One read of Claude Documentationclaude-docs-20261112T150704Z
2 pages moved out of 290 read.
Pages moved
2
significant first
Pages read
290
in this capture
Captured
15:07 UTC
Corpus hash
f5cda5b170c1
corpus-hash
What this read moved
1-2 of 2third-party/claude-desktop/extensions Changed · +14 / -4 lines
### How a marketplace credential helper runs
from line 276
276276| - | - |
277277| `"anonymous"` | No credential is sent. Use for public repositories or unauthenticated file hosts. |
278278| `"userGit"` | Uses the git credential helpers already configured for the signed-in OS user (for example, `git-credential-manager`, macOS Keychain, or a GitHub CLI credential helper). Use when each user already has read access through their own account. For `url` sources, the same credential is sent as HTTP Basic on the manifest and archive requests. |
279| `"credentialHelper"` | Runs the executable at `credentialHelper`. If it prints a bare token, the token is used as the git password for username `x-access-token` (accepted by GitHub, GitLab, and Azure DevOps) and, for `url` sources, sent as `Authorization: Bearer <token>` on the manifest and archive requests. For hosts that need a particular username, print git-credential lines `username=<user>` and `password=<token>` instead (for example `x-token-auth` for Bitbucket Data Center access tokens, or `gitlab+deploy-token-N` for a GitLab deploy token); `url` sources then use HTTP Basic. Print `authtype=Bearer` and `credential=<token>` to force a bearer header. For `url` sources, the helper can instead print a flat JSON object of HTTP headers, such as `{"Authorization": "Bearer …", "X-Tenant": "acme"}` (the form a managed MCP server's `headersHelper` prints, not an inference credential helper's `{"token": …}` object), and Claude Desktop sends every header in it on each request to that marketplace. `github` and `git` sources refuse this form. Output that opens with `{` must be a valid header object, or the fetch is refused. Username forms require Claude Desktop 1.37937.0 or later. Otherwise follows the execution model of an [inference credential helper](https://claude.com/docs/third-party/claude-desktop/credential-helper.md). |
279| `"credentialHelper"` | Runs the executable at `credentialHelper`. If it prints a bare token, the token is used as the git password for username `x-access-token` (accepted by GitHub, GitLab, and Azure DevOps) and, for `url` sources, sent as `Authorization: Bearer <token>` on the manifest and archive requests. For hosts that need a particular username, print git-credential lines `username=<user>` and `password=<token>` instead (for example `x-token-auth` for Bitbucket Data Center access tokens, or `gitlab+deploy-token-N` for a GitLab deploy token); `url` sources then use HTTP Basic. Print `authtype=Bearer` and `credential=<token>` to force a bearer header. For `url` sources, the helper can instead print a flat JSON object of HTTP headers, such as `{"Authorization": "Bearer …", "X-Tenant": "acme"}` (the form a managed MCP server's `headersHelper` prints, not an inference credential helper's `{"token": …}` object), and Claude Desktop sends every header in it on each request to that marketplace. `github` and `git` sources refuse this form. Output that opens with `{` must be a valid header object, or the fetch is refused. Username forms require Claude Desktop 1.37937.0 or later. See [How a marketplace credential helper runs](#how-a-marketplace-credential-helper-runs). |
280280| `"inferenceCredential"` | `url` sources only. Sends the credentials Claude Desktop already sends to your inference gateway or to your [bootstrap server](https://claude.com/docs/third-party/claude-desktop/bootstrap.md), so a marketplace hosted on either is private to signed-in members without a separate credential. On the gateway's origin it sends the same `Authorization` bearer as inference and works for [gateway single sign-on](https://claude.com/docs/third-party/claude-desktop/gateway.md#single-sign-on-with-your-identity-provider), a [credential helper](https://claude.com/docs/third-party/claude-desktop/credential-helper.md), and bearer-scheme API keys. On the bootstrap server's origin (Claude Desktop 1.37937.0 or later) it sends the bootstrap sign-in token or your `bootstrapHeaders` and `bootstrapHeadersHelper` headers. Claude Desktop sends a credential only when the marketplace URL is on one of those two origins. When there is nothing to send yet (no sign-in held and no bootstrap headers configured, or a gateway API key sent as `x-api-key` rather than a bearer), no request is made and the entry reports why in the diagnostic report. |
281281
282282Because the fetch happens on the host, the marketplace host does not need to be on the [`coworkEgressAllowedHosts`](https://claude.com/docs/third-party/claude-desktop/configuration#coworkegressallowedhosts) allowlist. It does need to be reachable from end-user devices.
from line 292
292292
293293Devices sync to the new revision on the next app launch or periodic re-fetch, about every 10 minutes. A pinned marketplace syncs when the device receives the new pin.
294294
295Claude Desktop also checks a `url` marketplace with no `manifestSha256` pin when a user opens a new Chat, Cowork, or Code session, returns to the app with that new session still open, or sends the session's first message:
295Claude Desktop also checks a git marketplace that isn't pinned to a commit, and a `url` marketplace with no `manifestSha256` pin, when a user opens a new Chat, Cowork, or Code session, returns to the app with that new session still open, or sends the session's first message:
296296
297297* **What users see**: a new skill in a plugin the user has installed, or in a plugin marked for automatic installation, shows when the user types `/` in the message box, and Claude can use it in that session
298* **What counts as a change**: Claude Desktop compares the bytes of `marketplace.json` with the copy it installed, so a new zip at the same URL goes unseen until that file changes. When you replace a zip, update its `sha256` in `marketplace.json`, or the plugin's `version` if the archive lists no `sha256`. Otherwise serve the same bytes, with no timestamp or other value that differs between requests
299* **What your server gets**: each device requests `marketplace.json`, at most once every 10 seconds per marketplace. After any change to the file, each device downloads every archive that it lists
298* **What counts as a change**: for a git marketplace, the branch or tag it follows points to a different commit. For a `url` marketplace, Claude Desktop compares the bytes of `marketplace.json` with the copy it installed, so a new zip at the same URL goes unseen until that file changes. When you replace a zip, update its `sha256` in `marketplace.json`, or the plugin's `version` if the archive lists no `sha256`. Otherwise serve the same bytes, with no timestamp or other value that differs between requests
299* **What your server gets**: each device asks a git server for the latest commit, or requests `marketplace.json`, at most once every 10 seconds per marketplace. After any change, each device clones the repository again, or downloads every archive that `marketplace.json` lists
300300* **If the server is slow or an update fails**: a session waits up to 5 seconds for the marketplace's answer and up to 30 seconds in all, then starts with the copy it has. After a check that fails or gets no answer, or a new version that doesn't install, new sessions don't ask that marketplace again for five minutes
301301* **With `userGit` or `credentialHelper`**: opening or returning to a new session checks at most once every five minutes, so a new skill can be missing from the `/` list until the user sends the first message
302302
from line 303
303303Earlier versions of Claude Desktop sync only at launch and at the periodic re-fetch.
304304
305305To remove a marketplace, delete its entry; Claude Desktop unregisters it and uninstalls its plugins on the next sync.
306
307### How a marketplace credential helper runs
308
309When an entry's `credentialKind` is `"credentialHelper"`, Claude Desktop runs the executable at `credentialHelper` as the signed-in OS user and reads [its output](#marketplace-credentials). The executable must exit with code `0` and finish without prompting the user. It runs differently from an [`inferenceCredentialHelper`](https://claude.com/docs/third-party/claude-desktop/credential-helper) in these ways:
310
311* **Arguments and path**: Claude Desktop passes no arguments. Each entry takes one `credentialHelper` path, used on every operating system. To use a different path on some devices, give those devices their own configuration.
312* **Context**: Claude Desktop doesn't tell the executable which marketplace it runs for, and doesn't set `CLAUDE_HELPER_CONTEXT`. Give marketplaces that need different credentials their own executables.
313* **Time limit and caching**: each run must finish within 30 seconds, but a new session waits 5 seconds for an update check. `inferenceCredentialHelperTtlSec` doesn't apply. The executable runs when Claude Desktop fetches the marketplace, such as at first install and when its pin changes. For a marketplace that isn't pinned to a commit or a `manifestSha256`, it also runs at each [update check](#roll-out-marketplace-updates).
314* **Failures**: when a run for a new version fails, users keep the version they have.
315* **Proxy**: the executable gets `HTTPS_PROXY` and `HTTP_PROXY` for the marketplace's host. If the server that issues your token needs a different proxy, set it inside the executable. For details, see [Traffic that bypasses the app proxy](https://claude.com/docs/third-party/claude-desktop/network-proxy.md#traffic-that-bypasses-the-app-proxy).
306316
307317### Move a marketplace to a new source
308318
third-party/claude-desktop/network-proxy Changed · +4 / -2 lines
from line 91
9191| Commands in Cowork's sandboxed shell on Linux | None; commands connect directly |
9292| The agent in an [SSH remote Code session](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md) | None from the device; the remote host's own network route applies |
9393| App update check and download | OS proxy settings only |
94| Credential helper and header helper scripts you configure | None injected; the script's own environment applies |
94| `credentialHelper` scripts for [plugin marketplaces](https://claude.com/docs/third-party/claude-desktop/extensions.md#how-a-marketplace-credential-helper-runs) | App proxy, resolved for the marketplace's host and passed to the script as `HTTPS_PROXY` and `HTTP_PROXY` |
95| `inferenceCredentialHelper`, `bootstrapHeadersHelper`, and helper scripts in `managedMcpServers` entries | None injected; the script's own environment applies |
9596| Brokered Microsoft Entra sign-in (Company Portal on macOS, Web Account Manager on Windows) | The OS broker's own settings |
9697| Pages opened in the system browser | The browser's own settings |
9798
from line 107
106107* **SSH remote Code sessions.** When a user runs a Code session on another machine through [`sshHostAllowlist`](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions), the agent runs on that host and connects to the inference endpoint from there. Claude Desktop passes the endpoint address to the remote agent but not the pinned key, the device's OS proxy settings, or proxy variables from Claude Code managed settings on the device. The host's own network route and any Claude Code managed settings installed on the host apply instead. See [Inference credentials on the remote host](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md#inference-credentials-on-the-remote-host).
107108* **Pages opened in the system browser.** Some sign-in flows open your default browser. That traffic follows the browser's proxy settings, which normally track the OS; pin it with the browser's own policy (for example, the Chrome or Edge `ProxySettings` policy) or the device's network profile.
108109* **Brokered Microsoft Entra sign-in.** When [brokered authentication](https://claude.com/docs/third-party/claude-desktop/entra-broker.md) is in use, the token request is made by Company Portal (macOS) or Web Account Manager (Windows), not by the app. Those components follow the OS proxy settings; configure them through the same MDM that manages the device.
109* **Helper scripts.** An `inferenceCredentialHelper` or MCP `headersHelper` script runs with the app's environment and no injected proxy variables. If a helper needs a proxy, set it inside the script.
110* **Helper scripts.** An `inferenceCredentialHelper`, `bootstrapHeadersHelper`, or `managedMcpServers` helper script runs with the app's environment and no injected proxy variables. If a helper needs a proxy, set it inside the script.
111* **Marketplace credential helpers.** Unless the environment that starts Claude Desktop already sets proxy variables, a plugin marketplace's [`credentialHelper`](https://claude.com/docs/third-party/claude-desktop/extensions#how-a-marketplace-credential-helper-runs) script gets `HTTPS_PROXY` and `HTTP_PROXY` for the marketplace's host. They're empty for a direct connection. When a proxy is set, `NO_PROXY` lists `localhost`, `127.0.0.1`, and `::1`. If that host's proxies are all SOCKS proxies, or Claude Desktop can't resolve a proxy, the script gets no proxy variables. The same variables apply to every host the script calls, so if the server that issues your token needs a different proxy, set it inside the script.
110112* **Programs that ignore proxy variables.** The agent passes `HTTPS_PROXY`, `HTTP_PROXY`, and `NO_PROXY` to the programs it launches on the device, but a program that does not honor those variables connects directly if the network allows it. The only complete control for this case is blocking direct egress at the network layer.
111113
112114> [!WARNING]