Before you install a Claude Code plugin, open three things in its folder: hooks/hooks.json, .mcp.json and bin/. Look for SessionStart hooks, and for MCP servers started with npx or uvx but no version number.
The reason is simple. A plugin can run code before you type anything. The docs say it directly: "A Claude Code plugin you install can execute arbitrary code on your machine with your user privileges." Four parts of a plugin start on their own:
bin/`` PATH of the shell Claude runs commands in.
Claude Code runs all of these outside the sandbox, and installing a plugin also enables it.
So how many public plugins do this? We read every plugin in 1,961 active public repos.
hooks/hooks.json, starting with SessionStart and Setup..mcp.json. command is a process on your machine. If it runs npx some-package or uvx some-package with no version, the package manager resolves a version at start. A new release can then reach your machine without any change to the plugin you reviewed. Pinned means a version after the name: @1.4.2 for npx, as in npx -y some-package plus ==1.4.2 for uvx, as in some-package==1.4.2. claude --plugin-dir <plugin folder> plugin details <plugin name>. It reads the plugin's files without starting a session and prints its hooks with their events, MCP and LSP servers, skills and agents.
If the plugin ships a mod, read our review of 891 public mods for what to check there. We don't repeat it here.
filename:plugin.json path:.claude-plugin). Search returns at most 1,000 results per query, so we split the search into 40 file-size slices. We ran them in alternating order under a 30-minute cap and finished 23, which cover every size range. That gave 17,965 unique manifests, about 53% of the total, from 17,928 repos.hooks key, mcpServers key, .lsp.json, monitors/monitors.json and | What the plugin does | Repos (of 1,961) | Plugins, max 10 per repo | All plugins |
|---|---|---|---|
| Runs something when a session starts (SessionStart or Setup hook, local MCP server, or monitor) | 30.4% | 27.4% | 24.5% |
| SessionStart or Setup shell hook | 16.0% | 14.3% | 12.8% |
| …whose script writes files | 6.0% | 5.1% | 4.6% |
| …whose script goes online | 1.5% | 1.2% | 1.1% |
| Any shell hook | 22.2% | 20.1% | 18.5% |
| UserPromptSubmit hook (sees each prompt, output goes to Claude) | 8.1% | 7.0% | 6.3% |
| PreToolUse hook | 11.8% | 10.5% | 9.5% |
| Declares MCP servers | 26.3% | 24.1% | 21.3% |
| Local MCP server (a process on your machine) | 18.4% | 16.4% | 14.6% |
| Remote MCP server (a URL) | 8.6% | 8.2% | 7.2% |
| MCP server started by npx or bunx | 5.9% | 5.5% | 4.9% |
| …with no version | 3.9% | 3.5% | 3.2% |
| MCP server started by uvx with no version | 1.4% | 1.2% | 1.0% |
| Any package-manager-started MCP server with no version | 5.3% | 4.7% | 4.2% |
| Passes an environment variable named like a secret to an MCP server | 2.4% | 2.1% | 1.9% |
| bin/ folder on Claude's PATH | 9.5% | 8.0% | 7.1% |
| Ships a mod (see the mods review) | 5.3% | 4.9% | 4.3% |
| Monitors | 0.4% | 0.3% | 0.3% |
| Sets defaultEnabled: false | 0.1% | 0.0% | 0.0% |
Quick guess: of the MCP servers these plugins start with npx or bunx, how many name a version? About one in three. Of 171 such servers, 112 (65%) name none: they use @latest, a bare package name, or a GitHub reference. 149 (87%) pass -y, which skips npm's install prompt. Across all 945 MCP servers, the most common kinds are remote URLs (445), local scripts in the plugin (176) and npx (164).
A few examples, without names:
node, bash or python3, with file names like session-start, resume-hint or context-inject. Of the 29 repos whose session-start script goes online, 26 check for updates against GitHub or npm, and several talk to their own service on localhost. Around ten mention telemetry or analytics; we did not check what they send.ANTHROPIC_API_KEY and sends a slice of the conversation to judge it. Its comments say so. It spends your quota and sends your conversation, which you may want to know before installing.~/.ssh or .env were mostly guards that list those paths in order to block them.
None of the plugins our rules flagged looked malicious when we read them.
The number of components. A plugin with twenty hooks can be a careful guard, and a plugin with one SessionStart script and an unpinned npx server is the one to read closely. Look at what starts by itself and what it fetches.
The counts above, in all three weightings, are in plugin-startup-2026-11.json. Repo and plugin names are left out. To check a plugin yourself, run claude --plugin-dir <plugin folder> plugin details <plugin name> and read the files it lists.
For skills you choose to install yourself, the [AgentCraft skills directory](https://agentcraft.dev/en/skills/) lists 5,101 Claude Code skills, and every community skill is reviewed before it's listed.
The full post is on AgentCraft: [https://agentcraft.dev/en/blog/claude-code-plugin-startup-2026-11/](https://agentcraft.dev/en/blog/claude-code-plugin-startup-2026-11/)
Disclosure: I'm Adrian Vale and I help run AgentCraft.