Short answers to what readers ask most about this topic.
The best open-source Claude Code plugins — 62 skills, slash commands, subagents, and hooks for agentic workflows, code review, security, and governance. Install any in one command.
Matthews Wong
Software Engineer
Key Takeaway
Claude Code plugins are installable bundles of skills, slash commands, subagents, and hooks that extend Claude Code. Matthews Wong's open-source marketplace ships 62 of them for agentic workflows, security, compliance, governance, and quality — add the marketplace and install any plugin in one command.
Claude Code is most powerful when it stops being an autocomplete and becomes a fleet of agents that verify their own work, review each other, pull their own context, and run on a schedule. Plugins are how you package that practice so it is reusable across every repository you touch.
This guide walks through all 62 plugins in the open-source matthews-agentic-plugins marketplace, grouped so you can find the right one fast. Every plugin ships an auto-invocable skill, has zero runtime dependencies, and is MIT-licensed. The full source is public on GitHub — clone it, read it, and adapt it to your own stack.
If you want a short answer, install these five first — they cover self-verification, review, security, and durable context, which is where most teams feel the bottleneck first.
Every plugin here removes a specific kind of friction you have probably already felt. Instead of babysitting the agent line by line, you let it verify, review, and remember — then you review the result, not every keystroke. That is the whole shift from using Claude Code as autocomplete to running it as a small, accountable team.
Adding the marketplace makes every plugin available; a plugin only does something once you install it into your session. Add the marketplace once, then install any plugin by name. Browse everything with the marketplace list command, and after installing run reload-plugins so Claude Code picks the new components up.
# 1) Add the marketplace (one time)
/plugin marketplace add matthews-wong/claude-code-plugins
# 2) Install any plugin by name
/plugin install memory@matthews-agentic-plugins
/plugin install verify-before-review@matthews-agentic-plugins
# 3) Browse everything, then reload
/plugin marketplace list
/reload-pluginsThe marketplace is public and MIT-licensed — clone or install it directly. Repo: github.com/matthews-wong/claude-code-plugins
A Claude Code plugin is a manifest plus the components it ships. There are four component types, and knowing which one a plugin uses tells you how it fires.
| Component | How it triggers | Example |
|---|---|---|
| Skill | Auto-invoked — Claude pulls it in when your request matches the skill's description. | Ask to review a diff for security and security-review-agent fires. |
| Slash command | You invoke it explicitly by name. | /context-audit, /scan-secrets, /spec |
| Subagent | Runs in an isolated context; the model delegates or a skill routes to it. | The code-reviewer behind /code-review. |
| Hook | Deterministic — fires automatically on an event once installed. | test-guardian runs tests after every edit. |
The categories map to the maturity model from Boris Cherny's Steps to AI adoption with Claude Code. The idea: teams advance not by buying more tokens but by finding the next bottleneck and layering the right guardrail. Each group below is the concrete guardrail for one step-up.
The plugins are useful on their own, but the point is how they chain together on a normal feature. Here is the loop most teams settle into once a handful of these are installed.
The first bottleneck in agentic coding is your attention. These plugins give Claude Code an end-to-end self-verification loop so tests, lint, build, and review all run before a human ever looks at the diff.
| Plugin | What it installs | Trigger |
|---|---|---|
verify-before-review | Runs the project's tests, lint, and build as a self-verification loop before you review any change. | /verify + Stop hook |
code-review-agent | A code-reviewer subagent that reviews your working git diff for bugs, edge cases, and quality issues. | /code-review + subagent |
security-review-agent | A security-reviewer subagent that scans changes for common vulnerabilities, ranked by severity. | /security-review + subagent |
test-guardian | A hook that runs the fast test suite automatically after edits and surfaces any failures immediately. | PostToolUse hook |
e2e-verifier | A checklist-driven skill that verifies a change end-to-end before you hand the work to a human. | /e2e-check + skill |
Approving every tool call by hand is friction. These plugins pre-approve a vetted set of safe commands and analyze what you keep denying, so Claude stops asking about the harmless things.
| Plugin | What it installs | Trigger |
|---|---|---|
permission-optimizer | Analyzes denied tool calls and proposes a read-only-only allowlist to cut repeated permission prompts. | auto-skill |
auto-mode-setup | Configures auto mode and pre-approves a vetted set of safe bash and MCP commands. | command + skill |
plan-mode-helper | A plan-first workflow: draft an approach plus a test strategy, confirm it, then execute. | auto-skill |
Trust and context are the bottleneck from parallel to supervised work. These plugins pull the right context before a task and turn your standards into reusable skills.
| Plugin | What it installs | Trigger |
|---|---|---|
skills-connector | Scaffold, list, and wire up Claude Code skills with routing-friendly descriptions — the backbone of a skills library. | /skill-new, /skill-list |
claude-md-manager | Scaffold and lint your CLAUDE.md standards file and trim bloat that Claude can already derive. | command + skill |
context-puller | Gathers README, docs, ADRs, and git history into a grounded working brief before a task starts. | auto-skill |
repo-onboarder | An exploring subagent that maps an unfamiliar repository and writes an ONBOARDING.md. | subagent |
Throughput is the next ceiling. These plugins kick off agents in parallel, isolate them on git worktrees, and turn repeatable work into loops and scheduled routines.
| Plugin | What it installs | Trigger |
|---|---|---|
agent-kickoff | Decompose a task and kick off subagents in parallel — agent-to-agent orchestration. | auto-skill |
worktree-isolation | Run agents on isolated git worktrees so parallel edits never collide into merge chaos. | auto-skill |
loop-runner | Turn a repeatable task into a recurring routine using the /loop interval-and-condition taxonomy. | /loop taxonomy |
parallel-lanes | Fan a big task into independent lanes that run concurrently, then synthesize the results. | auto-skill |
routine-scheduler | Define scheduled routines such as nightly PR triage or recurring dependency checks. | auto-skill |
At team scale, cost and oversight become the constraint. These plugins set a model-selection policy, track token usage, and export telemetry with spend caps.
| Plugin | What it installs | Trigger |
|---|---|---|
cost-controller | A model-selection policy: cheap and fast models for bulk work, a frontier model for judgment calls. | auto-skill |
token-budget-tracker | A session hook and command that track token usage and trim context before it overflows. | /token-budget + hook |
otel-governance | Enable OpenTelemetry export plus spend caps so a team can govern usage centrally. | command + skill |
These skills fire automatically when you write or review matching code — no command needed. Each applies modern, opinionated defaults for its language or layer.
| Plugin | What it installs | Trigger |
|---|---|---|
javascript-standards | Modern JavaScript defaults: ESM, const and let, strict equality, async/await, immutability, real error handling. | .js/.ts/.jsx/.tsx |
typescript-typing | Avoid any (prefer unknown plus narrowing), discriminated unions, constrained generics, satisfies, and strict config. | TS types, generics |
react-patterns | Rules of hooks, state colocation, stable keys, controlled inputs, effect cleanup, measured memoization, and a11y. | JSX / .tsx, hooks |
css-responsive | Mobile-first layout, flexbox versus grid, relative units, design tokens, color-scheme, and container queries. | .css/.scss, layout |
rest-api-design | Resource naming, correct status codes, an error envelope, pagination, idempotency, versioning, and edge validation. | API / endpoint design |
node-backend-patterns | Route-service-data layering, boundary validation, centralized async errors, env config, and graceful shutdown. | Node / Express / Fastify |
The enterprise layer starts with keeping secrets, vulnerable dependencies, and mishandled data out of your repository — mapped to controls auditors recognize.
| Plugin | What it installs | Trigger |
|---|---|---|
secret-scanner | A hook and command that flag likely secrets — API keys, tokens, private keys — in the diff before they leak. | /scan-secrets + hook |
dependency-auditor | A vulnerability audit via native tooling (npm, pip, cargo, govulncheck) with practical triage. | /audit-deps |
license-compliance | Inventory every dependency license and flag any that fall outside your SPDX allowlist. | /check-licenses |
sbom-generator | Produce a CycloneDX or SPDX Software Bill of Materials for your project. | /generate-sbom |
data-classification | Classify fields as public, internal, confidential, or PII and recommend handling for each. | /classify-data |
compliance-checklist | Pre-release controls mapped to SOC 2 and ISO 27001 so nothing ships unverified. | /compliance-check |
access-review | A read-only subagent that reviews IAM and RBAC changes for over-broad grants and privilege escalation. | read-only subagent |
Consistent history, decisions, and ownership are what let a team move fast without breaking process. These plugins enforce PR standards, commits, ADRs, releases, and ownership.
| Plugin | What it installs | Trigger |
|---|---|---|
pr-governance | Enforce PR standards: a real description, a linked ticket, sane size, tests, and a focused scope. | /pr-review |
conventional-commits | A command and hook that format and validate Conventional Commits messages. | /commit + hook |
adr-manager | Create and manage Architecture Decision Records so consequential choices are written down. | /adr-new, /adr-list |
changelog-generator | Maintain a Keep-a-Changelog file straight from your commit history. | /update-changelog |
release-manager | A repeatable semver bump, tag, release notes, and checklist flow. | /release |
codeowners-manager | Scaffold and validate a CODEOWNERS file so every critical path has an owner. | /codeowners |
standards-enforcer | Check a diff against your editable org standards profile before it merges. | /enforce-standards |
Reliability comes from gates that fail loudly. These plugins guard coverage, API contracts, docs freshness, incident response, and infrastructure policy.
| Plugin | What it installs | Trigger |
|---|---|---|
test-coverage-gate | A hook and command that gate a change below a configurable test-coverage threshold. | /coverage-gate + hook |
api-contract-guard | Detect breaking API changes by diffing OpenAPI or JSON schemas between versions. | /api-compat |
docs-guardian | A hook and command that flag documentation that has gone stale when the code changed. | /docs-check + hook |
incident-runbook | Triage steps, comms templates, and a blameless postmortem scaffold for incidents. | /incident |
terraform-policy | Policy-as-code checks for IaC: public buckets, open security groups, and missing encryption. | /tf-policy |
Agents forget between sessions; a file does not. These plugins give Claude Code durable, folder-scoped memory with local vector search plus rules it promotes from recurring lessons. Start with the all-in-one memory plugin.
| Plugin | What it installs | Trigger |
|---|---|---|
memory | All-in-one memory plus auto-learning: hybrid vector-search learnings and durable auto-surfaced rules, one store, zero dependencies. The recommended install. | /memory-status, /learn + hook |
context-budget | Audit CLAUDE.md and skills for bloat and enforce lean, structured context via progressive disclosure. | /context-audit |
knowledge-loop | Folder-scoped memory only: a hook auto-surfaces relevant past learnings via local vector search; /learn records new gotchas. | /learn + SessionStart hook |
instincts | Auto-learning only: promotes recurring learnings into durable rules surfaced every session, with a support and confidence model. | auto-skill + export/import |
These skills pull themselves in when your task matches — threat modeling a feature, hardening a Dockerfile, checking a K8s manifest, reviewing a migration, or auditing accessibility.
| Plugin | What it installs | Trigger |
|---|---|---|
threat-modeling | STRIDE threat modeling for a feature or design — attack surface plus concrete mitigations. | auto-skill (STRIDE) |
dockerfile-hardening | Review or generate hardened Dockerfiles: non-root, pinned base, minimal layers, no secrets, a healthcheck. | auto-skill |
k8s-security-policy | Review Kubernetes manifests against Pod Security Standards: securityContext, dropped caps, no privileged, limits. | auto-skill |
db-migration-safety | Review a schema migration for safety: expand-contract, avoid long locks, nullable-first then backfill. | auto-skill |
accessibility-audit | Audit UI and markup for WCAG 2.2 AA basics: alt text, labels, contrast, keyboard nav, and ARIA. | auto-skill (WCAG) |
Packaged directly from Anthropic's official Claude Code best-practices guide: verify the app for real, write a spec, review with fresh context, clean a stuck session, and fan out a large migration.
| Plugin | What it installs | Trigger |
|---|---|---|
verify-app | An e2e-verification subagent that runs the app, exercises real flows, and reports PASS or FAIL with evidence. | subagent |
spec-writer | Interviews you with AskUserQuestion and writes a self-contained SPEC.md to execute in a fresh session. | /spec |
writer-reviewer | A fresh-context reviewer that checks the diff against the plan, flagging only correctness and requirement gaps. | /review-fresh |
context-cleaner | Spot the kitchen-sink, over-correction, and infinite-exploration traps and recommend a /clear plus a better re-prompt. | auto-skill |
fan-out-migrate | The large-migration fan-out: generate a file list, loop a scoped claude -p per file, and sample before scaling. | auto-skill |
Plugins that operationalize how Claude Code's creator actually works — his own subagents and engineering principles, distilled into components you can install.
| Plugin | What it installs | Trigger |
|---|---|---|
code-simplifier | Boris's own subagent — simplify the working diff after Claude is done, preferring to delete lines over adding them. | subagent |
mistake-logger | The preserve-mistakes loop — capture a repeated mistake into CLAUDE.md or a skill so the fix persists. | auto-skill |
senior-standards | His three principles as a skill: the simplest change, fix the root cause, and keep the blast radius minimal. | /standards-check |
If you install only one plugin, make it memory. It is the all-in-one context engine: folder-scoped learnings retrieved by hybrid vector search, plus recurring lessons promoted into durable rules that surface at the start of every session. One SessionStart hook surfaces both, one store holds everything, and a status command shows you what Claude remembers.
memory combines knowledge-loop and instincts into one store with whole-memory export and import. It has zero external dependencies — the vector search runs locally, so nothing leaves your machine.
Auto-invocation is model-driven routing, not a hardwired switch — a skill fires when your task matches its description. After installing or updating, run reload-plugins, then give a task that should match and confirm Claude loads the skill instead of improvising. If it does not fire, the description usually needs sharpening — that is the single most common cause.
Tip: if a skill will not auto-fire, sharpen its description before anything else. A routing description should name the triggers and the task shape, not just the topic.
The whole marketplace is open source. Clone it to read how each plugin is built, fork it to adapt the hook scripts to your stack, or install straight from the marketplace command above. The plugins are intentionally small and dependency-free so they are easy to tailor.
Source and install: github.com/matthews-wong/claude-code-plugins — clone with git clone, or add it to Claude Code with the marketplace add command. MIT-licensed, contributions welcome.
Start small: install verify-before-review and code-review-agent to get self-verification, add memory so lessons persist, then layer the enterprise and language plugins as your team's bottleneck moves. Behavior, not your license tier, determines how far up the adoption curve you actually are.