Claude Plugins Official

What It Does

claude-plugins-official is Anthropic's managed marketplace for Claude Code plugins: a single 170,741-byte .claude-plugin/marketplace.json manifest listing 289 installable plugins, backed by 39 Anthropic-maintained plugins in plugins/, 15 partner-vendored definitions in external_plugins/ (context7, playwright, github, linear, terraform, serena), and 236 entries that live in external repositories but are pinned to exact commit SHAs. Users install from it inside Claude Code with /plugin install @claude-plugins-official. The repo is also a curation machine: nine CI workflows validate manifests, scan every changed external entry with an AI security reviewer, check MCP URLs, verify licenses, and nightly-bump pinned SHAs against upstream. The audience is Claude Code users installing plugins, and plugin authors: the vendored plugin-dev plugin (7 skills, 4,158 lines) is a complete authoring curriculum.

The Good

The supply-chain engineering is the best GearScope has reviewed in a marketplace. All 236 external entries carry a sha field: 151 plain url git sources and 85 git-subdir sources (repo plus subpath plus pinned commit), zero unpinned. The bump-plugin-shas.yml workflow runs nightly (07:23 UTC), compares each pinned SHA against upstream HEAD, validates the new SHA inline with claude plugin validate, and opens one PR per bumped plugin so a failing entry cannot block the rest. When the AI scan fails a bumped entry, revert-failed-bumps.yml drops it from the bump PR automatically. The workflow comments explain non-obvious GitHub Actions mechanics (GITHUB_TOKEN PRs not triggering required checks, and the self-dispatch workaround) better than most blog posts on the topic.

An AI security review is a required status check, with an unusually sharp policy. .github/policy/prompt.md (140 lines) instructs a Claude-based reviewer to read the whole shipped payload including hidden directories, and .github/policy/schema.json forces a structured verdict (passes, violations, hooks array, has_broad_scope_hooks, has_undisclosed_telemetry, description_matches_behavior). The bar is stated as "handles user data responsibly, not merely isn't malicious." The credential-exfiltration heuristic is precise: flag credentials routed cross-service (an ANTHROPIC_AUTH_TOKEN sent to a non-Anthropic endpoint is a violation even if the plugin calls it a gateway key; a Railway token calling Railway is normal). Telemetry without disclosure plus opt-out is an explicit fail. Verdicts are cached per (plugin, SHA) and the cache is keyed on the policy hash, so changing the prompt re-scans everything.

Install mechanics verified end to end, including the anti-spoof guard. In an isolated HOME with claude CLI 2.1.152: claude plugin marketplace add anthropics/claude-plugins-official succeeded; code-review installed byte-identical to the repo clone (content-addressed cache dir b819188d2eea, sole extra file the .in_use session marker); frontend-design and the fully-external SHA-pinned aikido (v1.2.6) installed and enabled; uninstall and marketplace removal are fully reversible. Attempting to register a local clone under the same name is refused: "The name 'claude-plugins-official' is reserved for official Anthropic marketplaces and can only be used with GitHub sources from the 'anthropics' organization." That is a real phishing defense for the default marketplace name.

The vendored content is substantive. The 39 in-repo plugins ship 25 SKILL.md files, 29 commands, 31 agents, and 25 hooks. plugin-dev alone is 7 skills totaling 4,158 lines (command-development 884, hook-development 712, skill-development 637, mcp-integration 554, plugin-settings 544, plugin-structure 476, agent-development 401), currently the most complete Claude Code plugin-authoring reference in existence. receipts (300-line skill plus scripts) ran its mine-transcripts.mjs on an empty transcripts directory and emitted clean structured JSON (generatedAt, periodDays 30, filesScanned 0, sessions 0) instead of crashing.

The Bad

One shipped agent is broken on main, its own validator catches it, and its own CI does not. plugins/pr-review-toolkit/agents/silent-failure-hunter.md has YAML frontmatter that fails to parse: the description embeds multi-line example dialogues containing Context: colons, which break the YAML. claude plugin validate plugins/pr-review-toolkit errors: "frontmatter: YAML frontmatter failed to parse... At runtime this agent loads with empty metadata (all frontmatter fields silently dropped)." Since the description is what Claude Code uses to route model invocation, the agent effectively ships inert. The repo's validate-frontmatter.yml only validates files changed in the current PR (it derives its file list from gh pr diff), so breakage that predates a check or slips through is never re-swept repo-wide. This is the same defect class GearScope documented in the composio community marketplace; finding it in Anthropic's own directory is notable.

The README documents a rename-migration feature the shipped validator rejects. The README states that the renames map in marketplace.json is read by "the Claude Code plugin loader," which "transparently rewrites the old slug to the new one on the user's next sync." The manifest carries 9 such renames. But claude plugin validate . --strict on the repo root fails with: "renames: Unknown field 'renames'. Claude Code ignores it at load time." On CLI 2.1.152, either the loader honors the map and the validator lags it, or the README oversells a feature the CLI ignores. Either way the documented contract and the tooling disagree.

23 of 289 manifest homepages point at the repo's former name. Entries including code-review, frontend-design, context7, github, linear, and playwright link to anthropics/claude-plugins-public/tree/main/... rather than claude-plugins-official. GitHub 301-redirects the old name (verified), so links resolve, but the manifest was renamed upstream and 23 entries were never updated. Related hygiene gaps: only 14 of 289 entries declare a version field (installed in-repo plugins fall back to commit-hash versions, e.g. code-review shows "Version: b819188d2eea"), 14 entries carry no category, and the repo itself has zero releases, tags, or changelog despite operational churn past PR #5,600.

It is Claude Code-only, and the issue tracker is a one-way mailbox. There is no install path for Hermes, OpenClaw, Codex, Cursor, or any other agent, despite plugins bundling standard SKILL.md files that would port (the skills.sh registry distributes some of the same content, e.g. frontend-design's 822K all-time installs, but that is not this repo's mechanism). External PRs are auto-closed by close-external-prs.yml; contributions flow through a submission form. Combined with 1,037 open issues (a 3.0 percent ratio), the repo is operated as a service, not a community project, which is a defensible choice but limits outside inspection of curation decisions.

Smoke Test Results

Host test on macOS 26.5.2 aarch64 with claude CLI 2.1.152, Node 24, git shallow clone at main (pushed 2026-08-27). Every check below ran against the real repo and the real CLI.

Run A. Fresh clone, no deps preinstalled

$ git clone --depth 1 https://github.com/anthropics/claude-plugins-official
✅ clone ok (9.7 MB shallow, main branch)
$ python3 -m json.tool .claude-plugin/marketplace.json
✅ manifest is valid JSON (170,741 bytes, 289 entries)
$ check every external source object is SHA-pinned
✅ 236 external entries, 236 SHA-pinned, 0 unpinned
$ check duplicate plugin names
✅ no duplicate names across 289 entries
$ check local dirs match manifest names
✅ all local plugin dirs have manifest entries (example-plugin is the documented reference impl)
$ ls .github/workflows
✅ 9 CI workflows (scan, validate, frontmatter, licenses, mcp-urls, bump-shas, revert, pr-guards)
$ check AI review policy artifacts
✅ policy prompt (140 lines) + JSON verdict schema present
$ check LICENSE + README
✅ Apache-2.0 LICENSE + README present
$ count in-repo plugin manifests
✅ 25 of 39 in-repo plugins carry plugin.json; 15 manifest-defined by design (12 LSP, receipts, session-report)

Pass rate: 9 of 9. A fresh clone is structurally sound with zero dependencies beyond git and python3.

Full log →

Run B. Sandbox with deps preinstalled (claude CLI 2.1.152)

$ claude plugin validate .
⚠ Validation passed with warnings: renames: Unknown field 'renames'. Claude Code ignores it at load time.
$ claude plugin validate . --strict
❌ Validation failed (--strict treats warnings as errors): same renames field
$ claude plugin validate plugins/pr-review-toolkit
❌ Found 1 error: agents/silent-failure-hunter.md frontmatter: YAML parse error, loads with empty metadata
$ for d in plugins/*/; do claude plugin validate "$d"; done
✅ 24 pass of 39 (14 manifest-defined LSP/receipts/session-report dirs fail standalone by design; pr-review-toolkit is the 1 genuine failure)
$ for d in external_plugins/*/; do claude plugin validate "$d"; done
✅ 15 pass, 0 fail
$ claude plugin marketplace add /tmp/cpo-review-20260827 # local-path spoof attempt
❌ refused: name reserved for official Anthropic marketplaces

Pass rate: 4 of 6. Both failures are real findings: the strict-mode renames rejection and the broken agent frontmatter. The 14 manifest-defined dirs failing standalone validation is expected (they are defined entirely in marketplace.json, 12 of them LSP servers with lspServers config).

Full log →

Run C. Functional verification (does it do what it claims?)

$ claude plugin marketplace add anthropics/claude-plugins-official
✅ Successfully added marketplace (isolated HOME)
$ claude plugin install code-review@claude-plugins-official
✅ installed, payload BYTE-IDENTICAL to repo clone (content-addressed cache b819188d2eea)
$ claude plugin install frontend-design@claude-plugins-official
✅ installed and enabled
$ claude plugin install aikido@claude-plugins-official # fully-external SHA-pinned entry
✅ installed and enabled, Version: 1.2.6
$ node plugins/receipts/skills/receipts/scripts/mine-transcripts.mjs # empty transcripts dir
✅ clean structured JSON: filesScanned 0, sessions 0, no crash
$ claude plugin uninstall <all three> && claude plugin marketplace remove claude-plugins-official
✅ fully reversible (empty cache dirs remain behind)

Functional pass rate: 6 of 6. The marketplace's core claim, curated plugins installable by name, is verified end to end including the external SHA-pinned path.

Full log →

What the runs tell you

The marketplace machinery works: every install path, the pinned-external path, and the anti-spoof guard behaved correctly under the real CLI. The two Run B failures are quality drift inside the content, not the pipeline scaffolding: a broken agent that predates the frontmatter gate, and a manifest field the README promises but the validator disowns.

Setup Walkthrough

1. Open Claude Code in any project and run /plugin, then pick the Discover tab: claude-plugins-official is the built-in default marketplace, no add needed.
2. Or install directly: /plugin install code-review@claude-plugins-official.
3. Or from a shell: claude plugin marketplace add anthropics/claude-plugins-official, then claude plugin install @claude-plugins-official.
4. Plugin authors: clone the repo and read plugins/example-plugin plus the plugin-dev plugin's plugin-structure and skill-development skills before submitting via the directory submission form.

No gotchas on install. Note that plugins install at user scope by default and land under ~/.claude/plugins/cache/ with content-addressed revision dirs.

Alternatives

1. composio-community/awesome-claude-plugins - the largest community Claude Code marketplace (25 in-repo plugins plus externals), installable side by side, but without SHA pinning or an AI security gate (16 of its 25 plugins failed strict validation in our earlier review).
2. vercel-labs/skills (npx skills) - the universal installer across 73 agents including Hermes and OpenClaw; use it when you want the same class of content outside Claude Code.
3. Vendor-native skill repos (prisma/skills, adobe/skills, getsentry/skills) - install skills straight from the vendor with no marketplace intermediary; better when you want one vendor's full pack at its own release cadence.