What's Inside a Plugin Folder

Installing a Claude Code plugin takes one command, so the better question is how to look inside it first.

Three terms first. The manifest: a file called plugin.json that names the plugin. A hook: a command that runs by itself when something happens in your session. An MCP server: a program that plugs Claude into outside tools and data.

On disk, a plugin is just a folder — open it, and each kind of part has its own place inside. The shipping label is plugin.json, in a folder named .claude-plugin: it holds the plugin's name, a description, and sometimes a version. Only the name is required.

Slash commands are the parts you trigger yourself — each one is a markdown file in the commands folder; type /commit, and Claude follows the steps written in that file. Sub-agents are helpers with one job, each a markdown file in the agents folder — Claude hands one a multi-step task, it works through it on its own, then reports back. Skills are folders of know-how, each with a SKILL.md file — nothing to type; Claude reads each skill's description and opens one when the task matches.

Hooks fire on events: the hooks file says "when Claude edits a file, or finishes a turn, run this command." A security-guidance plugin uses hooks to check each edit for risky code — that's a real program, running on your machine. MCP servers are listed in .mcp.json — they plug Claude into outside tools and data, and start when the plugin is turned on; a GitHub plugin might hold one entry, GitHub's own server, reached with your access token.

A plugin carries only the parts it needs — a commit-commands plugin might be a label plus three slash commands; a GitHub plugin might be a label plus one MCP server. Nothing else. Plugins live in a marketplace, a catalog you install from — Anthropic's official one lists 255 as of late August 2026. But the catalog's own README says: make sure you trust a plugin before you install it. Anthropic doesn't control what's inside.

Your Turn: Paste into Claude Code: "Before I install the Claude Code plugin [name], read its folder. List every part it ships: plugin.json, commands, sub-agents, skills, hooks, and MCP servers. For each hook, give the event and the exact command it runs. For each MCP server, say where it connects and what keys it needs. Then list what it could read, change, or send off my machine. Don't install or run anything." Then check two things yourself: open hooks/hooks.json and read every command it runs, and open .mcp.json to confirm every server matches what the plugin says it does.

Sources: Anthropic, claude-plugins-official (the official Claude Code plugin directory; plugin count from its marketplace.json as of August 27, 2026); Anthropic, knowledge-work-plugins

0:00 The question, and three terms 0:23 The folder and its label 0:42 Slash commands 0:52 Sub-agents 1:02 Skills 1:12 Hooks 1:25 MCP servers 1:39 Only the parts it needs, and the marketplace 2:02 Your turn

Part of the Claude & Agentic AI series. @NikBearBrown

Deliberately Not Claimed

This video summarizes Anthropic's own published plugin directory structure and does not claim to cover every plugin field or configuration option that may exist. The plugin count cited (255) reflects the official marketplace.json as of August 27, 2026, and will change over time. It does not claim Anthropic vets or guarantees the safety of third-party plugin contents — the catalog's own README explicitly places that responsibility on the installer. Check the linked repositories for current, authoritative details.

SEO Keyword Tags

Claude Code plugin structure, plugin.json manifest, Claude Code hooks, Claude Code slash commands, Claude Code sub-agents, Claude Code skills folder, MCP server plugin, Claude plugin marketplace, inspect before installing plugin, Claude Code security, Anthropic plugin directory, Claude Code hooks.json, .mcp.json Claude, Claude plugin trust, Claude Code plugin anatomy

What this video covers

• 0:00 — The question, and three terms 0:23 The folder and its label 0:42 Slash commands 0:52 Sub-agents 1:02 Skills 1:12 Hooks 1:25 MCP servers 1:39 Only the parts it needs, and the marketplace 2:02 Your turn

Transcript

A lightly formatted transcript of the video, with timestamps so you can jump to any section on YouTube.

The question, and three terms 0:23 The folder and its label 0:42 Slash commands 0:52 Sub-agents 1:02 Skills 1:12 Hooks 1:25 MCP servers 1:39 Only the parts it needs, and the marketplace 2:02 Your turn

[0:00] Konnichiwa, this is Liam in for Bear, installing a plugin takes one command. So, the question isn't how to install one, it's how to look inside it first. Three terms: the manifest, a file called plugin.json that names the plugin, a hook, a command that runs by itself when something happens in your session, and an MCP server, a program that plugs Claude into outside tools and data. Here's the plugin box from last time. On disk, a plugin is just a folder. Open it and each kind of part has its own place inside. First, the shipping label, a file called plugin.json in a folder named .claudeplugin. It holds the plugin's name, a description, and sometimes a version. Only the name is required. Slash commands are the parts you trigger yourself. Each one is a markdown file in the commands folder. Type /commit and Claude follows the steps written in that file. Sub-agents are

Helpers with one job, and each one is a markdown file in the agents folder. Claude hands one a multi-step task. It works through it on its own, then reports back. Skills are folders of know-how, each with a skill.md file. You don't have to type anything. Claude reads each skill's description and opens one when the task matches. Hooks fire on events. The hooks file says, "When Claude edits a file or finishes a turn, run this command." The security guidance plugin uses hooks to check each edit for risky code. That's a real program running on your machine. MCP servers are listed in .mcp.json. They plug Claude into outside tools and data, and they start when the plugin is turned on. GitHub's plugin holds one entry, GitHub's own server, reached with your access token. And a plugin carries only the parts it needs. Commit Commands is a label and three slash commands. GitHub's

Is a label and one MCP server, nothing else. Plugins live in a marketplace, a catalog you install from. Anthropic's official one lists 255, but the catalog's own readme says, "Make sure you trust a plugin before you install it. Anthropic doesn't control what's inside." Your turn. Paste this into Claude code before I install the Claude code plugin name read its folder. List every part it ships, plugin.json, command sub agents, skills, hooks, and MCP servers. For each hook, give the event and the exact command it runs. For each MCP server, say where it connects and what keys it needs. Then list what it could read, change, or send off my machine. Don't install or run anything. Then check two things yourself. Open the hooks file and read every command it runs. And open .mcp.json. Does every server match what the plugin says it does? What's inside a plugin folder at Nick Bear Brown?