What to check before you install a Claude Code plugin

Direct answer

Before you install a Claude Code plugin, check which marketplace serves it, whether Anthropic’s official or community directory lists it, whether every channel served the same commit for the version you are about to get, whether an advisory names it, and which hooks, MCP servers and commands it adds. After install, compare the commit Claude Code recorded with HOL’s record.

Five checks

  1. Check 1

    Know which marketplace serves it

    Claude Code installs plugins from marketplaces: the official one it ships with, or git repositories you add. A plugin with the same name can exist in more than one. Open the listing and confirm the repository matches the marketplace you added.

    /plugin marketplace list

  2. Check 2

    Check whether Anthropic lists it

    Anthropic publishes its official marketplace and a community directory of plugins submitted through claude.ai that passed its review. Each HOL listing shows whether either list carries it today and since when.

  3. Check 3

    Check the release record for the version

    HOL records the commit each channel served for each version. A “channels differ”, “republished” or “version withdrawn” event on the version you are about to install is worth reading before you continue.

  4. Check 4

    Read what it runs

    Plugins can add hooks that run on every tool call, MCP servers, slash commands and skills. The listing’s scan shows which of these it declares and what the scanner found in the source.

  5. Check 5

    Compare after install

    HOL Guard reads the commit Claude Code recorded for your install and compares it with HOL’s record for that version. A difference is a warning only; Guard changes nothing.

    hol-guard plugin verify owner/plugin

What HOL recorded for Claude Code

Counted when this page loaded, from HOL’s directory reads and release ledger. Each listing page shows the same records for one plugin.

Directories HOL reads for Claude Code

Full list

Claude Code official marketplace

Read on : 315 entries, 81 of them matched to HOL listings.

Full list

Claude community directory

Read on : 2,283 entries, 217 of them matched to HOL listings.

Release records

In the last 30 days HOL recorded builds for 247 plugins on the channels Claude Code installs from, and noted 0 integrity events.

Advisories

HOL has published no advisory for Claude Code plugins. Advisories need two public sources.

Limitations

  • A directory listing, a matching build and a clean scan are records of what HOL saw. None of them says a plugin is harmless.
  • HOL compares what each channel served; it does not say which channel is right or why a build changed.
  • Advisories appear only when two public sources describe the incident.
  • Verify compares Claude Code installs only, and only when Claude Code kept the version and commit.

For publishers

Every record on this page is public and free. Listing owners can subscribe to a webhook for integrity events on their listing; with HOL Blue or Gold it arrives within minutes instead of in a weekly digest, so owners hear about a change before their users do. What a publisher pays never changes what HOL records or shows here.

Run the free directory pre-flight · Release integrity