The official directory is a catalogue, not a trust seal
At commit fa59bc9, the marketplace file listed 314 plugins. Anthropic maintains the directory and the entries under /plugins, while partner and community work also appears locally or through pinned Git sources. Claude Code users get one familiar install command and a Discover screen instead of hunting through unrelated repositories. That is the useful promise: one front door.
The README puts a warning beside that convenience. Anthropic says it does not control the MCP servers, files, or other software included in plugins and cannot promise that they work as intended or stay unchanged. Directory acceptance therefore answers a narrower question than a security review. A plugin that can run a hook, start a process, or reach an account still needs the same supplier check you would give any other dependency.
The 314 entries use several execution models
The marketplace snapshot contained 38 local Anthropic plugins, 14 local external plugins, and 262 entries that pointed to Git repositories. Those remote records can name a repository, subdirectory, branch or tag, and commit SHA. Fourteen entries used the non-strict skill-bundle route, which lets selected SKILL.md folders become namespaced Claude Code skills without a conventional plugin manifest.
That variety is useful, but it defeats any single setup story. One entry can be text instructions. Another can start Bun, Python, a language server, or an MCP process and then ask for account credentials. Immutable plugin names protect installed configurations from casual renames, and the top-level renames map handles deliberate migrations. Neither mechanism says what the plugin will execute after installation.
What happened when we ran it
Our sandbox cloned commit fa59bc9 and entered external_plugins/discord, the runnable Node and Bun project selected by the lab. On 3 CPUs with 8 GB of RAM, Bun installed 130 packages in 49 seconds. Dependencies occupied 52 MB. The full checkout was 10.2 MB, with 540 files and about 48,506 source lines.
There was no build script or target, so the build stage was skipped. There was also no test script or target, and the test stage was skipped for the same reason. We did not substitute an invented command. The result proves that dependency installation completed in our unprivileged Debian container; it does not prove that the Discord bridge can log in, exchange messages, or enforce its access rules.
The repository signals showed 9 CI workflow files, no Dockerfile, and no tests directory. Those workflows include plugin validation, license checks, frontmatter checks, MCP URL checks, and scanning. They are useful catalogue controls. They do not turn the unrun Discord behavior into a passing test result, and they say nothing about code fetched from 262 outside Git sources after those sources change.
The Discord entry needs a bot token and an access policy
Version 0.0.4 of the Discord plugin connects a bot to Claude Code through MCP. It gives the assistant 5 tools for replies, reactions, edits, history, and attachment downloads. History fetches are capped at 100 messages. Replies can attach up to 10 files of 25 MB each, while inbound attachments stay untouched until the assistant requests a download.
Getting there takes more than /plugin install. You need Bun, a Discord application, Message Content Intent, a resettable bot token, and a server shared with the bot. Claude Code must relaunch with --channels plugin:discord@claude-plugins-official. The token can live in ~/.claude/channels/discord/.env, and the code attempts to restrict that file to its owner on systems that support Unix permissions.
Unknown direct-message senders receive pairing codes under the default policy. After approving the intended account, the documentation tells you to switch to allowlist, which drops other senders silently. Guild channels are disabled until added by numeric channel ID, and mention requirements can narrow them further. These are sensible controls, yet they protect the channel boundary only. The Claude session behind the bot still has whatever local tools and files its operator allowed.
A September 28 push shows activity, while 1,037 open items need triage
GitHub showed 37,168 stars and a September 28, 2026 push when we checked on September 29. Its combined open count was 1,037: search separated that into 1,017 issues and 20 pull requests. Recent activity included a Discord and Telegram fix for Windows-style line endings, a new plugin submission, and reports against Anthropic-maintained plugins. The project is active, although the queue is large.
There is no published GitHub release to anchor an upgrade policy. Issue 1870, updated on September 28, reports plugins marked as published in submissions but still missing from the public directory. That report matters mainly to authors, while users should watch the exact source and SHA recorded for an entry. A recent repository push can update catalogue metadata without proving that every listed plugin is healthy.
Use the directory to build a smaller allowlist
Claude Plugins Official is the natural first stop for a Claude Code user because its 314 entries speak the host's own install format. Start with the Anthropic-maintained subset when it meets the job. For an external entry, inspect the owner, pinned source, executable commands, MCP endpoints, requested credentials, hooks, and update path before installation.
A small team can record those decisions beside its Claude configuration. A larger organization should copy approved entries into a private marketplace and retest them when the pinned SHA changes. Our 49-second Discord install makes a candidate easy to try. The missing build and test targets are the reason approval still belongs to your own review.