Claude Code plugins¶

ID: claude-code-plugins
Home page: https://docs.claude.com/en/docs/claude-code/plugins
Platforms: 🐧 Linux · 🍎 macOS · 🪟 Windows
Operations: installed · install · upgrade · remove · sync · cleanup
purl types: pkg:claude-code-plugins
CLI name: claude
Issues and PRs: 📦 manager: claude-code-plugins
Source: meta_package_manager/managers/claude_code_plugins.toml

Claude Code’s own plugin system (https://docs.claude.com/en/docs/claude-code/plugins), driven through the claude plugin command surface.

A package is a plugin identified as name@marketplace, and every verb takes that form: it is what the listing reports and what install, uninstall and update all accept, so ids round-trip without translation. A marketplace is the registry, added from a URL, a path or a GitHub repository, and several can be configured at once, which is why the marketplace half of the id is part of the identity rather than decoration.

Parsing notes, verified against Claude Code 2.1.236 on macOS:

The inventory is claude plugin list --json. The default output is a multi-line record per plugin, an ❯ id line followed by indented Version:, Scope: and Status: lines, which no per-line pattern can reduce. The JSON form is a flat top-level array carrying both fields this needs.
claude plugin list --json --available is not a search source: it answers with an object keyed installed and available rather than an array, so declaring search would pull the whole manager into a class.
No upgrade_all: claude plugin update requires a plugin argument and offers no --all.
No outdated: nothing reports staleness without acting on it.
sync refreshes every configured marketplace at once, update taking an optional name and updating all of them when given none.

Note

claude plugin prune --dry-run lists the auto-installed dependencies that cleanup_orphan removes, which is the shape orphans wants. It is left undeclared because no populated sample could be captured: the drive host had no auto-installed plugin to strand.

What `mpm` adds to `claude-code-plugins`¶

mpm reaches across every manager at once, not claude-code-plugins alone: mpm installed and mpm outdated cover claude-code-plugins alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `claude-code-plugins` commands, in `mpm`¶

You already know claude-code-plugins: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `claude-code-plugins`	With `mpm`
List what’s installed	`claude plugin list --json`	`mpm --claude-code-plugins installed`
Install a package	`claude plugin install <package_id>`	`mpm install pkg:claude-code-plugins/<package_id>`
Upgrade one package	`claude plugin update <package_id>`	`mpm --claude-code-plugins upgrade <package_id>`
Remove a package	`claude plugin uninstall <package_id>`	`mpm remove pkg:claude-code-plugins/<package_id>`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✓
`outdated`
`orphans`
`search`
`install`	✓
`upgrade`	✓
`upgrade_all`
`remove`	✓
`sync`	✓
`cleanup`	✓	`--orphans` runs the system-wide orphan sweep
`doctor`

Selecting and configuring `claude-code-plugins`¶

Deselect claude-code-plugins for a single run with --no-claude-code-plugins, or persist the choice in your configuration:

[mpm]
claude-code-plugins = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.claude-code-plugins]
timeout = 900

mpm config-template claude-code-plugins prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around claude-code-plugins, one mpm command each:

Snapshot and clone a machine: mpm --claude-code-plugins dump claude-code-plugins.toml, then mpm restore claude-code-plugins.toml on the next one.
Export a compliance SBOM: mpm --claude-code-plugins sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations needs root.

See privilege escalation for the full policy.

Cooldown¶

State of Claude Code plugins’s release-age gating, from the cooldown support table:

Status: ❌ None (marketplace manifests carry no publication date)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: Claude Code marketplaces
Retraction: Manifest edit: a marketplace is a git repository listing its plugins, so a version is withdrawn by its owner dropping the entry or retagging, with no index in between
Publish date: ❌ neither the listing nor a marketplace manifest carries a publication date

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Version probe¶

The version is probed by running:

$ claude --version
2.1.236 (Claude Code)

and extracted with:

r"(?P<version>\d+\.\d+\.\d+)\s+\(Claude Code\)"

Reference traces¶

Raw native outputs captured in the bundled definition: the reference mpm’s parsers were written against. If you know Claude Code plugins well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ claude plugin list --json
[
  {
    "id": "pyright-lsp@claude-plugins-official",
    "version": "1.0.0",
    "scope": "user",
    "enabled": true,
    "installPath": "/tmp/mpm-drive/.claude/plugins/cache/claude-plugins-official/pyright-lsp/1.0.0",
    "installedAt": "2026-08-30T19:20:57.593Z",
    "lastUpdated": "2026-08-30T19:20:57.593Z"
  }
]

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --claude-code-plugins installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog¶

8.0.0.dev0 (unreleased)
- Add Claude Code plugins manager, with inventory, install, remove, single-plugin upgrade, marketplace sync and orphan cleanup.