MCP Integration for Claude Plugins
Configure MCP servers in Claude Code plugins to connect external services and expose their tools.
The document explicitly recommends environment variables, HTTPS/WSS, narrowly scoped tool allowlists, and avoiding committed credentials; the README also warns users to review plugin and MCP risks. However, systematic data-flow disclosure, user confirmation, rollback/revocation procedures, and dependency pinning are missing. Examples using npx -y and dynamic authentication scripts increase supply-chain and execution risk, so points are deducted.
The skill is structurally thorough, covering configuration, lifecycle, error handling, troubleshooting, and testing checklists. However, it inconsistently describes startup versus on-demand connections, leaves key claims about OAuth, HTTP, and WebSocket behavior unverified by local tests or committed coverage, and gives only generalized abnormal-path handling; the static score is therefore limited.
The frontmatter provides clear trigger phrases, and the content covers stdio, SSE, HTTP, WebSocket, and multiple use cases. Non-fit boundaries, compatibility limits, and false-trigger conditions are insufficiently specified; there is no Chinese-language support guidance or evidence that core remote services are reachable from mainland China, so points are deducted.
The documentation has useful layering, examples, and linked reference files, and declares version 0.1.0. The repository supplies Apache-2.0 licensing, official provenance, and maintenance workflow evidence. However, the skill lacks a changelog, compatibility matrix, explicit maintenance owner, and clear update path, while README documentation requirements are deferred to skill users; it does not receive full marks.
The skill provides directly reusable templates for the core integration workflow, including transport selection, configuration, authentication, tool authorization, error handling, and testing. Yet configuration semantics and platform behavior are not execution-verified in the supplied material, and examples may require adjustment for the actual Claude Code version or server, leaving substantial manual review; the static cap and uncertainty reduce the score.
Evidence includes versioned skill text, examples, reference documents, and repository CI. The CI only checks liveness of some repository MCP URLs and does not cover this skill's key configuration or tool-call paths. No third-party execution report or independently reproducible result is supplied, warranting only limited static auditability.
- Verify claims about automatic OAuth, HTTP/SSE/WebSocket support, tool naming, and connection lifecycle against the target Claude Code version and real tests.
- Before using npx -y, unpinned packages, Python modules, or headersHelper scripts, pin and review dependencies and restrict command, environment, filesystem, and network permissions.
- Remote MCP services may process sensitive data and depend on cross-border connectivity; confirm data flows, OAuth scopes, server trust, regional reachability, and user confirmation plus recovery for write/delete operations before deployment.
What it does & when to use it
This skill belongs to the plugin-dev plugin in anthropics/claude-plugins-official and focuses on integrating Model Context Protocol servers into Claude Code plugins. It covers .mcp.json and plugin.json configuration, plus stdio, SSE, HTTP, and WebSocket server types. It also explains environment variables, OAuth and token authentication, MCP tool naming, lifecycle management, permissions, error handling, debugging, and local validation. It is suited to developers building plugins that access databases, APIs, file systems, or hosted services.
Guides users to create .mcp.json at a plugin root or configure mcpServers in plugin.json; provides command, args, env, url, and headers examples for local and remote MCP servers; explains ${CLAUDE_PLUGIN_ROOT} and user environment-variable expansion; shows how to pre-allow MCP tools in commands and use them in commands or agents; describes OAuth, token authentication, connection failures, and tool-call errors; recommends /mcp for inspecting servers and claude --debug for reviewing connection, discovery, authentication, and call logs.
- A Claude Code plugin developer needs access to a local file system, database, or custom MCP server.
- A plugin needs to connect to a hosted service such as Asana or GitHub over SSE with OAuth.
- A team needs to connect a REST-style MCP backend using token-based headers.
- A developer is building a plugin workflow that spans multiple services such as GitHub and Jira.
- A plugin maintainer wants to validate configuration, discovery, authentication, and failure handling before release.
Pros & cons
- Covers four MCP transport types with concrete use cases.
- Includes directly reusable .mcp.json and plugin.json configuration examples.
- Addresses authentication, tool permissions, lifecycle, errors, performance, testing, and debugging.
- Promotes ${CLAUDE_PLUGIN_ROOT} and environment variables for portable configuration.
- It is written for Claude Code plugins, so plugin- and command-specific parts require adaptation elsewhere.
- It does not include an MCP server, external-service account, or test environment.
- The source does not document an automated test suite or establish compatibility with particular servers or platforms.
- Users must configure and maintain remote connections, OAuth, tokens, and environment variables themselves.
How to install
The skill is located at https://github.com/anthropics/claude-plugins-official in plugins/plugin-dev/skills/mcp-integration/SKILL.md. The README states that plugins can be installed through the Claude Code marketplace with: /plugin install plugin-dev@claude-plugins-official. The source does not document a separate installation command or additional dependency for this skill.
How to use
Invoke it for requests such as "add MCP server", "integrate MCP", "configure MCP in plugin", "use .mcp.json", or "set up Model Context Protocol". Then choose stdio, SSE, HTTP, or WebSocket, configure the server, document environment variables, verify it with /mcp, and pre-allow specific MCP tools in relevant commands. The source does not provide a standalone executable or automation script.