anthropics/claude-plugins-community Is Not a Plugin Repo. It Is a Gate.
A read-only marketplace mirror, pinned source references, and a private review pipeline turn Claude's plugin ecosystem into a curated catalog instead of an open code dump.
- This repository turns discovery into the public surface and approval into the private one.
- Pinned SHAs and source pointers make the marketplace behave like a lockfile, not a code host.
- Closed external PRs protect a supply chain that can execute code, not just describe it.
- The deeper pattern is a curated registry for agent capabilities, not a conventional open source contribution model.
Most plugin repositories are built to welcome pull requests. anthropics/claude-plugins-community does the opposite. It is public enough to inspect, but closed enough to keep the actual approval path somewhere else.
That matters because Claude Code can install and run third-party tools. Once a catalog becomes executable, the governance question stops being theoretical. Anthropic is separating discovery from approval so the catalog stays legible without becoming a supply-chain free-for-all.
claude plugin marketplace add anthropics/claude-plugins-communityThis morning, some internal source code was included in a Claude Code release. No sensitive customer data or credentials were exposed, and this was a human error in release packaging, not a security breach.
A marketplace made of pointers
The heart of the repo is .claude-plugin/marketplace.json. The entries read less like source files and more like registry records: a name, a description, a source location, a homepage, and sometimes a pinned SHA. Some point to a whole Git repo. Others point to a subdirectory inside a larger monorepo through git-subdir.
That design turns the marketplace into a lockfile for plugins. The catalog tells Claude where to fetch a tool and which revision to trust, but it does not host the tool itself.
Why the mirror exists
The other half of the story sits in .github/workflows/close-external-prs.yml. Public contributors can look around, but external pull requests are automatically commented on and closed. The repository stays readable while the approval path stays internal.
That split is not just bureaucracy. For a system that can execute code, a public mirror is easier to audit than a public contribution surface. Review happens before the entry reaches the mirror, and the SHA pin makes the approved version stick.
What changes when code becomes catalog entries
Once the repository is treated as a registry, the user experience changes too. Users add the marketplace to Claude Code, then choose from curated entries instead of browsing raw source. The repository becomes a trust layer, not a build target.
| Dimension | Traditional open plugin repo | anthropics/claude-plugins-community |
|---|---|---|
| Who can submit | Anyone with a pull request | External authors route through a private submission pipeline |
| What the repo stores | Plugin code and docs | Registry entries, source pointers, and pinned SHAs |
| Where trust is decided | Inside the public repo itself | Before sync, during internal review and scanning |
| How updates land | Direct edits to the codebase | Mirror updates after approval |
| What users install | Source they inspect | Curated listings they can trust |
| Risk profile | A wider supply chain surface | A narrower, pinned distribution surface |
That is the subtle product move here. Anthropic is not asking users to trust every maintainer equally. It is asking them to trust the catalog curation and the pinned reference behind each listing.
The design choice behind the shutdown of PRs
A public mirror gives outsiders visibility without handing them the steering wheel. It lets Anthropic show the community what is available, while keeping the actual gate inside the submission pipeline. That is a strong security posture for software that can touch files, shells, and external services.
What this says about agent platforms
This repo points to a broader pattern. As agents become more capable, the interface that matters is not the code host but the trust registry. Discovery can stay public. Approval can stay closed. The winning product shape starts to look like a curated app store with pinned dependencies.
That is the real inversion here. The catalog is the product. The code lives elsewhere.
