Ship doiget as a Claude Code plugin: self-hosted marketplace first, then the community catalog

[sotashimozono]

Mechanics verified 2026-08-26 against the installed claude-plugins-official marketplace on disk and the official docs.

Why this and not just claude mcp add

A plugin makes installation two lines with no binary handling, and it can carry skills, agents and commands alongside the MCP server — which is where domain workflows (systematic review / PRISMA, etc.) would eventually be delivered.

/plugin marketplace add QAtlasHub/doiget
/plugin install doiget@doiget

Files to add

At the repository root:

.claude-plugin/plugin.json       { name, description, version, author }
.claude-plugin/marketplace.json  { $schema, name, description, owner:{name,email}, plugins:[…] }
.mcp.json                        { "mcpServers": { "doiget": { "command":"npx", "args":["-y","doiget@latest","serve"] } } }

That .mcp.json is the same shape the official firebase plugin ships ({"command":"npx","args":["-y","firebase-tools@latest","mcp"]}), so it is a proven pattern rather than a guess.

Structure trap. Only plugin.json goes inside .claude-plugin/. .mcp.json, and later skills/, agents/, commands/, hooks/, all live at the plugin root. The docs call this out as the common mistake.

Marketplace entry fields. All 289 plugins in the official catalog carry name, description and source; category (275/289) and homepage (273/289) are effectively expected too. For a plugin living in its own repository, source can be the relative path string "./".

Depends on the npm issue. npx -y doiget@latest requires the package to exist. Shipping four platform binaries inside the git repo instead would work via ${CLAUDE_PLUGIN_ROOT} or a bin/ directory, but it would put hundreds of MB in the tree and route users around the cosign/SBOM verification story. Not worth it.

Two marketplaces, and only one takes submissions

Worth stating because it is easy to get backwards:

• claude-plugins-official — Anthropic-curated. There is no application process; Anthropic decides at its discretion, and the submission form does not add plugins to it.
• claude-community (anthropics/claude-plugins-community) — where third-party submissions land after review. Users add it with /plugin marketplace add anthropics/claude-plugins-community.

Submission forms, two of them:

• claude.ai — requires a Team or Enterprise organisation with directory-management access.
• Console — platform.claude.com/plugins/submit — for individual authors not in such an organisation. This is the one to use.

Before submitting, run locally:

claude plugin validate ./<plugin-dir> --strict

The review pipeline runs the same check. Approved plugins are pinned to a commit SHA in the community catalog and CI bumps the pin as commits land; the public catalog syncs nightly, so approval and availability are not simultaneous.

The review bar, and where doiget currently fails it

The criteria are public: anthropics/claude-plugins-official/.github/policy/{prompt.md,schema.json}. It is an automated LLM security and privacy review, and passes is true only if the plugin is

safe AND has no broad-scope hooks AND has no undisclosed telemetry AND its description matches its behavior.

criterion	doiget
has_broad_scope_hooks	Clean — doiget ships no hooks at all.
has_undisclosed_telemetry	Clean — ADR-0015, enforced by cargo-deny denials and posture-lint.yml.
may_make_external_network_calls	true, and correctly so; it is disclosed and is the point of the tool.
may_download_additional_software	true via npx — the same is true of firebase, which is listed. A postinstall binary download would read worse; see the npm issue.
description_matches_behavior	This is the one that currently fails.

#493 and #494 are literally documented description/behaviour mismatches: three places assert doiget respects arXiv's rate guideline while the code exceeds it fifteenfold, and LEGAL.md under-declares the default binary's network surface. The review prompt explicitly instructs the reviewer to read .mcp.json, README, SKILL.md and source files and check them against actual behaviour.

So #493 and #494 should be closed before submitting. Ironically, doiget's differentiator is auditability, and the one criterion it would fail is the audit one.

One more thing worth knowing: the prompt states that a plugin installed from a git source clones the entire repository to the user's disk, and instructs the reviewer to read scripts/, tests/, hidden directories and any .js/.ts/.py/.sh anywhere in the tree — not only the loaded surface. Nothing in doiget is a problem here, but the review scope is the whole repo, not just the plugin manifest.

Order

1. npm package exists (sibling issue).
2. Add the three files; self-hosted marketplace works immediately, with no approval from anyone.
3. Close arXiv is fetched 15x faster than its Terms of Use allow, and three places claim the opposite #493 / LEGAL.md under-declares the default binary's network surface and does not know tdm-ieee exists #494.
4. claude plugin validate --strict, then the Console form.

Steps 1–2 are entirely within our control and deliver most of the value; step 4 is discovery on top.

Refs #501, #493, #494, #483.

[sotashimozono]

Where this stands

Done — the self-hosted marketplace half. .claude-plugin/marketplace.json + plugin.json are in the tree and /plugin marketplace add QAtlasHub/doiget works today.

Done in #560 — the blocker that made the directory half not worth doing. .mcp.json ran a bare doiget serve, so the plugin did nothing for anyone who had not already installed the binary. It now runs npx -y doiget-cli serve and needs nothing beforehand. Verified by launching it from the real registry: initialize answers doiget 0.8.12, tools/list returns 22, stdout is pure JSON-RPC, stderr is empty.

TODO — directory submission (maintainer, manual)

• Run the validator locally first. claude plugin validate . against this repo. A failed automated scan on submission is a wasted round trip.
• Submit at platform.claude.com/plugins/submit. This is the route for individual authors. The claude.ai path needs a Team or Enterprise organisation with directory-management access, which does not apply here.
• Do not open a PR against anthropics/claude-plugins-community. Its README is explicit: "Pull requests opened directly against this repo are closed automatically — all changes flow from the internal review pipeline." The form is the only door.
• Expect automated security scanning plus a manual approval step before the listing appears.

Fields the catalog effectively expects, all already present: name, description, source, category, homepage.

Not applicable

claude-plugins-official is Anthropic-curated with no application process — submitting the form does not add a plugin to it. The community catalog is the reachable target.

Watch out for

plugin.json and marketplace.json carry a version that nothing stamps — no script or workflow references either file. They had drifted to 0.8.11 while the repo was two releases ahead, and /plugin marketplace add reads the default branch, so that stale number was what users saw. #560 sets them to 0.8.12. Worth a posture-lint check if this recurs.