Claude Plugin Marketplace Security Scanning: Automated Multi-Layer Review Before Approval

The Claude Plugin Marketplace validates every plugin submission through an automated, multi-step security scanning pipeline that combines deterministic static analysis with AI-driven policy review before any plugin is merged or listed.

The anthropics/claude-plugins-community repository uses a defense-in-depth approach to security scanning that protects users from malicious or unsafe plugins. Before any plugin appears in the marketplace, it must pass the scan-plugins GitHub Action—a continuous integration workflow that enforces supply chain integrity and policy compliance. This automated pipeline ensures that every external tool listed in the .claude-plugin/ directory meets Anthropic's security standards without requiring manual code review for every submission.

The Four Layers of Automated Security Scanning

1. Static Pin Check for Supply Chain Integrity

Before any AI analysis begins, the action runs .github/actions/scan-plugins/scripts/static-pin-check.sh to perform deterministic static analysis. This script examines every MCP server declared in plugin.json or .mcp.json files to ensure commands use exact commit SHAs rather than floating version specifiers like @latest or semantic version ranges. Because unpinned dependencies could pull malicious code at runtime, this check always emits warnings and can be configured to fail the build via fail-on-unpinned-autoexec: true, as documented in lines 18-34 of the action's README.md.

2. Claude-Based Policy and Safety Analysis

The core security scanning logic invokes the Claude CLI using claude -p with the policy prompt located at .github/actions/scan-plugins/policy/prompt.md. This automated review evaluates the plugin against Anthropic's Software Directory and Acceptable Use policies, flagging security-relevant findings such as unauthorized network calls, software installation attempts, or unsafe code patterns. The model returns a pass/fail verdict that the action parses into GitHub workflow annotations using ::warning or ::error commands when fail-on-findings is enabled.

3. Isolated Sandbox Environment

To prevent subversion during the review process, the scanning pipeline clones the plugin repository at the specific pinned SHA into a temporary directory. The analysis runs with read-only file tools only and restricts outbound network connections to an explicit allowlist containing github.com, gitlab.com, and bitbucket.org. This sandboxing, detailed in lines 70-79 of the scan-plugins documentation, ensures that malicious plugins cannot modify the scanning environment or exfiltrate data during the security review.

4. Configurable Enforcement Gates

Repository maintainers can tighten security scanning thresholds through action inputs defined in the workflow schema. Setting fail-on-findings: true causes the CI job to fail if the Claude policy scan detects any violations, while fail-on-unpinned-autoexec: true blocks merges containing floating version specifiers. These flags transform the pipeline from advisory warnings into mandatory security gates that prevent unsafe plugins from reaching the marketplace.

Implementing the Security Scan in Your Workflow

The scan-plugins action triggers automatically on pull requests that modify the .claude-plugin/** directory. Below is a complete workflow configuration that implements the marketplace's security scanning requirements:

# .github/workflows/scan-plugins.yml

name: Scan Plugins
on:
  pull_request:
    paths:
      - '.claude-plugin/**'

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write   # for optional Workload Identity Federation

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: anthropics/claude-plugins-community/.github/actions/scan-plugins@<PINNED-SHA>
        with:
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
          # Uncomment to block merges on any finding

          # fail-on-findings: "true"

For local development or pre-commit validation, you can run the static pin check directly without invoking the full AI scan:

# Verify version pinning without triggering the full AI scan

./.github/actions/scan-plugins/scripts/static-pin-check.sh plugins/example-plugin

# → prints warnings for any floating version specifiers

Summary

• The marketplace uses a multi-layer security scanning approach combining static analysis and AI policy review, as stated in the root README.md.
• Static pin checks in .github/actions/scan-plugins/scripts/static-pin-check.sh enforce deterministic, reproducible builds by rejecting floating version specifiers.
• Claude-based policy analysis uses policy/prompt.md and the claude -p CLI to evaluate security risks and policy violations against Anthropic's standards.
• Sandboxed execution clones plugins at pinned SHAs with read-only tools and network restrictions to prevent scan tampering.
• Configurable enforcement via fail-on-findings and fail-on-unpinned-autoexec inputs allows maintainers to block unsafe plugins automatically before they reach users.

Frequently Asked Questions

What triggers the security scan in the Claude Plugin Marketplace?

The scan-plugins GitHub Action runs automatically on every pull request that touches files within the .claude-plugin/** directory. This path-based trigger ensures that any new plugin submission or modification to existing plugins undergoes mandatory security validation before merge, as implemented in the repository's CI configuration.

How does the static pin check prevent supply chain attacks?

The check implemented in .github/actions/scan-plugins/scripts/static-pin-check.sh validates that all MCP server commands reference exact commit SHAs rather than mutable tags like @latest or version ranges. This prevents attackers from compromising the supply chain by publishing malicious updates to unpinned dependencies after the plugin's initial approval, ensuring the reviewed code matches the executed code.

Can the security scanning pipeline block plugins from being listed?

Yes. When repository administrators configure fail-on-findings: true or fail-on-unpinned-autoexec: true in the workflow inputs, the CI job will fail and prevent PRs from merging. According to README.md line 9, only plugins that have passed automated security scanning are eligible for listing in the marketplace, making these enforcement flags critical gatekeepers.

What policies does the Claude scan evaluate against?

The AI policy scan uses the minimal prompt defined in .github/actions/scan-plugins/policy/prompt.md to evaluate plugins against Anthropic's Software Directory policies and Acceptable Use policies. It specifically hunts for security-relevant patterns including unauthorized network calls, attempts to install additional software, and other unsafe code execution patterns that could harm end users.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}