# What Is the “url” Source Type for Claude Plugins? A Deep Dive into the Manifest Schema

> Discover the 'url' source type for Claude plugins. Learn how it enables downloading plugin files from public HTTP(S) endpoints, streamlining integration and development.

- Repository: [Anthropic/claude-plugins-community](https://github.com/anthropics/claude-plugins-community)
- Tags: deep-dive
- Published: 2026-09-05

---

**The `url` source type tells Claude to download plugin files from a public HTTP(S) endpoint rather than cloning a Git repository or reading a local path.**

In the `anthropics/claude-plugins-community` repository, the `url` source type is declared in [`.claude-plugin/marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/marketplace.json) and individual plugin manifests when a plugin's assets are hosted externally. This mechanism allows plugin authors to distribute pre-built bundles, versioned releases, or dynamic endpoints without requiring Claude to manage Git operations.

---

## Where the `url` Source Type Is Defined

The authoritative definition lives in [`.claude-plugin/marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/marketplace.json). This JSON file serves as the central registry, mapping plugin names to their source locations and loading mechanisms.

Each plugin entry contains a `source` object with a mandatory `source` property. When this property equals `"url"`, Claude expects a companion `url` property pointing to a downloadable resource.

---

## Anatomy of a `url` Source Declaration

A minimal `url`-sourced plugin entry follows this structure:

```json
{
  "source": {
    "source": "url",
    "url": "https://example.com/plugins/my-plugin-v1.0.0.zip"
  }
}

```

### Required and optional fields

| Field | Required? | Description |
|-------|-----------|-------------|
| `source` | **Yes** | Must be the literal string `"url"` to activate URL-based fetching. |
| `url` | **Yes** | Valid HTTP or HTTPS URL pointing to the plugin bundle. Can reference `.zip`, `.tar.gz`, or a directory index. |
| `headers` | No | Key-value object for custom HTTP headers (e.g., authentication tokens). |
| `sha256` | No | Hash for integrity verification; Claude refuses to load mismatched downloads. |

---

## How Claude Processes the `url` Source Type

When resolving a plugin with `source: "url"`, Claude performs these operations:

1. **HTTP GET request** – Fetches the resource at the specified `url`.
2. **Content-type detection** – Inspects headers and file extension to determine archive format.
3. **Extraction** – Unpacks the archive into a temporary plugin workspace.
4. **Manifest validation** – Locates [`.claude-plugin/plugin.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/plugin.json) within the extracted contents and validates against the schema.
5. **Skill registration** – Loads defined skills into the active Claude session.

This flow mirrors the `git-subdir` source type for steps 4–5 but replaces the Git clone with a direct download, reducing dependency on external version control systems.

---

## Real Examples from the Repository

Multiple plugins in `anthropics/claude-plugins-community` demonstrate the `url` source type in production use. The repository structure shows [`.claude-plugin/plugin.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/plugin.json) files in several plugin directories, including:

- [`tres-finance-plugin/.claude-plugin/plugin.json`](https://github.com/anthropics/claude-plugins-community/blob/main/tres-finance-plugin/.claude-plugin/plugin.json) – Financial data plugin fetching from a remote endpoint.
- [`testdino/.claude-plugin/plugin.json`](https://github.com/anthropics/claude-plugins-community/blob/main/testdino/.claude-plugin/plugin.json) – Test utility plugin with URL-sourced assets.
- [`quickdesign/.claude-plugin/plugin.json`](https://github.com/anthropics/claude-plugins-community/blob/main/quickdesign/.claude-plugin/plugin.json) – Design automation plugin.
- [`eli5/.claude-plugin/plugin.json`](https://github.com/anthropics/claude-plugins-community/blob/main/eli5/.claude-plugin/plugin.json) – Explanation generation plugin.

These manifests confirm that `url` is a first-class source type alongside alternatives like `git-subdir` or `local`.

---

## URL Source Type vs. Alternative Source Types

| Source Type | Use Case | Trade-off |
|-------------|----------|-----------|
| **`url`** | Static or dynamic HTTP-hosted bundles; release artifacts; CDN distributions. | Simple deployment, no Git dependency; requires manual version bumps in URL. |
| **`git-subdir`** | Source control integration; shared mono-repos; development workflows. | Automatic branch/tag resolution; requires Git authentication and clone time. |
| **`local`** | Built-in plugins; repository-bundled tools; testing scenarios. | Zero network latency; tied to specific repository checkout. |

Choose **`url`** when distributing stable, versioned releases to a broad audience without requiring users to configure Git credentials.

---

## Security and Integrity Considerations

The `url` source type introduces network attack surfaces that `local` and `git-subdir` avoid. The manifest schema mitigates this through:

- **HTTPS enforcement** – Plain HTTP URLs trigger warnings or blocks depending on Claude's security configuration.
- **Optional `sha256` verification** – Plugin authors can pin expected hashes; Claude compares computed against declared before execution.
- **Response size limits** – Prevents abuse via unbounded downloads.

Example with integrity protection:

```json
{
  "source": {
    "source": "url",
    "url": "https://cdn.example.com/plugins/secure-plugin-2.1.0.tar.gz",
    "sha256": "a3f5c8e9d2b1..."
  }
}

```

---

## Summary

- The **`url` source type** instructs Claude to fetch plugin files via HTTP(S) rather than Git or local filesystem access.
- Declared in [`.claude-plugin/marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/marketplace.json) and individual [`plugin.json`](https://github.com/anthropics/claude-plugins-community/blob/main/plugin.json) files, it requires a `url` property pointing to a downloadable archive.
- Processing involves fetching, extracting, validating, and registering—mirroring other source types but eliminating Git dependencies.
- Security features include HTTPS preference, optional SHA-256 verification, and size limits.
- Found in production plugins across the `anthropics/claude-plugins-community` repository, including `tres-finance-plugin`, `testdino`, `quickdesign`, and `eli5`.

---

## Frequently Asked Questions

### How does the `url` source type handle authentication?

Include an optional `headers` object in the source declaration to pass API keys, bearer tokens, or custom headers. Claude injects these into the HTTP request. For secrets that should not appear in manifest files, use environment variable references if your Claude deployment supports secret injection.

### Can the `url` source type point to dynamic or API-generated endpoints?

Yes. The URL can reference any HTTP-accessible resource, including endpoints that generate plugin bundles on demand. Ensure the response returns consistent, cacheable archives and include `sha256` verification if the payload may vary unexpectedly.

### What archive formats does Claude support for `url` sources?

Standard formats include `.zip`, `.tar.gz`, and `.tar.bz2`. Claude inspects Content-Type headers and file extensions to select the appropriate extraction method. Uncompressed directory indexes are supported if the server returns proper MIME types for JSON and text files.

### Is the `url` source type mandatory for external plugin hosting?

No. You can also use `git-subdir` to reference repositories you control. Choose `url` when you want faster downloads without Git overhead, or when distributing to users who lack Git credentials for your hosting platform.