Claude Code plugins are bundled packages that ship one or more skills, hooks, MCP server configs, and slash commands together as a single install. Open the browser with /plugin, pick something from the Discover tab, choose a scope, done. Reach for a plugin (rather than a bare skill) when you want event hooks or tool integrations to come along for the ride.
Searches for "claude code plugins" climbed past four thousand a month through 2025, and most of those people are trying to answer one of two questions: what exactly a plugin is, or how to install the right one. This guide answers both in plain terms, walks the /plugin browser end to end, explains how plugins differ from skills, hooks, and MCP servers, and lists the kinds of plugins that pay for themselves on day one. If you have hit the "skill locked by plugin" error, there is a fix near the end too.
Claude Code Plugins, in Plain Terms
A Claude Code plugin is a directory that bundles extensions and ships them as one unit. Inside, a plugin can contain:
- One or more skills:
SKILL.mdfiles that add instructions Claude follows in specific situations - Hooks: shell commands the agent fires automatically on events (before a tool call, after a file edit, on session start)
- MCP server configurations: pre-wired connections to databases, APIs, and external services
- Slash commands: custom
/your-commandentries that trigger specific workflows - Settings overrides: project-level config the plugin needs to function
When you install the plugin, all of those parts land together in your Claude Code session, ready to use. That is the entire idea: a skill is the atomic unit, a plugin is the wrapper that lets you ship a skill along with the hooks and tool integrations it needs in order to actually work.
Plugins vs Skills vs Hooks vs MCP: Which Builds On Which
The Claude Code extension surface has four moving parts and they nest. Knowing the hierarchy saves an evening of "do I need a skill or a plugin" wheel-spinning.
| Concept | What it actually is | When to reach for it |
|---|---|---|
| Skill | One SKILL.md file: YAML frontmatter + markdown instructions |
You only need to give Claude a way to behave in a situation |
| Hook | A shell command tied to an agent event (PreToolUse, PostToolUse, Stop, etc.) | You need to run real code on event, not just give instructions |
| MCP server | An external process exposing tools over the Model Context Protocol | You want the agent to call real tools (DB, GitHub, Slack) |
| Plugin | A directory bundling any combination of the above | You want to ship two or more of the above as one install |
A worked example: a "test-driven deploy" plugin might bundle a skill (the TDD discipline instructions), a hook (auto-run the test suite after every file edit), an MCP server config (your CI provider), and a slash command (/ship). None of those four pieces work as well alone; together they make a deploy workflow that survives a fresh laptop.
The /plugin Browser, End to End
Plugins live behind a single slash command. Type /plugin in any Claude Code session and the interactive browser opens with four tabs.
- Discover: every plugin from every marketplace you have connected. Arrow-navigate, press Enter to install.
- Installed: what you already have, with version, source, and an uninstall option per plugin.
- Marketplaces: add, remove, or refresh the catalogs Discover pulls from.
- Errors: anything that failed to load, with the reason. Check here first when a plugin "does not seem to be working."
When you install something, Claude Code asks for a scope:
| Scope | Where it goes | Who gets it |
|---|---|---|
| User | ~/.claude/ |
You, in every project you open |
| Project | .claude/ in the repo root |
Everyone who clones the repo |
| Local | .claude.local/ |
You, this machine, not committed |
Pick deliberately. A plugin that needs a personal API key belongs in user or local scope. A plugin that encodes team conventions (lint rules, review checklist) belongs in project scope so a teammate's clone has it without extra setup.
Adding a Third-Party Plugin Marketplace
The official marketplace is wired up by default. Pulling in community marketplaces is one command.
/plugin marketplace add owner/repo
The argument can be a GitHub owner/repo shorthand, a full git URL, a local directory path, or a remote URL pointing at a marketplace manifest. Once added, that marketplace's plugins show up under the Discover tab. Remove a marketplace the same way (/plugin marketplace remove), or refresh it to pick up new releases.
The same plugin can exist in multiple marketplaces. If names collide, the marketplace added most recently wins for Discover; the one already installed locally keeps running until you reinstall.
Anatomy of a Plugin (and When to Build One Yourself)
Open any installed plugin directory and you will see a small, predictable layout:
my-plugin/
plugin.json # name, version, description, author
skills/
review.md # one or more SKILL.md files
hooks/
pre-tool-use.json # event → shell command mappings
mcp/
config.json # MCP server entries
commands/
ship.md # slash commands
Only the top-level plugin.json manifest and at least one of the child directories are strictly required. Everything else is optional. Build a plugin (instead of a bare skill) when any one of these is true:
- The instructions only work if a hook runs alongside (for example, a coding-standard skill that needs to lint on save)
- The behavior depends on an MCP server being connected to a specific service
- You want to expose a custom slash command, which a bare skill cannot do
- You are shipping this to a team and want one install, not four files
For anything simpler, a single SKILL.md in ~/.claude/skills/ is enough; see our guide on how to add skills to Claude Code for the file-based path.
Plugins Worth Installing First
The ecosystem is large and uneven. Start with one or two from these categories before adding more.
- Code review: a reviewer plugin that bundles the review skill + a hook that auto-runs it on pre-commit. Catches issues before they ever reach a PR.
- Test-driven workflow: a TDD plugin pairing the discipline skill with a hook that runs your test suite after edits. The hook is the part that actually keeps you honest.
- Database: a Postgres or SQLite plugin that wires up the MCP server and ships a skill teaching the agent to use it (read schemas before writing migrations).
- Deployment: a deploy plugin with a
/shipslash command, a pre-deploy checklist skill, and CI hooks.
For cross-agent skills with automated security scanning at publish time, the PolySkill registry is the searchable catalog; plugins bundling those skills install the same way through /plugin.
Common Errors, Starting With "Locked by Plugin"
"Skill locked by plugin"
This error means the skill you tried to edit or delete is owned by an installed plugin. The plugin manages its own files; touching them by hand gets reverted on the next plugin update. Fix: run /plugin, switch to the Installed tab, find the owning plugin, and either uninstall it (if you do not want the skill at all), update it (if the upstream maintainer fixed your issue), or fork it (if you need a permanent custom version).
Plugin installs but its skills do not appear
Check the Errors tab in /plugin. Most often this is a manifest field missing in plugin.json, or a SKILL.md with malformed YAML frontmatter (tabs instead of spaces, an unquoted colon). The error message names the offending file.
Hook fires but does nothing
Hooks are shell commands; if the binary they call is not on the PATH that Claude Code inherits, the hook silently no-ops. Either use absolute paths in the hook command, or set the PATH explicitly inside the hook script.
MCP server in a plugin will not connect
Run claude mcp list outside the plugin context. If the server's start command does not run in a plain terminal, the plugin's MCP config is not the problem; the server itself is broken. See our Claude Code MCP guide for the deeper troubleshooting tree.
How to Pick Your First Two Plugins
Skip the temptation to install ten plugins on day one. Pick the two that target your most repeated annoyance: the small task you keep doing manually that a hook could automate, and the conversation you keep having with Claude that a skill could replace. A week of those two will teach you what a third plugin actually needs to do, which is the right time to add it. An over-stuffed Installed tab is just slow load times and forgotten capabilities.
Continue here: How to Add Skills to Claude Code (2026) | Claude Code MCP: Add & Configure MCP Servers (2026) | Claude Code Marketplace (2026) | Claude Code Router (2026)
Claude Code Plugins FAQ
What are Claude Code plugins?
A Claude Code plugin is a bundled package that can ship one or more skills (SKILL.md files), hooks (shell commands fired on agent events), MCP server configurations, and slash commands together. You install the plugin once and all those parts arrive in your Claude Code session. Plugins are how Claude Code's built-in marketplace distributes extensions; a skill is the atomic unit inside, a plugin is the wrapper.
How do I install a Claude Code plugin?
Run /plugin inside any Claude Code session. The interactive browser opens with a Discover tab; press Enter on a plugin to install it. Pick a scope when prompted: user (all your projects), project (committed to the repo so the team gets it), or local (this machine, not committed). To pull in plugins from outside the official marketplace, run /plugin marketplace add owner/repo first.
What is the difference between a plugin and a skill?
A skill is a single SKILL.md file: YAML frontmatter plus markdown instructions that tell Claude how to behave. A plugin is a directory that can bundle one or more skills alongside hooks, MCP server configs, and slash commands. If you only need to add instructions, write a skill. If you need to ship instructions plus event hooks or tool integrations together, build a plugin.
Why does my Claude Code skill say "locked by plugin"?
That message means a plugin you installed owns the skill, so you cannot edit or remove the SKILL.md file directly. Manage it through the plugin: run /plugin, find the plugin under the Installed tab, and uninstall or update it from there. Editing files inside a plugin directory by hand is unsupported and changes get reverted on the next plugin update.
Are Claude Code plugins safe?
Plugins can include shell commands via hooks and tool integrations via MCP, so they run with whatever permissions you grant. Treat a plugin like any dependency: prefer plugins from the official marketplace or sources that publish through the PolySkill registry, which runs static security scanning on every published item for credential exfiltration, pipe-to-shell, and destructive command patterns. Read what a plugin does before installing it.