You'll notice
Plugins from claude.ai now get their downloaded archive verified against the install-time hash.
When loading a plugin sourced from claude.ai at a pinned version, the client now compares the downloaded archive's content hash against the digest recorded at install time. On a mismatch, it deletes the staged download and refuses to load the plugin, telling the user to uninstall and reinstall to accept the new content.