community repo
Full docs: code.claude.com/docs/en/plugins/create.
Question
A plugin shows up in the anthropics/claude-plugins-community directory. What does that guarantee you?
Pick an answer to see the explanation.
Key takeaways
- Three sources: Claude Marketplace (claude.com/plugins), the official marketplace, and the community directory, which isn't audited.
- Before installing: Claude Code up to date,
claude plugin details, read the hooks. Plugin4Shell was a reminder that a plugin runs code on your machine. /skill-doctorand/usagetell you what your plugins cost in context. Prune what you don't use.- To build one:
claude plugin init,validate,eval. Never declarehooks/hooks.jsonagain inplugin.json.