# Plugin Source URL Allowlist Rules in Claude Plugins Community: A Security Deep Dive

> Learn the security rules for plugin source URLs in the Claude Plugins Community. Discover why only GitHub, GitLab, and Bitbucket are allowed to prevent SSRF attacks.

- Repository: [Anthropic/claude-plugins-community](https://github.com/anthropics/claude-plugins-community)
- Tags: security-best-practices
- Published: 2026-08-29

---

**The Claude Plugins Community repository restricts plugin source URLs to a strict allowlist of three major code hosting providers—GitHub, GitLab, and Bitbucket—to prevent SSRF attacks and ensure supply chain security.**

The **anthropics/claude-plugins-community** repository enforces rigorous **plugin source URL allowlist** rules to protect against unauthorized network requests. Before any plugin fetches external resources, validation scripts check the hostname against a predefined list of trusted providers. This security mechanism is documented in the action-level READMEs and applied consistently across multiple GitHub Actions workflows.

## Default Allowed Hosts

The **plugin source URL allowlist** defaults to the three dominant source-code hosting platforms. These providers offer robust version control infrastructure and established security practices.

According to the source code in [`.github/actions/validate-plugins/README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/validate-plugins/README.md), the `allowed-hosts` input accepts the following domains:

- **github.com** – Official GitHub host
- **gitlab.com** – Official GitLab host
- **bitbucket.org** – Official Bitbucket host

Any plugin specifying a `source_url` with a hostname outside this trio will fail validation. This restriction blocks potential Server-Side Request Forgery (SSRF) attacks by preventing workflows from contacting internal or malicious endpoints.

## How the Allowlist Is Enforced

Validation occurs at the action level before network requests execute. The `validate-plugins` action defined in [`.github/actions/validate-plugins/README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/validate-plugins/README.md) consumes the `allowed-hosts` input parameter to filter URLs.

When a plugin manifest is processed, the validation script extracts the hostname from the `source_url` field. If the hostname does not match an entry in the allowlist, the workflow step fails immediately. This preemptive check ensures that compromised or misconfigured plugins cannot exfiltrate data or probe internal networks.

## Implementing URL Validation in Workflows

Repository maintainers configure the allowlist through the `allowed-hosts` input when invoking validation actions.

### Validating with the Default Allowlist

The standard configuration uses the three default hosts without modification. Reference the `allowed-hosts` input in your workflow exactly as documented in the action README:

```yaml
jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Validate plugins
        uses: ./.github/actions/validate-plugins
        with:
          allowed-hosts: github.com gitlab.com bitbucket.org

```

### Extending the Allowlist for Custom Hosts

While the defaults cover most open-source plugins, organizations may need to trust additional internal hosts. Append custom domains to the space-separated list:

```yaml
jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Validate plugins (custom allowlist)
        uses: ./.github/actions/validate-plugins
        with:
          allowed-hosts: github.com gitlab.com bitbucket.org example.com

```

### Plugin Manifest Requirements

Each plugin must specify a `source_url` resolving to an allowed host. The JSON manifest should follow this structure:

```json
{
  "name": "awesome-plugin",
  "source_url": "https://github.com/yourorg/awesome-plugin/archive/refs/heads/main.zip"
}

```

The validation script parses this URL, confirms the hostname matches the allowlist, and only then permits the fetch operation.

## Shared Security Across Actions

The **plugin source URL allowlist** is not isolated to a single workflow. The security boundaries defined in [`.github/actions/validate-plugins/README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/validate-plugins/README.md) are reused by complementary actions to ensure consistent enforcement.

The `scan-plugins` action documented in [`.github/actions/scan-plugins/README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/scan-plugins/README.md) applies the same `allowed-hosts` logic when auditing existing plugins. Similarly, the `bump-plugin-shas` action referenced in [`.github/actions/bump-plugin-shas/README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/bump-plugin-shas/README.md) validates URLs before updating commit SHA references. This unified approach prevents security gaps between validation, scanning, and dependency update operations.

## Summary

- The **plugin source URL allowlist** restricts external requests to **github.com**, **gitlab.com**, and **bitbucket.org** by default.
- Validation scripts in [`.github/actions/validate-plugins/README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/validate-plugins/README.md) parse the `allowed-hosts` input to block unauthorized hostnames.
- The `source_url` field in plugin manifests must resolve to an allowed domain or the validation step fails.
- Both `scan-plugins` and `bump-plugin-shas` actions reuse the allowlist to maintain consistent SSRF protection across workflows.

## Frequently Asked Questions

### What happens if a plugin specifies a URL not in the allowlist?

The validation action rejects the plugin immediately. When the hostname in the `source_url` does not match an entry in the `allowed-hosts` list, the workflow step exits with an error before any network request occurs. This prevents the plugin from fetching code from untrusted or internal endpoints.

### Can I add private GitHub Enterprise hosts to the allowlist?

Yes. While the default configuration only includes public GitHub, you can extend the `allowed-hosts` input in your workflow YAML to include private GitHub Enterprise hostnames or any other trusted domain. Provide the custom host as a space-separated entry in the validation action inputs.

### Where is the allowlist logic documented in the source code?

The primary documentation resides in [`.github/actions/validate-plugins/README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/validate-plugins/README.md), which defines the `allowed-hosts` input parameter and lists the default permitted hosts. The same validation rules are referenced in [`.github/actions/scan-plugins/README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/scan-plugins/README.md) and [`.github/actions/bump-plugin-shas/README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/bump-plugin-shas/README.md) to ensure unified enforcement across different workflow stages.

### Why does the repository restrict plugin sources to these three hosts?

The restriction to GitHub, GitLab, and Bitbucket mitigates SSRF vulnerabilities by preventing plugins from making requests to internal metadata services or malicious external sites. According to the source code analysis, these three providers represent the vast majority of open-source code hosting and offer reliable infrastructure for secure supply chain management.