Claude Code Plugins Ecosystem Guide: Install, Build, and Manage Plugins

What Are Claude Code Plugins and Why Should You Care?

Claude Code plugins package reusable capabilities — skills, slash commands, subagents, hooks, MCP servers, and LSP services — into a single installable unit. Instead of configuring each piece by hand, you install one plugin and get a pre-wired toolkit.

Bottom line: plugins turn proven workflows into portable, shareable assets. They save setup time for teams and solo developers alike — but only when the workflow behind them is already battle-tested.

Installing Your First Claude Code Plugin

Open Claude Code and run one command:

/plugin install github@claude-plugins-official

Then activate without restarting:

/reload-plugins

You just installed the official github plugin — a pre-configured MCP server that gives Claude direct access to issues and pull requests. The entire process takes under 30 seconds.

This works without adding a marketplace first because @claude-plugins-official is Anthropic's curated directory, loaded automatically on every Claude Code launch. That makes it the shortest path from zero to a working plugin.

If /plugin doesn't exist as a command, your Claude Code version is outdated. Upgrade with brew upgrade claude-code (Homebrew) or npm install -g @anthropic-ai/claude-code@latest (npm), then restart your terminal.

Think of a plugin as a pre-assembled toolbox. Someone already organized the wrenches, screwdrivers, and measuring tape. You carry the whole box into your workshop and start working. A marketplace is the store shelf where these toolboxes sit. The official store comes pre-loaded.

What Does a Plugin Actually Contain?

A single plugin can bundle multiple capability types:

The github plugin provides an MCP server. The commit-commands plugin provides Git workflow slash commands. The pr-review-toolkit bundles specialized PR review subagents. Each plugin delivers a coordinated set of capabilities that work together out of the box.

Plugins vs. standard .claude/ config: standard config works for personal, single-project experiments with short names like /hello. Plugins add a manifest, namespace prefixes (/plugin-name:hello), version tracking, and cross-project portability. Use standard config for quick tests; switch to plugins when you need to distribute or share.

From my experience running a multi-project setup, the real value isn't "more features." Plugins let you turn a workflow you've validated over weeks into something a teammate installs in seconds. But package too early — before the workflow stabilizes — and you lock in immature patterns that cost more to change later.

Why Does the `@` Suffix Trip Up Everyone?

The install command structure is:

/plugin install <plugin-name>@<marketplace-registered-name>

The @ suffix must match the registered name of the marketplace on your machine, not the repository name. These frequently differ, and guessing wrong produces a "plugin not found" error every time.

Here are the three public marketplaces and their actual names:

Notice the pattern: you add the community directory with anthropics/claude-plugins-community, but the install suffix is @claude-community. The demo directory is added with anthropics/claude-code, yet the suffix is @claude-code-plugins. Repository name does not equal registered name.

When in doubt, run /plugin marketplace list to see every registered directory's exact name. Copy-paste from that output into your @ suffix.

A full walkthrough installing commit-commands from the demo directory:

/plugin marketplace add anthropics/claude-code        # add: use repo name
/plugin install commit-commands@claude-code-plugins    # install: use registered name
/reload-plugins                                         # activate
/commit-commands:commit                                 # invoke: use namespace prefix

The marketplace source isn't limited to GitHub:

Browsing Plugins Without Memorizing Commands

Type /plugin to open the graphical manager with four tabs:

• Discover — browse all plugins from added marketplaces, select one and press Enter to install.
• Installed — view, disable, or uninstall your current plugins.
• Marketplaces — add, update, or remove marketplace directories.
• Errors — view loading errors (common: missing language server executables).

Before installing, check three details in the plugin's detail page:

1. Will install checklist — every command, subagent, skill, hook, MCP, and LSP service the plugin brings. No surprises.
2. Context cost estimate — tokens consumed per conversation turn. More plugins means less room for your actual work.
3. Last updated date — a plugin last touched 18 months ago may not support current APIs.

You can also choose the installation scope:

What Plugins Ship in the Official Directory?

The official curated directory (@claude-plugins-official) already covers the most common needs:

Code intelligence (LSP) — gives Claude immediate feedback on type errors, missing imports, and jump-to-definition. Eleven languages are supported, each as a separate plugin. Your machine must have the matching language server installed:

LSP plugins act like error-detecting glasses for Claude. After editing code, Claude spots type mismatches and missing imports without you running a compiler — and fixes them in the same turn. If the language server binary isn't in your $PATH, the Errors tab will show Executable not found.

External integrations — pre-configured MCP servers for github, gitlab, notion, figma, slack, linear, atlassian, asana, vercel, firebase, supabase, sentry, and more.

Security — security-guidance automatically scans changes for common vulnerabilities and instructs Claude to fix them immediately.

Dev workflow — commit-commands (Git commit flow), pr-review-toolkit (PR review), plugin-dev (plugin authoring toolkit), agent-sdk-dev (Claude Agent SDK development).

Namespace prefix is mandatory. Every plugin skill must be invoked as /plugin-name:skill-name. For example, the commit skill from commit-commands is /commit-commands:commit. This colon prefix prevents name collisions between plugins.

How Should You Evaluate Plugin Security Before Installing?

Anthropic states this plainly: plugins and marketplaces are highly trusted components that can execute arbitrary code with your user permissions. A plugin's hooks can run any shell command. Its MCP servers can reach external services. Its skills can be auto-invoked by the model.

Before installing any plugin, check three things:

1. Purpose alignment — does what it does (code review, deployment, integration) match a real need you have right now?
2. Component inventory — open the Will install checklist in /plugin and verify you recognize every command, hook, and MCP service.
3. Source trustworthiness — official curated is most reliable; community passes automated validation; third-party and unknown sources require the most scrutiny.

I run a rule in my own workflow: never test a new third-party plugin against a production repository first. Spin up a throwaway directory, install the plugin, watch what it does — does it modify files you didn't expect? Does it call external services? Does it change Claude Code's default behavior? Only after that observation period does it earn a spot in real projects.

Organizations can restrict which marketplaces members are allowed to add using managed settings.

Plugins cannot bypass your confirmation. Actions involving deletion, publishing, commits, authorization, or payments still require your explicit approval. A plugin adds capability, not a free pass.

How Do You Verify a Plugin Actually Loaded?

After running /reload-plugins, spend ten seconds confirming. Three checks:

• Read the reload receipt — /reload-plugins outputs a count: plugins reloaded, skills, agents, hooks, MCP servers, and LSP services. If the numbers don't match your expectations, something failed to load.
• Verify entry points — check /help for skills under the plugin's namespace; check /agents for subagents; try invoking /plugin-name:skill-name directly.
• Check errors — open /plugin and switch to the Errors tab. The most frequent error is Executable not found in $PATH from LSP plugins.

The /reload-plugins command invalidates the conversation cache. The next request re-reads the entire conversation history. Plugins with MCP servers make this especially noticeable. Avoid reloading after every minor change — batch your changes and reload once.

Building Your Own Claude Code Plugin

Five steps from empty directory to working plugin:

Step 1 — Create the directory:

mkdir my-first-plugin

Step 2 — Add the manifest. Create .claude-plugin/plugin.json with your plugin's identity:

{
  "name": "my-first-plugin",
  "description": "A starter plugin for learning the ecosystem",
  "version": "0.1.0",
  "author": "your-name"
}

Step 3 — Add a skill. Create skills/hello/SKILL.md at the plugin root. The complete directory structure:

my-first-plugin/
├── .claude-plugin/
│   └── plugin.json        # only this file goes inside .claude-plugin/
├── skills/                 # everything else at root level
│   └── hello/SKILL.md
├── commands/               # slash commands
├── agents/                 # subagents
├── hooks/hooks.json        # hooks
├── .mcp.json               # MCP server config
└── .lsp.json               # LSP language service config

Critical structure rule: only plugin.json belongs inside .claude-plugin/. All other directories — skills/, commands/, agents/, hooks/ — live at the plugin root. Placing them inside .claude-plugin/ causes silent load failures. This is the most common structural mistake when authoring plugins.

Step 4 — Test locally without publishing:

claude --plugin-dir ./my-first-plugin

Invoke your skill with the namespace prefix (derived from the name field in plugin.json):

/my-first-plugin:hello

Edit any file, then run /reload-plugins to refresh. No restart needed.

Step 5 — Share. Push to GitHub, add a marketplace.json, and anyone can install with /plugin marketplace add <your-repo>.

Migrating from standard config: if you already have skills and hooks in a project's .claude/ directory, migration is a file copy. Move .claude/commands/, .claude/agents/, .claude/skills/ to the plugin root. Copy hooks from .claude/settings.json into hooks/hooks.json (same format). Verify with claude --plugin-dir ./my-first-plugin.

From building several internal plugins for my own workflow: resist the urge to package every new automation. Wait until a process has survived at least a few weeks of real use. Packaging immature workflows creates maintenance debt — you end up maintaining the plugin and the workflow simultaneously.

How Do You Manage Plugins When Your Stack Gets Too Large?

Plugins have diminishing returns at scale. Three costs accumulate:

• Context pressure — every plugin's skill and command descriptions consume tokens.
• Decision diffusion — too many entry points make the model less precise about which to choose.
• Attack surface — more code running with your permissions means more potential exposure.

Core management commands:

/plugin marketplace list               # show all registered directories
/plugin disable plugin-name@dir-name   # disable without uninstalling
/plugin enable plugin-name@dir-name    # re-enable
/plugin uninstall plugin-name@dir-name # fully remove
/plugin marketplace remove dir-name    # remove entire directory + its plugins

Categorize plugins by risk to guide your installation pace:

A monthly review habit keeps the stack healthy: open the Installed tab in /plugin, keep what you actively use, disable anything you can't remember the purpose of, merge overlapping plugins, and remove unknown sources. A plugin earns its place by reducing repeated explanations, preventing recurring errors, or standardizing output. If it does none of those, disable it.

What Should You Learn Next?

Plugins package individual capabilities. To use them effectively, understand the components they contain:

• Skills — model-invoked capabilities triggered by task context
• Slash Commands — user-triggered command entry points
• Subagents — independent agents with isolated context
• Hooks — event-driven scripts that run automatically
• MCP Servers — bridges to external tools and services

Official documentation (always defer to current docs):

• Creating plugins: https://code.claude.com/docs/en/plugins
• Discovering and installing plugins: https://code.claude.com/docs/en/discover-plugins
• Creating and distributing marketplaces: https://code.claude.com/docs/en/plugin-marketplaces

Plugins exist to replicate mature workflows, not to replace foundational skills. Run the process manually first, validate it works, then package it. Review before you trust, and prune before you accumulate.

Related Reading

• Claude Code Complete Guide 2026 - The complete Claude Code reference guide
• Claude Code Slash Commands - Commands that plugins can extend
• Best Claude Code Skills 2026 - Skills vs plugins: when to use which
• Claude Code Hooks Tutorial - Build event-driven hooks that plugins bundle
• Claude Code Subagents Guide - Subagent architecture that plugins can package

— Leo