Skip to content
Back to skills

Claude Plugins Reference 2026

ASecurity

Reference guide for Claude Code plugins system (January 2026). Use when creating, distributing, or understanding plugins, plugin.json schema, marketplace configuration, bundling skills/commands/agents/hooks/MCP/LSP, or plugin validation.

  • 2 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added September 27, 2026
documentationbashtestinggitdocumentation

Works with

  • claude code
  • cli
  • mcp

Security analysis

A100/100

Scanned September 27, 2026

npx -y skills add David-Li0406/meta-skill-evloving --skill claude-plugins-reference-2026 --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Claude Plugins Reference 2026?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Claude Plugins Reference 2026
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/david-li0406-claude-plugins-reference-2026/badge)](https://www.skillsdirectory.com/skills/david-li0406-claude-plugins-reference-2026)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: claude-plugins-reference-2026
description: Reference guide for Claude Code plugins system (January 2026). Use when creating, distributing, or understanding plugins, plugin.json schema, marketplace configuration, bundling skills/commands/agents/hooks/MCP/LSP, or plugin validation.
---

# Claude Code Plugins System - Complete Reference (January 2026)

Plugins bundle multiple Claude Code capabilities (skills, commands, agents, hooks, MCP servers, LSP servers) into distributable packages.

---

## plugin.json Schema

```json
{
  "name": "plugin-name",
  "version": "1.0.0",
  "description": "Plugin description with trigger keywords",
  "author": {
    "name": "Author Name",
    "email": "author@example.com",
    "url": "https://github.com/author"
  },
  "homepage": "https://docs.example.com/plugin",
  "repository": "https://github.com/author/plugin",
  "license": "MIT",
  "keywords": ["keyword1", "keyword2"],
  "commands": "./commands/",
  "agents": "./agents/",
  "skills": ["./skills/skill-one", "./skills/skill-two"],
  "hooks": "./hooks.json",
  "mcpServers": "./.mcp.json",
  "lspServers": "./.lsp.json",
  "outputStyles": "./styles/"
}
```

### Required Fields

| Field  | Type   | Constraints                                 |
| ------ | ------ | ------------------------------------------- |
| `name` | string | Kebab-case, unique identifier, max 64 chars |

### Recommended Fields

| Field         | Type   | Purpose                                  |
| ------------- | ------ | ---------------------------------------- |
| `version`     | string | Semantic versioning (X.Y.Z)              |
| `description` | string | Max 1024 chars, include trigger keywords |
| `author`      | object | `{name, email?, url?}`                   |
| `homepage`    | string | Documentation URL                        |
| `repository`  | string | Source code URL                          |
| `license`     | string | SPDX identifier                          |
| `keywords`    | array  | Marketplace discoverability              |

### Component Paths

| Field          | Type          | Default Location         |
| -------------- | ------------- | ------------------------ |
| `commands`     | string/array  | `./commands/`            |
| `agents`       | string/array  | `./agents/`              |
| `skills`       | string/array  | `./skills/`              |
| `hooks`        | string/object | `./hooks.json` or inline |
| `mcpServers`   | string/object | `./.mcp.json` or inline  |
| `lspServers`   | string/object | `./.lsp.json` or inline  |
| `outputStyles` | string        | `./styles/`              |

---

## Directory Structure

```
plugin-name/
├── .claude-plugin/           # REQUIRED metadata directory
│   └── plugin.json          # REQUIRED manifest (only file here)
├── commands/                 # Slash command files (.md)
├── agents/                   # Agent definitions (.md)
├── skills/                   # SKILL.md directories
│   ├── skill-one/
│   │   ├── SKILL.md
│   │   └── references/
│   └── skill-two/
│       └── SKILL.md
├── hooks.json               # Hook configurations
├── .mcp.json                # MCP server definitions
├── .lsp.json                # LSP server configurations
├── scripts/                 # Helper scripts for hooks
├── LICENSE
├── CHANGELOG.md
└── README.md
```

**Critical**: `.claude-plugin/` contains ONLY `plugin.json` - never put components here.

---

## Distribution Methods

### Marketplace (Recommended)

```json
{
  "name": "marketplace-name",
  "owner": {
    "name": "Team Name",
    "email": "team@example.com"
  },
  "metadata": {
    "description": "Marketplace description",
    "version": "1.0.0",
    "pluginRoot": "./plugins"
  },
  "plugins": [
    {
      "name": "plugin-one",
      "source": "./plugins/plugin-one"
    },
    {
      "name": "plugin-two",
      "source": { "source": "github", "repo": "owner/repo" }
    }
  ]
}
```

### Plugin Sources

| Type          | Format                                         |
| ------------- | ---------------------------------------------- |
| Relative path | `"./plugins/my-plugin"`                        |
| GitHub        | `{ "source": "github", "repo": "owner/repo" }` |
| Git URL       | `{ "source": "url", "url": "https://..." }`    |

### Installation Commands

```bash
# Add marketplace
/plugin marketplace add owner/repo
/plugin marketplace add https://gitlab.com/company/plugins.git
/plugin marketplace add ./local-marketplace

# Install plugin
/plugin install plugin-name@marketplace-name
/plugin install plugin-name@marketplace-name --scope project
/plugin install plugin-name@marketplace-name --scope local

# Manage
/plugin enable plugin-name
/plugin disable plugin-name
/plugin update plugin-name
/plugin uninstall plugin-name
```

---

## Installation Scopes

| Scope     | Settings File                 | Use Case                     |
| --------- | ----------------------------- | ---------------------------- |
| `user`    | `~/.claude/settings.json`     | Personal, global (default)   |
| `project` | `.claude/settings.json`       | Team, shared via git         |
| `local`   | `.claude/settings.local.json` | Project-specific, gitignored |
| `managed` | `managed-settings.json`       | Enterprise, admin-controlled |

---

## Bundled Capabilities

### Commands

- Location: `commands/` directory
- Format: Markdown with frontmatter
- Namespace: `/plugin-name:command-name`

### Agents

- Location: `agents/` directory
- Format: Markdown with frontmatter
- Auto-delegation by Claude

### Skills

- Location: `skills/` with `SKILL.md`
- Auto-activation by Claude
- Progressive disclosure support

### Hooks

- Location: `hooks.json` or `plugin.json` inline
- Events: PreToolUse, PostToolUse, Stop, etc.
- Use `${CLAUDE_PLUGIN_ROOT}` for paths

### MCP Servers

- Location: `.mcp.json`
- Types: http, stdio
- Auto-start when plugin enabled

### LSP Servers

- Location: `.lsp.json`
- Requires binary installation
- Code intelligence features

---

## Environment Variables

| Variable                | Description                       |
| ----------------------- | --------------------------------- |
| `${CLAUDE_PLUGIN_ROOT}` | Absolute path to plugin directory |
| `${CLAUDE_PROJECT_DIR}` | Project root directory            |

---

## Validation

```bash
# CLI
claude plugin validate .
claude plugin validate ./my-plugin

# In Claude Code
/plugin validate .
```

### Testing

```bash
# Load during development
claude --plugin-dir ./my-plugin
claude --plugin-dir ./plugin-one --plugin-dir ./plugin-two
```

---

## Enterprise Features

```json
{
  "enabledPlugins": {
    "code-formatter@company-tools": true
  },
  "extraKnownMarketplaces": {
    "company-tools": {
      "source": { "source": "github", "repo": "org/plugins" }
    }
  },
  "strictKnownMarketplaces": [
    { "source": "github", "repo": "acme-corp/approved-plugins" }
  ]
}
```

| Setting                              | Effect            |
| ------------------------------------ | ----------------- |
| `strictKnownMarketplaces: []`        | Complete lockdown |
| `strictKnownMarketplaces: [sources]` | Allowlist only    |
| `strictKnownMarketplaces: undefined` | No restrictions   |

---

## Constraints

- Plugins copied to cache, not used in-place
- Cannot reference files outside plugin directory (`../` fails)
- LSP servers require separate binary installation
- All paths must be relative, start with `./`
- Path traversal (`..`) not allowed
- Scripts must be executable (`chmod +x`)
- Reserved marketplace names: `claude-code-marketplace`, `anthropic-plugins`

---

## Private Repository Authentication

| Service   | Environment Variable         | Scope             |
| --------- | ---------------------------- | ----------------- |
| GitHub    | `GITHUB_TOKEN` or `GH_TOKEN` | `repo`            |
| GitLab    | `GITLAB_TOKEN` or `GL_TOKEN` | `read_repository` |
| Bitbucket | `BITBUCKET_TOKEN`            | read access       |

---

## Sources

- [Create Plugins](https://code.claude.com/docs/en/plugins)
- [Plugins Reference](https://code.claude.com/docs/en/plugins-reference)
- [Plugin Marketplaces](https://code.claude.com/docs/en/plugin-marketplaces)
- [Discover and Install Plugins](https://code.claude.com/docs/en/discover-plugins)

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…