best 15 claude code plugins

this is guidance rather than tooling: aesthetic direction, typography, and how to avoid the generic default styling that makes ai-generated interfaces instantly recognisable. it is the most-installed plugin in the official directory by a clear margin.

because it's first-party it tracks model behaviour as the models change, which community style guidance tends not to.

understand what you're getting though. there are no components, no build integration and no tooling — it is taste, expressed as context, and it costs tokens on every turn it's active.

there is also a `frontend-design` skill inside anthropic's skills repo, which causes genuine naming confusion. the plugin is the one you install from the marketplace.

superpowers intercepts 'build me x' and refuses to just start typing. instead it interrogates requirements, produces a spec in reviewable chunks, plans the implementation, then runs subagent-driven development with red-green tdd and enforced yagni and dry.

the problem it solves is real and expensive: an agent that charges off and confidently builds the wrong thing for an hour. at nearly 260,000 stars and around 966,000 installs, a lot of people have concluded it's worth the overhead.

install from the official marketplace with `/plugin install superpowers@claude-plugins-official`, or add the author's own marketplace. it is multi-harness, working across codex, cursor, copilot cli, opencode and others.

two honest caveats. it is heavily opinionated and the methodology is take-it-or-leave-it — on a small fix it is pure friction, and the context cost is large. and while the project is mit, the readme advertises paid commercial support, so there is a business attached.

it runs multiple specialised agents over a change and then scores findings by confidence to filter out the noise. that second step is what separates it from every community review plugin, which typically reports everything it notices and leaves you to triage.

at roughly 422,000 installs it's one of the most adopted things in the directory.

be aware of the overlap. claude code ships a bundled `/code-review` skill, and there is a separate first-party `pr-review-toolkit` plugin. installing all three is redundant and expensive in context — pick one.

one behavioural note worth knowing: as of a recent version, `/verify` and `/code-review` no longer self-invoke. you have to run them.

this is the plugin wrapper around the context7 mcp server, pulling version-specific library documentation into context on demand. around 406,000 installs.

it earns its place because the failure it prevents — confidently written code against an api version that no longer exists — is the most common and most annoying thing agents do.

it's worth understanding that this is an mcp server underneath, which means a network dependency on a third-party service and a per-turn context cost for its tool definitions unless your client defers them.

coverage varies by library. for the big frameworks it's excellent; for niche packages you may find nothing.

eleven first-party plugins covering typescript, python, go, rust, java, kotlin, c#, c/c++, php, lua and swift. they enable claude code's built-in lsp tool, which gives two things: automatic diagnostics after every edit, and real code navigation — definitions, references, hover types, call hierarchies.

the diagnostics loop is the valuable half. instead of writing code, finishing, and discovering type errors later, the model sees the compiler's actual complaint immediately and corrects it in the same turn. that is real ground truth rather than pattern matching.

install per language, for example `/plugin install typescript-lsp@claude-plugins-official`.

two practical gotchas. the language server binary has to already be on your path or you get an executable-not-found error — the plugin doesn't install it. and anthropic's own docs warn that rust-analyzer and pyright consume significant memory on large projects, which on a big monorepo is not a footnote.

creates, edits and optimises skills, and critically runs evals to measure whether a skill actually improves performance. roughly 368,000 installs.

that measurement step is genuinely rare. the normal workflow for writing a skill is to write it, try it once, decide it feels better and ship it. being able to test properly is the difference between engineering and superstition.

it's a meta-tool, so if you aren't authoring skills it has no value at all.

given that custom commands have now been merged into skills and the docs steer new work toward `skills/`, this is likely to matter more over time rather than less.

claude-mem captures what happened in a session, compresses it, and re-injects the relevant parts into future sessions. it's cross-agent and one of the oldest projects in this ecosystem still under active development.

the problem it addresses is the one everybody hits: starting a new session and spending the first ten minutes rebuilding context the agent had yesterday.

install with `npx claude-mem install` or via the marketplace. the readme carries an explicit warning worth repeating: `npm install -g claude-mem` installs the library only and does not register hooks or the worker service. people do this, get no memory, and assume the plugin is broken.

it runs a background worker and hooks into a lot of the lifecycle, so it is not a light-touch install.

this is a marketplace rather than a single plugin: 94 plugins organised by domain, so `/plugin install python-development` gets you a curated set for that stack. multi-harness across claude code, codex, cursor, opencode, copilot and gemini cli.

it has the longest continuous track record of anything in this ranking, running since july 2025, and is still pushed daily.

the trade-off is inherent to the format. quality varies across 94 plugins, and the stated quality-evaluation process is self-administered. it's also very easy to over-install here and blow up your context budget.

treat it as a catalogue to pick one or two things from, not a bundle to install wholesale.

trail of bits, an established security firm, maintains a marketplace containing only plugins and marketplaces their staff have code-reviewed. their stated reason is blunt: published skills have been found with backdoors and malicious hooks, and the ecosystem has no built-in quality gate.

given that the security model everywhere else is trust-the-publisher — anthropic's own docs say they can't verify plugins work as intended — a human security review is the strongest assurance available.

install with `/plugin marketplace add trailofbits/skills-curated` then browse with `/plugin menu`.

at 468 stars it is by far the least popular thing in this ranking and, for a lot of readers, the most important. the catalogue is deliberately tiny — that's the point of curation, not a defect. one oddity: it's licensed cc-by-sa-4.0, a content licence rather than a software one.

a persistent display below the input showing context usage, active tools, running agents and todo progress. that's the whole product.

it earns its place because context is the binding constraint in this ecosystem, and until you can see it you're guessing. knowing you're at eighty percent before a long agentic run changes what you do next.

install is `/plugin marketplace add jarrodwatts/claude-hud` then `/plugin install claude-hud`.

it is cosmetic in the sense that it changes nothing about output quality — it changes what you know. and there's a documented install failure on linux where `/tmp` is a separate tmpfs on older claude code versions.

six first-party plugins covering the development lifecycle: `commit-commands` for commit, push and pr workflows; `pr-review-toolkit` with agents for comments, tests, error handling and type design; `feature-dev` for exploration through architecture to quality review; `plugin-dev` with seven skills for building plugins; `claude-code-setup`, which analyses your repo and recommends hooks, skills, mcp servers and subagents; and `hookify`, which generates hooks from patterns it notices in your conversation.

`claude-code-setup` and `hookify` are the two genuinely novel ones. most people configure claude code by copying someone's dotfiles; having the tool read your actual repository and tell you what would help is better.

being first-party and apache-2.0, these are also the lowest-risk things you can install.

the caveat is redundancy. they overlap each other and the skills already bundled with claude code, and installing all six is a waste of context. pick the one that matches what you're actually doing.

ecc bundles skills, 'instincts', memory, security and a research-first development approach into one system, working across claude code, codex, opencode and cursor. profile-based install lets you take a minimal or full configuration rather than everything.

adoption is enormous — 232,000 stars since january.

the thing to flag prominently is in the project's own readme: stacking install methods is described as the most common broken setup. running `/plugin install` and then `npx ecc-install --profile full` breaks it. that's an unusually candid warning and also a sign the install model is more fragile than it should be.

the scope is very broad, which means a large surface area and a large context cost. if you want one opinionated system it's a reasonable choice; if you want a specific capability, install that instead.

the idea is that each task should compound into knowledge the organisation keeps, rather than evaporating when the session ends. it ships specialist reviewer and research behaviours as skills.

it's backed by a media company rather than an individual, launched on day one of the plugin system, and has the strongest codex support here — native `codex plugin` integration with per-profile configuration.

install with `/plugin marketplace add EveryInc/compound-engineering-plugin` then `/plugin install compound-engineering`.

it is methodology-heavy and overlaps conceptually with superpowers, so running both is unlikely to help. one legacy hazard: older `AGENTS.md` setups carry an obsolete claude-compatibility block that mis-instructed codex to collapse subagent dispatch — worth checking if you inherited a config.

security-guidance gives pattern-based warnings on edits, runs an llm diff review on the stop hook, and does agentic commit review, with support for project-specific rules. a companion plugin, `claude-security`, does deeper vulnerability scanning at a chosen effort level entirely in-session.

catching a vulnerability as it's written is meaningfully cheaper than catching it in review, and much cheaper than catching it in production.

install with `/plugin install security-guidance@claude-plugins-official`.

the costs are latency and tokens on every stop, and the obvious limitation: this is an llm reading a diff, not static analysis and not a penetration test. treat it as a first line rather than the line.

context mode attacks context bloat four ways: sandboxing tool output so only the useful part reaches the model, session continuity via sqlite with bm25 retrieval that survives compaction, a 'think in code' mode where the agent writes a script and logs only the result, and trimming filler from output tokens.

the compaction-survival piece is the novel one. most memory approaches lose everything at compaction; retrieving from a local index afterwards is a better design.

the claimed numbers — a 315kb to 5.4kb reduction, ninety-eight percent — are the vendor's own and we could not independently verify them. treat as a directional claim.

two real blockers. github cannot identify a standard licence on the repository, which is an adoption stopper for anyone with a legal review. and it's a heavy install: hooks, an mcp server and a sqlite database, with routing behaviour that varies by harness and trust settings.