The 5 Official Claude Plugins, Explained
Anthropic — the company that makes Claude — ships five official plugins for Claude Code: a security scanner that argues with its own findings, a setup advisor that reads your repo, a CLAUDE.md gardener, an agent SDK dev kit, and real C/C++ code intelligence. Here’s what each one does, where the official list lives, and the stale plugin names you should stop hunting for.
Explain it like I’m five
Imagine your toy robot can already do a lot of tricks. Now imagine the people who built the robot hand you five special power-up packs — one that checks your toy house for broken parts, one that reads the instructions for you, one that keeps your notebook tidy, one that teaches you to build your own robots, and one that helps the robot understand a language it didn’t speak before.
That’s what these are. Plugins are add-on packs for Claude Code that bundle new abilities — agents, skills, commands, hooks, and server connections — into one installable unit. And official means Anthropic itself wrote them: the robot’s own builders, not a stranger on the internet. There are exactly five of them, and almost nobody has them installed.
Why official matters
A plugin is not a theme or a skin — it’s a bundle of agents, skills, commands, hooks, and MCP server configurations that runs inside your Claude Code session with your permissions. That makes the author the single most important thing about any plugin.
Official plugins are authored by Anthropic. The official marketplace manifest — the machine-readable list of what’s actually in the store — lives in public on GitHub at anthropics/claude-plugins-official, and every entry there carries "author": {"name": "Anthropic"}. If the plugin you’re about to install doesn’t trace back to that manifest, you’re installing a third party’s code with your credentials — review the source first.
One more thing worth knowing, because it will save you a frustrating half hour: popular third-party guides list stale names. Names like frontend-design, security-guidance, commit-commands, hookify, pr-review-toolkit, feature-dev, and code-review appear in older tutorials but none of them appear in the current official manifest — and security-guidance appears to have become claude-security. So if a guide tells you to install one of those ghosts, the guide is out of date, not your setup. The five real ones are below.
The only plugins you can trust without reading the source are the ones in Anthropic’s official marketplace manifest — and as of this writing, there are exactly five.
The five plugins
Each entry below comes from Anthropic’s own description in the official marketplace manifest. Five plugins, five jobs, no filler.
Runs deep vulnerability scans on your code right inside a Claude Code session. The unusual part is the skepticism: it challenges every finding before reporting it, so the noise gets filtered before it reaches you. Findings that survive become verified patches you apply when you choose — a security reviewer that argues with itself first.
Analyzes your codebase and recommends tailored automations for it — hooks, skills, MCP servers, and subagents. Point it at your repo and it reads how the project is actually structured, then tells you exactly which automation pieces fit. A personalized setup plan instead of a generic checklist.
Keeps your CLAUDE.md project files healthy: audits their quality, captures learnings from your sessions, and keeps project memory current. Your CLAUDE.md is your project’s memory — and memory rots without a gardener.
The development kit for building agents with the Claude Agent SDK. If you want to build your own agents instead of just using Claude Code’s, this is the official playbook Anthropic ships for agent builders.
Adds the clangd C/C++ language server so Claude Code gets real code intelligence — go-to-definition, references, and the rest — for C/C++. Not guessing at symbols from text; actual language-server semantics wired into the session.
Five plugins, one per real need: secure the code, set up the project, maintain the memory, build new agents, understand C and C++. If none of those is your bottleneck, you don’t need any of them.
Source: the official plugin marketplace manifest on GitHub — check it for the current list ↗How to install them
They’re distributed through Anthropic’s official plugin marketplace. The one rule that matters: install only the plugins you’ll actually use.
For the exact install command, verify against Anthropic’s docs at code.claude.com first — plugin installation syntax has changed before and will change again, and a stale command from a tutorial is worse than no command. What won’t go stale is the shape of the manifest itself: each plugin entry names the plugin, describes it, and declares its author.
// marketplace.json — one entry per official plugin
{
"name": "claude-security",
"author": { "name": "Anthropic" },
"description": "Deep vulnerability scans ..."
}
// five entries today: claude-security, claude-code-setup,
// claude-md-management, agent-sdk-dev, clangd-lspA plugin you never load is just clutter — and every installed plugin is more code running with your permissions. The security plugin scans your vulnerabilities; make sure you’re not introducing one by installing five plugins when you needed one.
FAQ
security-guidance shows up in older guides but isn’t in the current official manifest — it appears to have become claude-security. If a tutorial tells you to install security-guidance, follow claude-security in the official marketplace instead.
Nowhere official. Names like frontend-design, commit-commands, hookify, pr-review-toolkit, feature-dev, and code-review appear in stale third-party guides but not in the current official manifest. Don’t hunt for ghosts — check the manifest.
No. Install only what you’ll use. Writing Python web apps? The C/C++ language server buys you nothing. The honest test: can you name the task you’d run it on this week? If not, skip it — you can always install it later.
A plugin is a bundle — it can ship agents, skills, commands, hooks, and MCP server configs together as one installable unit. A skill is a single reusable playbook inside (or outside) that bundle. Plugins are the shipping container; skills are the cargo. We go deep on this distinction in the next guide.
Cautiously, and only after reading the source. Plugins run with your permissions: hooks execute commands, MCP configs reach your accounts. Prefer official plugins when they cover your need, and treat every third-party install like adding a dependency — review the code, check the permissions, and install the minimum.
The marketplace manifest on GitHub at anthropics/claude-plugins-official — linked above. It’s the source of truth; blog posts (this one included) go stale, manifests don’t pretend otherwise.
Key takeaways
- Anthropic ships exactly five official Claude Code plugins: claude-security, claude-code-setup, claude-md-management, agent-sdk-dev, and clangd-lsp — each author-stamped in the public marketplace manifest.
- claude-security scans for vulnerabilities and challenges its own findings before reporting; only surviving findings become verified patches.
- claude-code-setup reads your repo and recommends the automations that actually fit it — hooks, skills, MCP servers, subagents.
- claude-md-management is a gardener for your CLAUDE.md: audits it, captures session learnings, keeps project memory current.
- Stale guides list ghost names (frontend-design, security-guidance, hookify, pr-review-toolkit, feature-dev, code-review) — none are in the current official manifest; security-guidance appears to have become claude-security.
- Install only what you’ll use: verify install commands against code.claude.com docs, and treat every plugin like a dependency — it runs with your permissions.