# Supported Source Types for Claude Plugins: URL and Git-Subdir Definitions

> Discover supported source types for Claude plugins: URL for direct references and Git-Subdir for nested directories. Learn how these are defined and validated.

- Repository: [Anthropic/claude-plugins-community](https://github.com/anthropics/claude-plugins-community)
- Tags: api-reference
- Published: 2026-09-04

---

**Claude plugins support exactly two source types—`url` for direct repository references and `git-subdir` for nested plugin directories—defined in the [`.claude-plugin/marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/marketplace.json) manifest and enforced by automated validation workflows.**

The `anthropics/claude-plugins-community` repository maintains strict schema definitions for supported source types for Claude plugins. These definitions ensure reproducible plugin installations and secure marketplace operations by requiring explicit commit SHAs and repository paths.

## URL Source Type

The `url` source type fetches plugins directly from public Git repositories. In [`.claude-plugin/marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/marketplace.json), entries specify the repository URL and the exact commit SHA that must be checked out to ensure immutable plugin versions.

The **0x** plugin demonstrates this structure at lines 14-20 of the marketplace manifest:

```json
{
  "source": {
    "source": "url",
    "url": "https://github.com/0xProject/0x-ai.git",
    "sha": "0167bbb411cc972b966127d23c23de801061fa99"
  }
}

```

When defining a plugin with a URL source, include three required fields:

- `source`: Must be the string `"url"`
- `url`: The HTTPS URL of the public Git repository
- `sha`: The exact Git commit hash to checkout

```json
{
  "name": "example-plugin",
  "description": "A simple example plugin.",
  "source": {
    "source": "url",
    "url": "https://github.com/example/example-plugin.git",
    "sha": "a1b2c3d4e5f6g7h8i9j0k123456789abcdef1234"
  },
  "homepage": "https://github.com/example/example-plugin"
}

```

## Git-Subdir Source Type

The `git-subdir` source type accommodates plugins located within subdirectories of larger repositories. This approach requires additional parameters to locate the specific plugin folder within the broader codebase.

According to the marketplace manifest at lines 54-61, the **42Crunch-api-security-testing** plugin uses this structure:

```json
{
  "source": {
    "source": "git-subdir",
    "url": "https://github.com/42Crunch-AI/claude-plugins",
    "path": "plugins/api-security-testing",
    "ref": "v1.0.1",
    "sha": "30287f5e3f122a646d1ac5ca3ab96e130c52a3ad"
  }
}

```

This source type requires five fields:

- `source`: Must be the string `"git-subdir"`
- `url`: The HTTPS URL of the parent repository
- `path`: The relative path to the plugin directory within the repository
- `ref`: The Git reference (branch, tag, or commit) to checkout
- `sha`: The expected SHA for verification

```json
{
  "name": "subdir-plugin",
  "description": "Plugin located inside a repo sub-folder.",
  "source": {
    "source": "git-subdir",
    "url": "https://github.com/example/large-repo.git",
    "path": "plugins/subdir-plugin",
    "ref": "v2.0.0",
    "sha": "1234567890abcdef1234567890abcdef12345678"
  },
  "homepage": "https://github.com/example/large-repo"
}

```

## Validation and Schema Enforcement

The marketplace enforces these Claude plugins source types through automated validation. The [`.github/actions/validate-plugins/README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/validate-plugins/README.md) documentation specifies that the validation workflow automatically hardens against new source kinds that might be added in the future (lines 139-140).

This validation ensures that only explicitly supported source types appear in the marketplace, maintaining security and consistency across the plugin ecosystem. Any submission attempting to use undefined source types will fail the automated checks.

## Summary

- Claude plugins support exactly two source types: `url` and `git-subdir`.
- The **URL source type** requires `source`, `url`, and `sha` fields for direct repository references to standalone plugin repositories.
- The **git-subdir source type** adds `path` and `ref` fields to locate plugins within subdirectory structures of larger monorepos.
- All source definitions are stored in [`.claude-plugin/marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/marketplace.json) and validated against the schema in [`.github/actions/validate-plugins/README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/validate-plugins/README.md).

## Frequently Asked Questions

### What is the difference between the url and git-subdir source types?

The `url` source type references standalone plugin repositories directly, while `git-subdir` extracts plugins from specific paths within larger monorepos. Use `git-subdir` when multiple plugins or related code coexist in the same repository, and `url` when the plugin maintains its own dedicated repository.

### How do I specify which version of my plugin to use?

Both source types require an explicit `sha` field containing the Git commit hash. The `git-subdir` source type additionally uses the `ref` field to specify tags or branches, though the SHA provides the authoritative version check. This ensures reproducible installations by pinning exact code states.

### Can I add custom source types to Claude plugins?

Currently, the marketplace only recognizes `url` and `git-subdir` as valid source types. The validation workflow in [`.github/actions/validate-plugins/README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/validate-plugins/README.md) is designed to automatically harden against unrecognized source kinds, meaning new types would require explicit updates to the validation schema and marketplace infrastructure.

### Where is the official list of Claude plugins maintained?

The authoritative list resides in [`.claude-plugin/marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/marketplace.json) within the `anthropics/claude-plugins-community` repository. This file contains all plugin metadata, source definitions, and validation parameters for the community marketplace.