# What a Claude Code plugin runs before you type: we read 2,688 public plugins > Source: > Published: 2026-11-06 00:17:55+00:00 Before you install a Claude Code plugin, open three things in its folder: `hooks/hooks.json`, `.mcp.json` and `bin/`. Look for `SessionStart` hooks, and for MCP servers started with `npx` or `uvx` but no version number. The reason is simple. A plugin can run code before you type anything. The docs say it directly: "A Claude Code plugin you install can execute arbitrary code on your machine with your user privileges." Four parts of a plugin start on their own: `bin/`` PATH` of the shell Claude runs commands in. Claude Code runs all of these outside the sandbox, and installing a plugin also enables it. So how many public plugins do this? We read every plugin in 1,961 active public repos. `hooks/hooks.json`, starting with `SessionStart` and `Setup`.`.mcp.json`.` command` is a process on your machine. If it runs `npx some-package` or `uvx some-package` with no version, the package manager resolves a version at start. A new release can then reach your machine without any change to the plugin you reviewed. Pinned means a version after the name: `@1.4.2` for npx, as in `npx -y some-package` plus `==1.4.2` for uvx, as in `some-package==1.4.2`.` claude --plugin-dir plugin details `. It reads the plugin's files without starting a session and prints its hooks with their events, MCP and LSP servers, skills and agents. If the plugin ships a mod, read our [review of 891 public mods](https://agentcraft.dev/en/blog/claude-code-mods-review-2026-11/) for what to check there. We don't repeat it here. `filename:plugin.json path:.claude-plugin`). Search returns at most 1,000 results per query, so we split the search into 40 file-size slices. We ran them in alternating order under a 30-minute cap and finished 23, which cover every size range. That gave 17,965 unique manifests, about 53% of the total, from 17,928 repos.`hooks` key, `mcpServers` key, `.lsp.json`, `monitors/monitors.json` and | What the plugin does | Repos (of 1,961) | Plugins, max 10 per repo | All plugins | |---|---|---|---| | Runs something when a session starts (SessionStart or Setup hook, local MCP server, or monitor) | 30.4% | 27.4% | 24.5% | | SessionStart or Setup shell hook | 16.0% | 14.3% | 12.8% | | …whose script writes files | 6.0% | 5.1% | 4.6% | | …whose script goes online | 1.5% | 1.2% | 1.1% | | Any shell hook | 22.2% | 20.1% | 18.5% | | UserPromptSubmit hook (sees each prompt, output goes to Claude) | 8.1% | 7.0% | 6.3% | | PreToolUse hook | 11.8% | 10.5% | 9.5% | | Declares MCP servers | 26.3% | 24.1% | 21.3% | | Local MCP server (a process on your machine) | 18.4% | 16.4% | 14.6% | | Remote MCP server (a URL) | 8.6% | 8.2% | 7.2% | | MCP server started by npx or bunx | 5.9% | 5.5% | 4.9% | | …with no version | 3.9% | 3.5% | 3.2% | | MCP server started by uvx with no version | 1.4% | 1.2% | 1.0% | | Any package-manager-started MCP server with no version | 5.3% | 4.7% | 4.2% | | Passes an environment variable named like a secret to an MCP server | 2.4% | 2.1% | 1.9% | | `bin/` folder on Claude's PATH | 9.5% | 8.0% | 7.1% | | Ships a mod (see the mods review) | 5.3% | 4.9% | 4.3% | | Monitors | 0.4% | 0.3% | 0.3% | | Sets `defaultEnabled: false` | 0.1% | 0.0% | 0.0% | Quick guess: of the MCP servers these plugins start with `npx` or `bunx`, how many name a version? About one in three. Of 171 such servers, 112 (65%) name none: they use `@latest`, a bare package name, or a GitHub reference. 149 (87%) pass `-y`, which skips npm's install prompt. Across all 945 MCP servers, the most common kinds are remote URLs (445), local scripts in the plugin (176) and `npx` (164). A few examples, without names: `node`, `bash` or `python3`, with file names like `session-start`, `resume-hint` or `context-inject`. Of the 29 repos whose session-start script goes online, 26 check for updates against GitHub or npm, and several talk to their own service on `localhost`. Around ten mention telemetry or analytics; we did not check what they send.`ANTHROPIC_API_KEY` and sends a slice of the conversation to judge it. Its comments say so. It spends your quota and sends your conversation, which you may want to know before installing.`~/.ssh` or `.env` were mostly guards that list those paths in order to block them. None of the plugins our rules flagged looked malicious when we read them. The number of components. A plugin with twenty hooks can be a careful guard, and a plugin with one SessionStart script and an unpinned `npx` server is the one to read closely. Look at what starts by itself and what it fetches. The counts above, in all three weightings, are in [plugin-startup-2026-11.json](https://agentcraft.dev/data/plugin-startup-2026-11.json). Repo and plugin names are left out. To check a plugin yourself, run `claude --plugin-dir plugin details ` and read the files it lists. For skills you choose to install yourself, the [AgentCraft skills directory](https://agentcraft.dev/en/skills/) lists 5,101 Claude Code skills, and every community skill is reviewed before it's listed. The full post is on AgentCraft: [https://agentcraft.dev/en/blog/claude-code-plugin-startup-2026-11/](https://agentcraft.dev/en/blog/claude-code-plugin-startup-2026-11/) Disclosure: I'm Adrian Vale and I help run AgentCraft.