api-guardian

Claude Code Private Marketplace Demo

A teaching project that shows how to build a private plugin marketplace for Claude Code. Contains two example plugins with agents, commands, and skills -- everything you need to understand the plugin architecture and start building your own.

What This Demo Shows

If you have been looking at Claude Code plugins and wondering "how do I actually structure a private marketplace for my team?" -- this is your reference. The repository demonstrates:

• How to create a marketplace manifest (marketplace.json) that lists and distributes plugins
• How to structure plugins with agents, commands, and skills
• How plugins, project config (CLAUDE.md), and settings work together to form the full Claude Code experience

This is a demo. The plugins here are illustrative -- they show the correct file structure and conventions, not production-ready tooling. Use this as a starting point, then refer to the official docs linked below for the full specification.

Project Structure

demo-claude-marketplace/
├── .claude-plugin/
│   └── marketplace.json          # Marketplace manifest -- lists all plugins
├── claude-plugins/
│   ├── data-toolkit/
│   │   ├── .claude-plugin/
│   │   │   └── plugin.json       # Plugin metadata (name, description, version)
│   │   ├── agents/               # Subagent definitions (data-engineer, pipeline-architect)
│   │   ├── commands/             # Slash commands (ingest, transform)
│   │   └── skills/               # Skills organized by domain (sql/, etl/)
│   └── api-guardian/
│       ├── .claude-plugin/
│       │   └── plugin.json
│       ├── agents/               # Subagent definitions (security-auditor, api-reviewer)
│       ├── commands/             # Slash commands (audit, scan)
│       └── skills/               # Skills organized by domain (openapi/, security/)
├── CLAUDE.md                     # Project-level memory and conventions
└── README.md

How Plugin Marketplaces Work

A marketplace is a Git repository with a .claude-plugin/marketplace.json at its root. This manifest declares the marketplace name, owner, and lists all available plugins with their relative source paths.

Here is the manifest from this demo:

{
  "name": "demo-marketplace",
  "owner": {
    "name": "Demo Author",
    "email": "[email protected]"
  },
  "plugins": [
    {
      "name": "data-toolkit",
      "source": "./claude-plugins/data-toolkit",
      "description": "Adds data engineering agents, commands, and skills for ETL pipeline development."
    },
    {
      "name": "api-guardian",
      "source": "./claude-plugins/api-guardian",
      "description": "Adds API security auditing agents, commands, and skills for governance and OWASP compliance."
    }
  ]
}

Users add the marketplace and install plugins like this:

# Add this marketplace (from a Git repo URL or local path)
/plugin marketplace add ./path/to/demo-claude-marketplace

# Install a specific plugin
/plugin install data-toolkit@demo-marketplace

For private repositories, Claude Code uses your existing git credential helpers. If git clone works in your terminal, it works in Claude Code.

What Plugins Provide

Each plugin is a directory with .claude-plugin/plugin.json at its root, plus any combination of these components:

Component	Location	Purpose
Agents	agents/*.md	Specialized subagents with custom system prompts, tool access, and permissions. Appear in /agents.
Commands	commands/*.md	Slash commands invokable with /plugin-name:command.
Skills	skills/<name>/SKILL.md	Reusable expertise modules Claude loads automatically based on task context. Can include supporting files.
MCP Servers	.mcp.json	Model Context Protocol server definitions for external tool integrations.
Hooks	hooks/hooks.json	Event handlers that fire on lifecycle events (PostToolUse, PreToolUse, etc.).
LSP Servers	.lsp.json	Language Server Protocol configs for code intelligence.

Note: MCP server definitions should live within plugins (via .mcp.json or inline in plugin.json) when the capability is meant to be reusable across projects. This keeps the MCP configuration bundled with the plugin and distributed through the marketplace automatically.

Included Plugins

data-toolkit

Data engineering capabilities for ETL pipeline development and analytics workflows.

• Agents: data-engineer and pipeline-architect -- specialized subagents for data infrastructure tasks
• Commands: /data-toolkit:ingest and /data-toolkit:transform -- slash commands for data operations
• Skills: sql/ and etl/ -- domain expertise Claude applies automatically when working on data tasks

api-guardian

API security and governance tooling for auditing, validation, and standards enforcement.