The 10 Best Claude Code Plugins in 2026

Most Claude Code plugins are not worth the install. Out of the 276 in Anthropic's official marketplace, about eight change how a session actually goes, and the rest are integrations you will use once. The ones that matter are the ones that give Claude a new sense (type errors, live docs, a second opinion on a diff) rather than a new command.

This is the shortlist, the mechanism behind why those specific ones work, and the ones sitting in your /plugin list right now that you should remove.

The shortlist

Install counts pulled from claude.com/plugins on 2026-07-31. They move. Treat them as a popularity signal, not a quality ranking, because "most installed" and "most kept" are very different numbers.

superpowers (988k) is the biggest third-party entry and sits outside this ranking on purpose. It is a whole methodology, not a plugin, and it collides with entries 3, 6, and 7. More on that below.

What a plugin actually is

A plugin is a packaging format, not a feature. It is a directory that may contribute any combination of six component types. There is no required file: the .claude-plugin/plugin.json manifest is optional as long as the components sit in their default locations.

That list is the whole game. When you evaluate a plugin, you are not asking "is this good." You are asking "which of those six buckets does it fill, and what does that bucket cost me every turn?"

Because the costs are wildly different:

A plugin that ships 40 skills costs you 40 description lines on every single request for the rest of the session. A plugin that ships one hook costs nothing until the hook fires. This is why a 12-skill workflow plugin can quietly be more expensive than an MCP server with 50 tools.

Since Claude Code v2.1.143 the /plugin detail pane shows a Context cost estimate before you install. v2.1.145 added a Will install section listing exactly which commands, agents, skills, hooks, MCP servers, and LSP servers the plugin adds. Read both. They are the only honest spec sheet a plugin has.

Tier 1: install today

Code intelligence, for your language

This is the single highest-value install and almost nobody does it first. Without an LSP plugin, Claude finds a symbol by grepping, reads three files to figure out what a type is, and only discovers it broke your build when something later runs tsc.

With one installed, two things change. After every edit Claude makes, the language server reports errors and warnings straight back, so a type error introduced in turn 4 gets fixed in turn 4 instead of turn 11. And symbol lookups (go to definition, find references, call hierarchy, hover types) replace broad file reads, which means net context use usually goes down.

The official marketplace ships thirteen LSP plugins:

Ruby and Liquid are the two newest and are not yet in the docs table, so check marketplace.json rather than the docs page if your language looks missing.

/plugin install typescript-lsp@claude-plugins-official
/reload-plugins

The plugin does not install the binary. If you skip that step you get Executable not found in $PATH in the /plugin Errors tab and nothing works. Check the Errors tab after every LSP install.

One real cost: rust-analyzer and pyright chew memory on large repos. If your machine starts swapping, /plugin disable the LSP and fall back to Claude's built-in search.

Context7

412,076 installs, and the reason is boring and correct: models are trained on a snapshot, libraries move, and Claude confidently writes an API that was removed two minor versions ago. Context7 is an MCP server from Upstash that pulls version-specific docs and code examples from source repositories into context on demand.

/plugin install context7@claude-plugins-official

It earns its slot on any project using a fast-moving dependency. On a codebase pinned to stable libraries with good types, the LSP plugin already covers most of what Context7 would tell you, and you can skip it.

code-review

430,450 installs. Anthropic's own, and the design detail that makes it work is the confidence scoring. Every naive "review this diff" prompt produces a wall of plausible nitpicks, you learn to skim them, and then you miss the real one. code-review runs multiple specialized agents and filters on confidence, so what surfaces is short enough that you read all of it.

/plugin install code-review@claude-plugins-official

If you want the granular version, pr-review-toolkit (113k) splits into separate reviewers for comments, tests, error handling, type design, code quality, and simplification. Install one or the other, not both.

frontend-design

1,110,438 installs, the most-installed plugin in the directory. Its job is narrow and it does it: production-grade frontend output that avoids generic AI aesthetics. The default failure mode it fixes is the purple gradient hero with three centered feature cards that every model reaches for when you say "make a landing page."

/plugin install frontend-design@claude-plugins-official

If you never touch UI, skip it. It is the clearest example on this list of a plugin whose install count reflects how many people build frontends, not how good it is relative to the rest.

Tier 2: pick one workflow layer

Here is where most setups go wrong. feature-dev, superpowers, and code-review all want to own how a change gets planned, built, and reviewed. Stacking them does not give you three opinions. It gives you three sets of skill descriptions competing for the same trigger, and Claude picking one semi-randomly.

Pick exactly one:

feature-dev (253k) is Anthropic's version: specialized agents for codebase exploration, architecture design, and quality review, wired into a single feature workflow. It is the lightest of the three and the least opinionated about your process.

superpowers (988k) by Jesse Vincent is the heaviest. It teaches Claude brainstorming, subagent-driven development with built-in code review, systematic debugging, and red/green TDD, plus how to author and test new skills. It will refuse to move fast. That is the point. If you would rather wait two minutes than review a bad diff, this is your layer.

/plugin install superpowers@claude-plugins-official

code-simplifier (342k) is the smallest of the three and the one people underrate. It is a single agent that goes back over recently modified code and cuts it down while preserving behavior. Models over-write. They add abstraction layers nobody asked for and defensive branches for conditions that cannot happen. Running a simplifier pass after a build turn is the cheapest quality win on this list, and it composes with either of the other two.

security-guidance

235,822 installs, and it is the one plugin here that is genuinely non-optional if you ship. It works in three layers: pattern-based warnings while Claude edits, an LLM-powered review of the diff when the session stops, and an agentic commit reviewer covering injection, XSS, SSRF, hardcoded secrets, and 25-plus other vulnerability classes.

/plugin install security-guidance@claude-plugins-official

The layering is what matters. The pattern warnings are cheap and fire constantly. The diff review only runs on Stop, so it costs nothing during the build. You get coverage without paying for it every turn.

For a deeper one-off audit rather than continuous coverage, claude-security runs vulnerability scanning at a chosen effort tier and challenges every finding before reporting it. Use it before a launch, not on every session.

Tier 3: memory and accounting

claude-md-management

282,075 installs. It audits your CLAUDE.md for quality and captures session learnings back into it. Worth installing precisely because CLAUDE.md is the most expensive thing in your context: it loads in full, every request, forever. A 400-line CLAUDE.md is a tax on every turn of every session. This plugin is the thing that tells you which 200 lines to cut and which rules to move into .claude/rules/ with path scoping so they only load when relevant files are open.

remember

49,814 installs, third-party, and it solves the problem every other plugin ignores. It extracts, summarizes, and compresses conversations into tiered daily logs, so a new session starts knowing what happened yesterday instead of starting from zero.

The honest caveat: this is a third-party plugin that reads your conversation history. Plugins execute arbitrary code with your user privileges and Anthropic does not verify that any of them work as intended. Read the source before you install a memory plugin. That is not paranoia, it is just the correct threat model for something that reads every session you run.

session-report

11,256 installs, low because almost nobody knows it exists. It generates an explorable HTML report from your local ~/.claude/projects transcripts covering tokens, cache efficiency, subagent usage, skill usage, and your most expensive prompts.

/plugin install session-report@claude-plugins-official

This is the "token-saving plugin" that actually saves tokens, because it does not save any itself. It tells you where they went. Cache efficiency in particular is the number most people have never looked at, and a bad cache hit rate usually traces back to something concrete: a plugin you reload mid-session, an MCP server toggling on and off, a CLAUDE.md you keep editing.

What to uninstall

Every installed plugin has a startup cost and, if it ships skills, a per-request cost. Claude Code now surfaces the dead weight for you.

Run /plugin and open the Installed tab. Since v2.1.187, plugins you installed yourself but have not invoked in at least two weeks, across at least 10 sessions, are grouped under a Not used recently header. Each detail view carries a Last used line. That group is your uninstall list.

Two categories are deliberately excluded and should not be judged by it:

• Plugins your organization manages, or ones loaded with --plugin-dir
• Plugins that contribute a theme, output style, monitor, or workflow, because those deliver value without an invocation to track

LSP plugins used to be exempt entirely. Since v2.1.203, a language server counts as used when it delivers diagnostics or answers a navigation request, so an active LSP plugin will not show up as unused. One wrinkle: on v2.1.203 through v2.1.205, the first session after upgrading could still list an actively used LSP plugin as unused, because there was no recorded server activity yet. v2.1.206 fixed it by resetting the usage record. If you saw your typescript-lsp flagged in that window, that was the false positive, not a signal.

Beyond the automatic list, three things are worth pulling manually:

Integration MCP servers you installed for one task. The github, linear, atlassian, notion, figma, sentry, and slack plugins are excellent when you are working against those systems and pure overhead when you are not. Tool search keeps their idle cost low, but "low" is not "zero," and every reload with an MCP-providing plugin invalidates the prompt cache and forces a full re-read of the conversation on the next request.

Duplicate workflow layers. If you have superpowers and feature-dev and pr-review-toolkit installed at once, you have three competing sets of skill descriptions. Cut to one.

Anything from a marketplace you no longer recognize. Removing a marketplace uninstalls every plugin you got from it, which is the fastest way to clean up an experiment gone wide:

/plugin marketplace list
/plugin marketplace remove some-marketplace

Failure modes

Installing before reloading. A freshly installed plugin does nothing until /reload-plugins. If a plugin provides MCP servers whose tools are not deferred, the reload invalidates the prompt cache and the next request re-reads your entire conversation. Since v2.1.163 Claude Code warns and refuses in that case; pass --force if you really want it. Otherwise install and restart at a natural break.

Trusting install counts. frontend-design has 4x the installs of security-guidance, which tells you how many people build UIs, not which plugin is more valuable. session-report has 11k installs and will teach you more about your own usage than any plugin above it in the table.

Namespace confusion. Plugin skills are always namespaced as /plugin-name:skill-name. If you migrated your own .claude/commands/ into a plugin and forgot to delete the originals, both versions stay live and you will edit the wrong one for a week. Project and user .claude/agents/ definitions also override same-named plugin agents silently.

Installing from the community marketplace like it is the official one. The community marketplace holds 2,307 entries that passed automated validation and safety screening. That is a very different bar from Anthropic curating 276 by hand. Both are useful. Only one is vetted by a human.

Treating a plugin as a substitute for CLAUDE.md. A plugin cannot know your build command, your package manager, or the two conventions Claude keeps getting wrong in your repo. Fix those in CLAUDE.md first. Plugins are for capability, not for conventions.

The minimum viable setup

If you install four things and nothing else:

/plugin install typescript-lsp@claude-plugins-official
/plugin install code-review@claude-plugins-official
/plugin install security-guidance@claude-plugins-official
/plugin install session-report@claude-plugins-official
/reload-plugins

Swap the LSP for your language. That covers code intelligence, a second opinion on every diff, vulnerability coverage while you build, and visibility into what any of it costs you. Add a workflow layer only once you have felt the absence of one, and add integrations only for the system you are working against this week.

Everything else on the marketplace is optional, and most of it is a browser tab you would have opened anyway.

Posted by @speedy_devv