npm-based plugin marketplaces now validate registry URLs and support scoped allow/block policies
When installing a plugin or defining an npm-based marketplace source, the registry field is now checked to make sure it's a valid http or https URL, and Claude Code now rejects it otherwise with the message "Registry must be an http(s) URL".
The npm marketplace source definition also gains new version and registry fields, and the documentation now explains that policies like strictKnownMarketplaces and blockedMarketplaces can control npm-based marketplace plugins by:
- an exact package name
- a scope wildcard, such as
@acme/* - the
registryvalue, which acts as an allowed prefix for the plugin's download URL
This lets administrators lock down which npm-based plugin marketplaces are allowed, by name, by organization scope, or by trusted registry, and stops obviously malformed registry URLs from being accepted.
Added /plugin install <plugin> --marketplace <source>, which offers to add the marketplace before installing the plugin