Supported Source Types for Claude Plugins: URL and Git-Subdir Definitions

Claude plugins support exactly two source types—url for direct repository references and git-subdir for nested plugin directories—defined in the .claude-plugin/marketplace.json manifest and enforced by automated validation workflows.

The anthropics/claude-plugins-community repository maintains strict schema definitions for supported source types for Claude plugins. These definitions ensure reproducible plugin installations and secure marketplace operations by requiring explicit commit SHAs and repository paths.

URL Source Type

The url source type fetches plugins directly from public Git repositories. In .claude-plugin/marketplace.json, entries specify the repository URL and the exact commit SHA that must be checked out to ensure immutable plugin versions.

The 0x plugin demonstrates this structure at lines 14-20 of the marketplace manifest:

{
  "source": {
    "source": "url",
    "url": "https://github.com/0xProject/0x-ai.git",
    "sha": "0167bbb411cc972b966127d23c23de801061fa99"
  }
}

When defining a plugin with a URL source, include three required fields:

• source: Must be the string "url"
• url: The HTTPS URL of the public Git repository
• sha: The exact Git commit hash to checkout

{
  "name": "example-plugin",
  "description": "A simple example plugin.",
  "source": {
    "source": "url",
    "url": "https://github.com/example/example-plugin.git",
    "sha": "a1b2c3d4e5f6g7h8i9j0k123456789abcdef1234"
  },
  "homepage": "https://github.com/example/example-plugin"
}

Git-Subdir Source Type

The git-subdir source type accommodates plugins located within subdirectories of larger repositories. This approach requires additional parameters to locate the specific plugin folder within the broader codebase.

According to the marketplace manifest at lines 54-61, the 42Crunch-api-security-testing plugin uses this structure:

{
  "source": {
    "source": "git-subdir",
    "url": "https://github.com/42Crunch-AI/claude-plugins",
    "path": "plugins/api-security-testing",
    "ref": "v1.0.1",
    "sha": "30287f5e3f122a646d1ac5ca3ab96e130c52a3ad"
  }
}

This source type requires five fields:

• source: Must be the string "git-subdir"
• url: The HTTPS URL of the parent repository
• path: The relative path to the plugin directory within the repository
• ref: The Git reference (branch, tag, or commit) to checkout
• sha: The expected SHA for verification

{
  "name": "subdir-plugin",
  "description": "Plugin located inside a repo sub-folder.",
  "source": {
    "source": "git-subdir",
    "url": "https://github.com/example/large-repo.git",
    "path": "plugins/subdir-plugin",
    "ref": "v2.0.0",
    "sha": "1234567890abcdef1234567890abcdef12345678"
  },
  "homepage": "https://github.com/example/large-repo"
}

Validation and Schema Enforcement

The marketplace enforces these Claude plugins source types through automated validation. The .github/actions/validate-plugins/README.md documentation specifies that the validation workflow automatically hardens against new source kinds that might be added in the future (lines 139-140).

This validation ensures that only explicitly supported source types appear in the marketplace, maintaining security and consistency across the plugin ecosystem. Any submission attempting to use undefined source types will fail the automated checks.

Summary

• Claude plugins support exactly two source types: url and git-subdir.
• The URL source type requires source, url, and sha fields for direct repository references to standalone plugin repositories.
• The git-subdir source type adds path and ref fields to locate plugins within subdirectory structures of larger monorepos.
• All source definitions are stored in .claude-plugin/marketplace.json and validated against the schema in .github/actions/validate-plugins/README.md.

Frequently Asked Questions

What is the difference between the url and git-subdir source types?

The url source type references standalone plugin repositories directly, while git-subdir extracts plugins from specific paths within larger monorepos. Use git-subdir when multiple plugins or related code coexist in the same repository, and url when the plugin maintains its own dedicated repository.

How do I specify which version of my plugin to use?

Both source types require an explicit sha field containing the Git commit hash. The git-subdir source type additionally uses the ref field to specify tags or branches, though the SHA provides the authoritative version check. This ensures reproducible installations by pinning exact code states.

Can I add custom source types to Claude plugins?

Currently, the marketplace only recognizes url and git-subdir as valid source types. The validation workflow in .github/actions/validate-plugins/README.md is designed to automatically harden against unrecognized source kinds, meaning new types would require explicit updates to the validation schema and marketplace infrastructure.

Where is the official list of Claude plugins maintained?

The authoritative list resides in .claude-plugin/marketplace.json within the anthropics/claude-plugins-community repository. This file contains all plugin metadata, source definitions, and validation parameters for the community marketplace.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}