{"slug": "what-a-claude-code-plugin-runs-before-you-type-we-read-2688-public-plugins", "title": "What a Claude Code plugin runs before you type: we read 2,688 public plugins", "summary": "An analysis of 2,688 public Claude Code plugins across 1,961 active repositories found that nearly a third run code automatically when a session starts, and that most MCP servers launched via npx or bunx pin no version. The review reports that 30.4% of repos include a SessionStart or Setup hook, local MCP server, or monitor, and that 112 of 171 npx/bunx-launched servers (65%) specify no version, allowing new package releases to reach users without any change to the reviewed plugin.", "body_md": "Before you install a Claude Code plugin, open three things in its folder: `hooks/hooks.json`, `.mcp.json` and `bin/`. Look for `SessionStart` hooks, and for MCP servers started with `npx` or `uvx` but no version number.\n\nThe reason is simple. A plugin can run code before you type anything. The docs say it directly: \"A Claude Code plugin you install can execute arbitrary code on your machine with your user privileges.\" Four parts of a plugin start on their own:\n\n`bin/`` PATH` of the shell Claude runs commands in.\nClaude Code runs all of these outside the sandbox, and installing a plugin also enables it.\n\nSo how many public plugins do this? We read every plugin in 1,961 active public repos.\n\n`hooks/hooks.json`, starting with `SessionStart` and `Setup`.`.mcp.json`.` command` is a process on your machine. If it runs `npx some-package` or `uvx some-package` with no version, the package manager resolves a version at start. A new release can then reach your machine without any change to the plugin you reviewed. Pinned means a version after the name: `@1.4.2` for npx, as in `npx -y some-package` plus `==1.4.2` for uvx, as in `some-package==1.4.2`.` claude --plugin-dir <plugin folder> plugin details <plugin name>`. It reads the plugin's files without starting a session and prints its hooks with their events, MCP and LSP servers, skills and agents.\nIf the plugin ships a mod, read our [review of 891 public mods](https://agentcraft.dev/en/blog/claude-code-mods-review-2026-11/) for what to check there. We don't repeat it here.\n\n`filename:plugin.json path:.claude-plugin`). Search returns at most 1,000 results per query, so we split the search into 40 file-size slices. We ran them in alternating order under a 30-minute cap and finished 23, which cover every size range. That gave 17,965 unique manifests, about 53% of the total, from 17,928 repos.`hooks` key, `mcpServers` key, `.lsp.json`, `monitors/monitors.json` and | What the plugin does | Repos (of 1,961) | Plugins, max 10 per repo | All plugins | \n|---|---|---|---|\n| Runs something when a session starts (SessionStart or Setup hook, local MCP server, or monitor) | 30.4% | 27.4% | 24.5% | \n| SessionStart or Setup shell hook | 16.0% | 14.3% | 12.8% | \n| …whose script writes files | 6.0% | 5.1% | 4.6% | \n| …whose script goes online | 1.5% | 1.2% | 1.1% | \n| Any shell hook | 22.2% | 20.1% | 18.5% | \n| UserPromptSubmit hook (sees each prompt, output goes to Claude) | 8.1% | 7.0% | 6.3% | \n| PreToolUse hook | 11.8% | 10.5% | 9.5% | \n| Declares MCP servers | 26.3% | 24.1% | 21.3% | \n| Local MCP server (a process on your machine) | 18.4% | 16.4% | 14.6% | \n| Remote MCP server (a URL) | 8.6% | 8.2% | 7.2% | \n| MCP server started by npx or bunx | 5.9% | 5.5% | 4.9% | \n| …with no version | 3.9% | 3.5% | 3.2% | \n| MCP server started by uvx with no version | 1.4% | 1.2% | 1.0% | \n| Any package-manager-started MCP server with no version | 5.3% | 4.7% | 4.2% | \n| Passes an environment variable named like a secret to an MCP server | 2.4% | 2.1% | 1.9% | \n| `bin/` folder on Claude's PATH | 9.5% | 8.0% | 7.1% | \n| Ships a mod (see the mods review) | 5.3% | 4.9% | 4.3% | \n| Monitors | 0.4% | 0.3% | 0.3% | \n| Sets `defaultEnabled: false` | 0.1% | 0.0% | 0.0% | \n\nQuick guess: of the MCP servers these plugins start with `npx` or `bunx`, how many name a version? About one in three. Of 171 such servers, 112 (65%) name none: they use `@latest`, a bare package name, or a GitHub reference. 149 (87%) pass `-y`, which skips npm's install prompt. Across all 945 MCP servers, the most common kinds are remote URLs (445), local scripts in the plugin (176) and `npx` (164).\n\nA few examples, without names:\n\n`node`, `bash` or `python3`, with file names like `session-start`, `resume-hint` or `context-inject`. Of the 29 repos whose session-start script goes online, 26 check for updates against GitHub or npm, and several talk to their own service on `localhost`. Around ten mention telemetry or analytics; we did not check what they send.`ANTHROPIC_API_KEY` and sends a slice of the conversation to judge it. Its comments say so. It spends your quota and sends your conversation, which you may want to know before installing.`~/.ssh` or `.env` were mostly guards that list those paths in order to block them.\nNone of the plugins our rules flagged looked malicious when we read them.\n\nThe number of components. A plugin with twenty hooks can be a careful guard, and a plugin with one SessionStart script and an unpinned `npx` server is the one to read closely. Look at what starts by itself and what it fetches.\n\nThe counts above, in all three weightings, are in [plugin-startup-2026-11.json](https://agentcraft.dev/data/plugin-startup-2026-11.json). Repo and plugin names are left out. To check a plugin yourself, run `claude --plugin-dir <plugin folder> plugin details <plugin name>` and read the files it lists.\n\nFor skills you choose to install yourself, the [AgentCraft skills directory](https://agentcraft.dev/en/skills/) lists 5,101 Claude Code skills, and every community skill is reviewed before it's listed.\n\nThe full post is on AgentCraft: [https://agentcraft.dev/en/blog/claude-code-plugin-startup-2026-11/](https://agentcraft.dev/en/blog/claude-code-plugin-startup-2026-11/)\n\nDisclosure: I'm Adrian Vale and I help run AgentCraft.", "url": "https://wpnews.pro/news/what-a-claude-code-plugin-runs-before-you-type-we-read-2688-public-plugins", "canonical_source": "https://dev.to/adrian2016/what-a-claude-code-plugin-runs-before-you-type-we-read-2688-public-plugins-4agn", "published_at": "2026-11-06 00:17:55+00:00", "updated_at": "2026-11-06 00:22:35.326051+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "ai-safety", "developer-tools", "agent-protocols"], "entities": ["Claude Code", "Anthropic", "npm", "npx", "uvx", "GitHub"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/what-a-claude-code-plugin-runs-before-you-type-we-read-2688-public-plugins", "markdown": "https://wpnews.pro/news/what-a-claude-code-plugin-runs-before-you-type-we-read-2688-public-plugins.md", "text": "https://wpnews.pro/news/what-a-claude-code-plugin-runs-before-you-type-we-read-2688-public-plugins.txt", "jsonld": "https://wpnews.pro/news/what-a-claude-code-plugin-runs-before-you-type-we-read-2688-public-plugins.jsonld"}}