appgarden

AppGarden Claude plugin marketplace

A Claude Code plugin marketplace that distributes the AppGarden plugin to Builders. The plugin registers the remote Client MCP server (https://mcp.appgarden.io/mcp) and bundles skills (/appgarden:expert, /appgarden:create-app, /appgarden:escalate) — one install gives a Builder the MCP tools and the orchestration skills.

This repo is the marketplace and holds the plugin (under plugins/). It carries no secrets — only the public MCP URL — so it can be a public repo.

Layout

plugin-marketplace/
├── .claude-plugin/
│   └── marketplace.json               # lists installable plugins
└── plugins/
    └── appgarden/
        ├── .claude-plugin/plugin.json # plugin identity + version
        ├── .mcp.json                  # points at mcp.appgarden.io/mcp (no creds — OAuth)
        └── skills/
            ├── expert/SKILL.md        # /appgarden:expert — guidance interview → Slack
            ├── create-app/SKILL.md    # /appgarden:create-app — Create prompt (STUB)
            └── escalate/SKILL.md      # /appgarden:escalate — spot when to call in an expert → expert

Skills & the MCP tools they call

Per the capability-layer rule (MCP = thin atomic tools; skills orchestrate), the interview/orchestration lives in the skills and the MCP exposes only atomic primitives.

Skill	What it does	MCP tool it calls
/appgarden:expert	One-question-at-a-time guidance interview; gathers the need, source links, code snippets, repos, and urgency; composes one message	send_slack_to_appgarden({ message })
/appgarden:create-app	Scaffold + deploy a new App (STUB)	TBD
/appgarden:escalate	Spots when a Builder is stuck on a technical concept or proposing an architecturally heavy feature; gently recommends expert feedback first, then hands off	none directly — hands off to /appgarden:expert

send_slack_to_appgarden contract (to be implemented in client-mcp)

The expert skill targets this generic primitive — keep the server implementation matching:

send_slack_to_appgarden({ message: string })   // message = Slack markdown composed by the skill

• The skill sends content only. The server attaches the authenticated Builder's identity (email / org, from the OAuth session) and a timestamp — the skill never gathers those.
• Server-side concerns (rate-limit, scope check, webhook post) live in the MCP's submit_guidance_session tool. It is intentionally generic — not guidance-specific — so other skills can reuse it.

How a Builder installs it

Builders track the stable branch — they receive a plugin update only when a release bumps the version (see RELEASING.md). Pin to it:

/plugin marketplace add https://github.com/appgarden-io/plugin-marketplace.git#stable
/plugin install appgarden@appgarden

To ride the latest (unreleased) main instead, drop the #stable ref and use the shorthand appgarden-io/plugin-marketplace.

appgarden@appgarden is plugin@marketplace. First tool call opens a browser for GitHub sign-in; the Client MCP's org-allowlist gate runs, and the token is stored in the OS keychain. After that the MCP tools and the bundled skills (/appgarden:expert, /appgarden:create-app) are all available.

Auth

The .mcp.json carries no credentials — it assumes the Client MCP server is an OAuth-protected remote MCP server (Path A: workers-oauth-provider + GitHub upstream). Claude Code drives the OAuth flow automatically from the server's /.well-known/oauth-protected-resource metadata.

If OAuth is ever dropped in favour of a static token (Path B), change .mcp.json to:

{
  "mcpServers": {
    "client-mcp": {
      "type": "http",
      "url": "https://mcp.appgarden.io/mcp",
      "headers": { "Authorization": "Bearer ${APPGARDEN_MCP_TOKEN}" }
    }
  }
}

…and each Builder sets APPGARDEN_MCP_TOKEN in their shell. Not recommended — it re-introduces a credential the OAuth model deliberately avoids.

TODO before going live