Cargando el Technology Radar
Claude Code Plugin Marketplace turns Claude Code customization into a distributable ecosystem. Plugins can extend Claude Code with skills, agents, hooks, MCP servers, LSP servers, output styles, and reusable commands; marketplaces are catalogs that users add and then install individual plugins from, similar to adding an app store and then choosing apps (Claude Code plugin docs). This signals a shift in coding-agent adoption from individual local configuration toward shared automation assets, internal platform packages, and curated team workflows.
The official marketplace, claude-plugins-official, is automatically available in Claude Code and is curated by Anthropic, while the community marketplace hosts third-party plugins that have passed Anthropic automated validation and safety screening, with each plugin pinned to a specific commit SHA in the catalog (Claude Code plugin docs). The official catalog includes code-intelligence plugins that connect Language Server Protocol tools such as pyright, rust-analyzer, gopls, and typescript-language-server, plus external integrations for GitHub, GitLab, Jira/Confluence, Asana, Linear, Notion, Figma, Vercel, Firebase, Supabase, Slack, and Sentry (Claude Code plugin docs).
The most important architectural point is trust. Claude Code's documentation warns that plugins and marketplaces are highly trusted components that can execute arbitrary code on a machine with user privileges, and that Anthropic does not control what MCP servers, files, or other software are included in plugins or verify that they work as intended (Claude Code plugin docs). That makes this a Trial item: valuable for approved internal workflows and curated extensions, but not something to roll out as an open marketplace without supply-chain controls.
/plugin opens the plugin manager, marketplaces can be added from GitHub repositories, Git URLs, local paths, or remote marketplace.json files, and plugins can be installed, disabled, enabled, uninstalled, reloaded, and scoped to user, project, local, or managed installations (Claude Code plugin docs)..claude-plugin/marketplace.json with required fields such as name, owner, and plugins, and plugin entries can declare sources, categories, tags, version metadata, skills, commands, agents, hooks, MCP servers, and LSP servers (Claude Code marketplace docs).ref and full commit sha pinning for exact-version control (Claude Code marketplace docs).strictKnownMarketplaces, block specific marketplaces with blockedMarketplaces, force managed-only hooks or MCP servers, lock skills/agents/hooks/MCP servers to plugins or managed settings with strictPluginOnlyCustomization, and prevent users or projects from defining permission rules with allowManagedPermissionRulesOnly (Claude Code permissions, Claude Code marketplace docs).Trial Claude Code plugin marketplaces for approved internal plugins, shared team commands, code-intelligence setup, project-specific skills, and repeatable engineering workflows. Start with a private organization marketplace, pinned plugin sources, explicit owners, signed or reviewed releases where possible, and project-scope installation only for repositories that need the workflow. Use plugins to standardize known-good workflows, not to let every developer discover and install arbitrary third-party automation.
Treat plugins as software supply-chain artifacts. Require code review, commit SHA pinning, dependency and secret scanning, license review, MCP scope review, hook review, least-privilege permissions, and documented update ownership. Disable or restrict third-party marketplace additions with strictKnownMarketplaces, block unapproved sources with blockedMarketplaces, and use managed settings for high-trust environments. For sensitive repositories, consider allowManagedHooksOnly, allowManagedMcpServersOnly, allowManagedPermissionRulesOnly, and strictPluginOnlyCustomization.
Move from Trial toward Adopt only after the organization has a curated marketplace process, plugin inventory, security review checklist, permission baseline, update policy, incident-response path, and telemetry for plugin usage. Avoid open-ended community marketplace adoption for production or sensitive codebases until plugin provenance, permissions, hooks, and MCP behavior are continuously governed.