What probably matters to youSection of the release
What
Marketplace catalog entries and plugin entries declared in settings files both accept headers and a headersHelper command, so an archive no longer has to inherit authentication from the enclosing marketplace. -y, --yes now also consents to the helper command used to fetch an archive, and on updates to a changed install command.
Details
An entry's own auth is bound to its URL and overlaid on the enclosing url-source marketplace's headers only when the archive shares that origin.
One resolver now decides archive auth from the marketplace source, the trusted declaration and the settings-entry auth together.
headersHelper values are validated as printable ASCII and capped at a length the install consent pane can render.
A managed-policy refusal reports entry_helper_disabled_by_policy or entry_helper_remote_policy_unconsented.
Trust telemetry gained hasMarketplaceHeadersHelper and hasRepoHeadersHelpers; a new on-disk cache namespace pluginAssetCache, keyed by archive digest, sits alongside.
Evidence
headersHelper must not be longer than the install consent UI can display, bound to this URL, one whose archive is fetched through a headersHelper command (required when stdin or stdout is not a TTY)
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Added sinceA small documentation edit on Commands touched a line naming --yes after this was published.| `/import [codex\|gemini\|cursor] [--dry-run] [--yes]` | Bring configuration from OpenAI Codex, Google Gemini CLI, or Cursor on your machine into Claude Code, including instruction files, MCP servers, commands, subagents, and skills. In […commandssee the edit
Added sinceA small documentation edit on extended-thinking touched a line naming headers after this was published.On Claude Opus 4.5, Claude Sonnet 4.5, and earlier Claude 4 models, add the `interleaved-thinking-2025-05-14` [beta header](https://platform.claude.com/docs/en/api/beta-headers) to your API request.build-with-claude/extended-thinkingsee the edit
Confirmed sinceAnthropic's documentation has since written up --yes, on Plugins reference.| `-y, --yes` | Skip the `--prune` confirmation prompt. Required when stdin or stdout is not a TTY | |plugins-referencesee the edit
Confirmed sinceAnthropic's documentation has since written up headers, on MCP, plugins, skills, and hooks.| `.mcp.json` | MCP servers bundled with this plugin. A JSON object keyed by server name: `{"mcpServers": {"<name>": {"type": "http", "url": "...", "oauth": true}}}`. A remote entry uses `type` (`http` or `sse`), not `transport`, and suppo…third-party/claude-desktop/extensionssee the edit
Confirmed sinceAnthropic's documentation has since written up headersHelper, on MCP, plugins, skills, and hooks.| `.mcp.json` | MCP servers bundled with this plugin. A JSON object keyed by server name: `{"mcpServers": {"<name>": {"type": "http", "url": "...", "oauth": true}}}`. A remote entry uses `type` (`http` or `sse`), not `transport`, and suppo…third-party/claude-desktop/extensionssee the edit
How sure we are
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agreesAnthropic's documentation has since written up headersHelper, on MCP, plugins, skills, and hooks.
Anthropic's release notes agreePlugin marketplaces: headersHelper on a url marketplace or a catalog entry runs a command that mints HTTP headers (e.g. a short-lived token)…
