What a Claude Code plugin runs before you type: we read 2,688 public plugins

An analysis of 2,688 public Claude Code plugins across 1,961 active repositories found that nearly a third run code automatically when a session starts, and that most MCP servers launched via npx or bunx pin no version. The review reports that 30.4% of repos include a SessionStart or Setup hook, local MCP server, or monitor, and that 112 of 171 npx/bunx-launched servers (65%) specify no version, allowing new package releases to reach users without any change to the reviewed plugin.

Before you install a Claude Code plugin, open three things in its folder: hooks/hooks.json , .mcp.json and bin/ . Look for SessionStart hooks, and for MCP servers started with npx or uvx but no version number. The reason is simple. A plugin can run code before you type anything. The docs say it directly: "A Claude Code plugin you install can execute arbitrary code on your machine with your user privileges." Four parts of a plugin start on their own: bin/ PATH of the shell Claude runs commands in. Claude Code runs all of these outside the sandbox, and installing a plugin also enables it. So how many public plugins do this? We read every plugin in 1,961 active public repos. hooks/hooks.json , starting with SessionStart and Setup . .mcp.json . command is a process on your machine. If it runs npx some-package or uvx some-package with no version, the package manager resolves a version at start. A new release can then reach your machine without any change to the plugin you reviewed. Pinned means a version after the name: @1.4.2 for npx, as in npx -y some-package plus ==1.4.2 for uvx, as in some-package==1.4.2 . claude --plugin-dir <plugin folder plugin details <plugin name . It reads the plugin's files without starting a session and prints its hooks with their events, MCP and LSP servers, skills and agents. If the plugin ships a mod, read our review of 891 public mods https://agentcraft.dev/en/blog/claude-code-mods-review-2026-11/ for what to check there. We don't repeat it here. filename:plugin.json path:.claude-plugin . Search returns at most 1,000 results per query, so we split the search into 40 file-size slices. We ran them in alternating order under a 30-minute cap and finished 23, which cover every size range. That gave 17,965 unique manifests, about 53% of the total, from 17,928 repos. hooks key, mcpServers key, .lsp.json , monitors/monitors.json and | What the plugin does | Repos of 1,961 | Plugins, max 10 per repo | All plugins | |---|---|---|---| | Runs something when a session starts SessionStart or Setup hook, local MCP server, or monitor | 30.4% | 27.4% | 24.5% | | SessionStart or Setup shell hook | 16.0% | 14.3% | 12.8% | | …whose script writes files | 6.0% | 5.1% | 4.6% | | …whose script goes online | 1.5% | 1.2% | 1.1% | | Any shell hook | 22.2% | 20.1% | 18.5% | | UserPromptSubmit hook sees each prompt, output goes to Claude | 8.1% | 7.0% | 6.3% | | PreToolUse hook | 11.8% | 10.5% | 9.5% | | Declares MCP servers | 26.3% | 24.1% | 21.3% | | Local MCP server a process on your machine | 18.4% | 16.4% | 14.6% | | Remote MCP server a URL | 8.6% | 8.2% | 7.2% | | MCP server started by npx or bunx | 5.9% | 5.5% | 4.9% | | …with no version | 3.9% | 3.5% | 3.2% | | MCP server started by uvx with no version | 1.4% | 1.2% | 1.0% | | Any package-manager-started MCP server with no version | 5.3% | 4.7% | 4.2% | | Passes an environment variable named like a secret to an MCP server | 2.4% | 2.1% | 1.9% | | bin/ folder on Claude's PATH | 9.5% | 8.0% | 7.1% | | Ships a mod see the mods review | 5.3% | 4.9% | 4.3% | | Monitors | 0.4% | 0.3% | 0.3% | | Sets defaultEnabled: false | 0.1% | 0.0% | 0.0% | Quick guess: of the MCP servers these plugins start with npx or bunx , how many name a version? About one in three. Of 171 such servers, 112 65% name none: they use @latest , a bare package name, or a GitHub reference. 149 87% pass -y , which skips npm's install prompt. Across all 945 MCP servers, the most common kinds are remote URLs 445 , local scripts in the plugin 176 and npx 164 . A few examples, without names: node , bash or python3 , with file names like session-start , resume-hint or context-inject . Of the 29 repos whose session-start script goes online, 26 check for updates against GitHub or npm, and several talk to their own service on localhost . Around ten mention telemetry or analytics; we did not check what they send. ANTHROPIC API KEY and sends a slice of the conversation to judge it. Its comments say so. It spends your quota and sends your conversation, which you may want to know before installing. ~/.ssh or .env were mostly guards that list those paths in order to block them. None of the plugins our rules flagged looked malicious when we read them. The number of components. A plugin with twenty hooks can be a careful guard, and a plugin with one SessionStart script and an unpinned npx server is the one to read closely. Look at what starts by itself and what it fetches. The counts above, in all three weightings, are in plugin-startup-2026-11.json https://agentcraft.dev/data/plugin-startup-2026-11.json . Repo and plugin names are left out. To check a plugin yourself, run claude --plugin-dir <plugin folder plugin details <plugin name and read the files it lists. For skills you choose to install yourself, the AgentCraft skills directory https://agentcraft.dev/en/skills/ lists 5,101 Claude Code skills, and every community skill is reviewed before it's listed. The full post is on AgentCraft: https://agentcraft.dev/en/blog/claude-code-plugin-startup-2026-11/ https://agentcraft.dev/en/blog/claude-code-plugin-startup-2026-11/ Disclosure: I'm Adrian Vale and I help run AgentCraft.