Plugin Source URL Allowlist Rules in Claude Plugins Community: A Security Deep Dive

The Claude Plugins Community repository restricts plugin source URLs to a strict allowlist of three major code hosting providers—GitHub, GitLab, and Bitbucket—to prevent SSRF attacks and ensure supply chain security.

The anthropics/claude-plugins-community repository enforces rigorous plugin source URL allowlist rules to protect against unauthorized network requests. Before any plugin fetches external resources, validation scripts check the hostname against a predefined list of trusted providers. This security mechanism is documented in the action-level READMEs and applied consistently across multiple GitHub Actions workflows.

Default Allowed Hosts

The plugin source URL allowlist defaults to the three dominant source-code hosting platforms. These providers offer robust version control infrastructure and established security practices.

According to the source code in .github/actions/validate-plugins/README.md, the allowed-hosts input accepts the following domains:

• github.com – Official GitHub host
• gitlab.com – Official GitLab host
• bitbucket.org – Official Bitbucket host

Any plugin specifying a source_url with a hostname outside this trio will fail validation. This restriction blocks potential Server-Side Request Forgery (SSRF) attacks by preventing workflows from contacting internal or malicious endpoints.

How the Allowlist Is Enforced

Validation occurs at the action level before network requests execute. The validate-plugins action defined in .github/actions/validate-plugins/README.md consumes the allowed-hosts input parameter to filter URLs.

When a plugin manifest is processed, the validation script extracts the hostname from the source_url field. If the hostname does not match an entry in the allowlist, the workflow step fails immediately. This preemptive check ensures that compromised or misconfigured plugins cannot exfiltrate data or probe internal networks.

Implementing URL Validation in Workflows

Repository maintainers configure the allowlist through the allowed-hosts input when invoking validation actions.

Validating with the Default Allowlist

The standard configuration uses the three default hosts without modification. Reference the allowed-hosts input in your workflow exactly as documented in the action README:

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Validate plugins
        uses: ./.github/actions/validate-plugins
        with:
          allowed-hosts: github.com gitlab.com bitbucket.org

Extending the Allowlist for Custom Hosts

While the defaults cover most open-source plugins, organizations may need to trust additional internal hosts. Append custom domains to the space-separated list:

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Validate plugins (custom allowlist)
        uses: ./.github/actions/validate-plugins
        with:
          allowed-hosts: github.com gitlab.com bitbucket.org example.com

Plugin Manifest Requirements

Each plugin must specify a source_url resolving to an allowed host. The JSON manifest should follow this structure:

{
  "name": "awesome-plugin",
  "source_url": "https://github.com/yourorg/awesome-plugin/archive/refs/heads/main.zip"
}

The validation script parses this URL, confirms the hostname matches the allowlist, and only then permits the fetch operation.

Shared Security Across Actions

The plugin source URL allowlist is not isolated to a single workflow. The security boundaries defined in .github/actions/validate-plugins/README.md are reused by complementary actions to ensure consistent enforcement.

The scan-plugins action documented in .github/actions/scan-plugins/README.md applies the same allowed-hosts logic when auditing existing plugins. Similarly, the bump-plugin-shas action referenced in .github/actions/bump-plugin-shas/README.md validates URLs before updating commit SHA references. This unified approach prevents security gaps between validation, scanning, and dependency update operations.

Summary

• The plugin source URL allowlist restricts external requests to github.com, gitlab.com, and bitbucket.org by default.
• Validation scripts in .github/actions/validate-plugins/README.md parse the allowed-hosts input to block unauthorized hostnames.
• The source_url field in plugin manifests must resolve to an allowed domain or the validation step fails.
• Both scan-plugins and bump-plugin-shas actions reuse the allowlist to maintain consistent SSRF protection across workflows.

Frequently Asked Questions

What happens if a plugin specifies a URL not in the allowlist?

The validation action rejects the plugin immediately. When the hostname in the source_url does not match an entry in the allowed-hosts list, the workflow step exits with an error before any network request occurs. This prevents the plugin from fetching code from untrusted or internal endpoints.

Can I add private GitHub Enterprise hosts to the allowlist?

Yes. While the default configuration only includes public GitHub, you can extend the allowed-hosts input in your workflow YAML to include private GitHub Enterprise hostnames or any other trusted domain. Provide the custom host as a space-separated entry in the validation action inputs.

Where is the allowlist logic documented in the source code?

The primary documentation resides in .github/actions/validate-plugins/README.md, which defines the allowed-hosts input parameter and lists the default permitted hosts. The same validation rules are referenced in .github/actions/scan-plugins/README.md and .github/actions/bump-plugin-shas/README.md to ensure unified enforcement across different workflow stages.

Why does the repository restrict plugin sources to these three hosts?

The restriction to GitHub, GitLab, and Bitbucket mitigates SSRF vulnerabilities by preventing plugins from making requests to internal metadata services or malicious external sites. According to the source code analysis, these three providers represent the vast majority of open-source code hosting and offer reliable infrastructure for secure supply chain management.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}