Unclear Whether this check is switched on is not known.
What
Some plugin and marketplace repositories include submodules, which are other repositories pulled in at a specific recorded commit. After cloning a plugin, Claude Code now checks that each submodule is at the commit the main repository records. A mismatch refuses the repository with "SHA pin verification failed". If the check cannot be confirmed, Claude Code also refuses to use it. The check is controlled by a server-side switch.
Why
It stops a plugin from quietly pulling in different code than its repository says it uses.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
Whether this check is switched on is not known.