Skip to content
marketplace-structure logo

Marketplace Structure

marketplace-structure

This skill should be used when the user asks to "create a marketplace", "set up marketplace.json", "organize multiple plugins", "distribute plugins", "host plugins", "marketplace schema", "plugin marketplace structure", "multi-plugin organization", or needs guidance on plugin marketplace creation...

SKILL.md

Full skill instructions

Marketplace Structure

A plugin marketplace is a catalog of available plugins that enables centralized discovery, version management, and distribution. This skill covers creating and maintaining marketplaces for team or community plugin distribution.

Overview

Marketplaces provide:

  • Centralized discovery - Browse plugins from multiple sources in one place
  • Version management - Track and update plugin versions automatically
  • Team distribution - Share required plugins across an organization
  • Flexible sources - Support for relative paths, GitHub repos, and git URLs

When to Create a Marketplace vs. a Plugin

Create a PluginCreate a Marketplace
Single-purpose extensionCollection of related plugins
Used directly by end usersDistributes multiple plugins
One team or individual maintains itCurates plugins from various sources
Installed via /​plugin installAdded via /​plugin marketplace add

Directory Structure

Place marketplace.json in the .claude-plugin/ directory at the repository root:

marketplace-repo/
├── .claude-plugin/
│   └── marketplace.json      # Required: Marketplace manifest
├── plugins/                  # Optional: Local plugin directories
│   ├── plugin-one/
│   │   └── .claude-plugin/
│   │       └── plugin.json
│   └── plugin-two/
│       └── .claude-plugin/
│           └── plugin.json
└── README.md                 # Recommended: Marketplace documentation

Marketplace Schema

The marketplace.json manifest defines the marketplace and its available plugins.

Required Fields

FieldTypeDescription
namestringMarketplace identifier (kebab-case, no spaces)
ownerobjectMarketplace maintainer information
pluginsarrayList of available plugin entries

Owner Object

{
  "owner": {
    "name": "Team Name",
    "email": "[email protected]",
    "url": "https://github.com/​team"
  }
}

Optional Metadata

{
  "metadata": {
    "description": "Brief marketplace description",
    "version": "1.0.0",
    "pluginRoot": "./​plugins"
  }
}

The pluginRoot field sets the base path for relative plugin sources.

Plugin Entry Format

Each plugin in the plugins array requires:

FieldTypeDescription
namestringPlugin identifier (kebab-case, unique within marketplace)
sourcestring or objectWhere to fetch the plugin

Optional Plugin Fields

Standard metadata fields:

  • description - Brief plugin description
  • version - Plugin version (semver)
  • author - Author information object
  • homepage - Documentation URL
  • repository - Source code URL
  • license - SPDX license identifier
  • keywords - Tags for discovery
  • category - Plugin category
  • tags - Additional searchability tags

Component configuration fields:

  • commands - Custom paths to command files or directories
  • agents - Custom paths to agent files
  • hooks - Hooks configuration or path to hooks file
  • mcpServers - MCP server configurations

For complete field reference, see references/​schema-reference.md.

Plugin Sources

Relative Paths

For plugins within the same repository:

{
  "name": "my-plugin",
  "source": "./​plugins/​my-plugin"
}

GitHub Repositories

{
  "name": "github-plugin",
  "source": {
    "source": "github",
    "repo": "owner/​plugin-repo"
  }
}

Git URLs

For GitLab, Bitbucket, or self-hosted git:

{
  "name": "git-plugin",
  "source": {
    "source": "url",
    "url": "https://gitlab.com/​team/​plugin.git"
  }
}

Strict vs. Non-Strict Mode

The strict field controls whether plugins must have their own plugin.json:

ModeBehavior
strict: true (default)Plugin must include plugin.json; marketplace entry supplements it
strict: falseplugin.json optional; marketplace entry serves as complete manifest

Use strict: false when:

  • Curating external plugins without modifying their source
  • Providing all metadata in the marketplace entry
  • Plugin directories contain only commands/​agents/​skills without manifest
{
  "name": "external-plugin",
  "source": {
    "source": "github",
    "repo": "external/​plugin"
  },
  "description": "Complete metadata here",
  "version": "2.0.0",
  "strict": false
}

Best Practices

Organization

  • One theme per marketplace - Group related plugins (e.g., "frontend-tools", "security-plugins")
  • Clear naming - Use descriptive kebab-case names for both marketplace and plugins
  • Version all entries - Include version for every plugin entry
  • Document each plugin - Provide description for discoverability

Versioning

  • Use semantic versioning (X.Y.Z) for marketplace metadata.version
  • Update marketplace version when adding, removing, or updating plugins
  • Consider a CHANGELOG.md for tracking changes

Distribution

  • GitHub hosting - Simplest distribution via /​plugin marketplace add owner/​repo
  • Team settings - Configure extraKnownMarketplaces in .claude/​settings.json
  • Local testing - Add with /​plugin marketplace add ./​path during development

For detailed distribution patterns, see references/​distribution-patterns.md.

Validation

Validate marketplace structure before publishing:

# Check JSON syntax
jq . .claude-plugin/​marketplace.json

# Verify required fields
jq 'has("name") and has("owner") and has("plugins")' .claude-plugin/​marketplace.json

Use the plugin-validator agent with marketplace support for comprehensive validation.

Complete Example

{
  "name": "team-tools",
  "owner": {
    "name": "DevTools Team",
    "email": "[email protected]",
    "url": "https://github.com/​company"
  },
  "metadata": {
    "description": "Internal development tools for the engineering team",
    "version": "1.0.0"
  },
  "plugins": [
    {
      "name": "code-formatter",
      "source": "./​plugins/​formatter",
      "description": "Automatic code formatting on save",
      "version": "2.1.0"
    },
    {
      "name": "security-scanner",
      "source": {
        "source": "github",
        "repo": "company/​security-plugin"
      },
      "description": "Security vulnerability detection",
      "version": "1.5.0",
      "category": "security"
    }
  ]
}

Additional Resources

  • references/​schema-reference.md - Complete field reference for marketplace.json
  • references/​distribution-patterns.md - Hosting and team distribution strategies
  • examples/​minimal-marketplace.md - Single plugin marketplace template
  • examples/​team-marketplace.md - Internal company marketplace template
  • examples/​community-marketplace.md - Public multi-plugin marketplace template

Related Skills

  • plugin-structure - For individual plugin plugin.json details
  • plugin-validator agent - For validating marketplace structure
  • /​plugin-dev:create-marketplace - Guided marketplace creation workflow

Working Example

This repository (plugin-dev) is itself a marketplace. Examine .claude-plugin/​marketplace.json at the repository root for a real-world example of marketplace structure and plugin organization.

More Security skills

supabase logo
Security

supabase

Handles the full Supabase workflow from schema changes to deployment, with built-in security guardrails that catch common traps like RLS...

2.7K 308.9K
View

Comprehensive guides and best practices for Neon Serverless Postgres, covering setup, connection methods, authentication, and platform APIs.

98 216.2K
View

Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.

462 163.8K
View

A skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.

462 127.7K
View

Official skill for integrating Firebase AI Logic (Gemini API) into web applications. Covers setup, multimodal inference, structured output, and security.

462 125.1K
View

Complete Better Auth server and client setup with database adapters, session management, plugins, and security configuration.

222 118.2K
View

Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. "deploy to vercel", "set up vercel", "add environment variables to vercel".

31.9K 116.1K
View
cloudflare logo
Security

cloudflare

Complete Cloudflare platform integration with decision trees for compute, storage, AI, networking, security, and infrastructure-as-code.

3K 110.7K
View

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

253 103K
View
gws-gmail logo
Security

gws-gmail

Send, read, and manage Gmail messages, drafts, labels, and account settings.

31.2K 78.9K
View

Comprehensive website auditing across 230+ rules in 21 categories including SEO, performance, security, and accessibility.

94 72.3K
View
gws-shared logo
Security

gws-shared

Shared authentication, CLI syntax, and output formatting patterns for gws Google Workspace commands.

31.2K 63.4K
View

Security AI tools

StarByFace logo
Security

StarByFace

Discover your celebrity doppelgänger with StarByFace!

Free
View
GeoSpy logo
Security

GeoSpy

GeoSpy: Pricing, Features, FAQs, and Alternatives for AI Teams

Free
View

Detect AI-generated voices to protect against audio fraud.

Paid
View

Ensure Your Content's Originality with AI Plagiarism Checker

Freemium
View
Img Upscaler logo
Security

Img Upscaler

Upscale images by 400% without quality loss

Freemium
View
AICheatCheck logo
Security

AICheatCheck

Accurately Detect AI-Generated Content with TheChecker.AI

Free
View
D
Security

Detect GPT

Chrome extension that detects and flags AI-generated content

Free
View