Anthropic's Developer Plugins: code-review, feature-dev, pr-review-toolkit, security-guidance and More

Anthropic’s developer plugins are first-party Claude Code plugins in the claude-plugins-official marketplace; the 14 covered here add a feature workflow (feature-dev), pull request review (code-review, pr-review-toolkit), security checks (security-guidance, claude-security), git commands, language servers and authoring kits. Every plugin command is namespaced, so /code-review is the built-in reviewer and /code-review:code-review is the plugin.

You install code-review, type /code-review, and get a local review instead of the pull request comment the README promised. A teammate adds pr-review-toolkit and every session now carries about 2,000 extra tokens. Nobody can say which of the three security tools ran on last week’s commit. This page is for developers who want these plugins to do real work in one feature, and tech leads who decide which of them the team pins. If you have never installed a plugin, read the plugins and marketplaces overview first; this page assumes you know what claude plugin install and a marketplace are.

What you’ll walk away with from this plugin guide

• One table with each plugin’s job, its install count and the context cost we measured on Claude Code 2.1.283
• The built-in versus plugin names that trip everyone up, checked against the 2.1.283 command list
• A worked /feature-dev:feature-dev run on a small feature, phase by phase
• A feature-to-merged-PR workflow that chains feature-dev, pr-review-toolkit, commit-commands, code-review and the security-guidance hooks, with the tests as the gate
• Copy-paste prompts, a hookify rule that blocks “done” without a test run, and the failure modes with recovery steps

Which Anthropic plugins exist and what does each cost?

Install counts come from each plugin’s page on claude.com/plugins, read on 2026-09-26. Always-on tokens are what claude plugin details NAME printed on Claude Code 2.1.283 the same day: the descriptions loaded into every session. On-invoke cost is paid again each time a skill or agent fires.

Plugin	What it adds	Installs	Always-on tokens
code-review	/code-review:code-review: five parallel reviewers on a GitHub PR, findings below 80/100 confidence dropped, one PR comment	438,525	~20
code-simplifier	One code-simplifier agent (model alias opus) that refines recently changed code without changing behaviour	346,763	~64
claude-md-management	/claude-md-management:revise-claude-md and the claude-md-improver audit skill	287,247	~175
feature-dev	/feature-dev:feature-dev, a seven-phase command with code-explorer, code-architect and code-reviewer agents	256,017	~238
security-guidance	Hooks on five events: pattern warnings on edits, an LLM diff review on stop, an agentic review on git commit and git push (and Graphite gt commands)	241,800	~0 (hooks run outside the context)
typescript-lsp	Registers typescript-language-server --stdio for .ts, .tsx, .js, .jsx, .mts, .cts, .mjs, .cjs	212,522	~0
claude-code-setup	The read-only claude-automation-recommender skill	195,067	~139
commit-commands	/commit-commands:commit, commit-push-pr and clean_gone	171,244	~103
pr-review-toolkit	/pr-review-toolkit:review-pr and six review agents	114,856	~2,033
pyright-lsp	Registers pyright-langserver --stdio for .py and .pyi	109,778	~0
plugin-dev	Seven plugin-authoring skills, the /plugin-dev:create-plugin command and three agents, including plugin-validator	67,663	~2,349
hookify	Hook rules written as Markdown files, plus a conversation-analyzer agent	60,376	~292
skill-creator	One skill that writes, evaluates and benchmarks skills	no directory page	~112
claude-security	Deep vulnerability scans with nine agents, verified findings and SARIF output	8,580	~776

Two readings of this table matter. The whole review-and-git set (code-review, feature-dev, security-guidance, commit-commands, claude-md-management, one LSP plugin) costs under 600 always-on tokens, so it can live at user scope. pr-review-toolkit and plugin-dev each cost more than all of those together, so install them with --scope project in the repositories that use them. The top plugins catalogue ranks these against vendor plugins such as Vercel and Figma.

Built-in command or plugin: which one runs?

Claude Code 2.1.283 lists plugin commands only in their /PLUGIN:COMMAND form, and ships built-ins with the same bare names. The session’s own command list, read from the init event of claude -p --output-format stream-json --verbose with all 14 plugins installed, is the evidence for every row below.

You type	What runs	What you probably wanted if you installed the plugin
/code-review	The built-in local reviewer (--fix and --comment options)	/code-review:code-review, the plugin’s multi-agent PR review
/review	The same built-in reviewer: /review is an alias of /code-review	/pr-review-toolkit:review-pr, the toolkit’s aspect-by-aspect review
/simplify	The built-in simplify skill	“use the code-simplifier agent on the files I changed”, which reaches code-simplifier:code-simplifier
/security-review	The built-in security review	security-guidance runs by itself as hooks; /claude-security:claude-security runs a deep scan
/claude-security	Nothing: the plugin skill is /claude-security:claude-security (the plugin README shows the short form)	/claude-security:claude-security scan my branch at high
/hookify, /commit, /review-pr	Nothing: README shorthand	/hookify:hookify, /commit-commands:commit, /pr-review-toolkit:review-pr

Two agents share a name, too. feature-dev:code-reviewer and pr-review-toolkit:code-reviewer are different prompts, and so are code-simplifier:code-simplifier and pr-review-toolkit:code-simplifier. When you ask for “the code-reviewer agent” with both plugins enabled, name the plugin.

Install the core set

Claude Code

Run these in a terminal. The official marketplace registers itself on your first interactive start, so the marketplace add line matters only in scripts and CI.

claude plugin marketplace add anthropics/claude-plugins-official
claude plugin install feature-dev@claude-plugins-official
claude plugin install security-guidance@claude-plugins-official
claude plugin install commit-commands@claude-plugins-official
claude plugin install code-review@claude-plugins-official
claude plugin install claude-md-management@claude-plugins-official
claude plugin install pr-review-toolkit@claude-plugins-official --scope project
claude plugin details feature-dev

For symbol navigation, install the language server first, because the LSP plugins only register a command and do not bundle the binary:

npm install -g typescript-language-server typescript
claude plugin install typescript-lsp@claude-plugins-official
npm install -g pyright          # or: pipx install pyright
claude plugin install pyright-lsp@claude-plugins-official

Run /reload-plugins in an open session, or start a new one. security-guidance needs Claude Code 2.1.144 or later and Python 3.8 or later on PATH. code-review and commit-push-pr need the gh CLI signed in.

Codex

None of these plugins is in Codex’s built-in openai-curated marketplace (manifest read 2026-09-26), and they were written for Claude Code’s command and hook formats. The nearest built-in equivalents in codex-cli 0.157.1:

codex review --base main          # review this branch against main; --uncommitted and --commit SHA also exist

In the TUI, /review runs the same reviewer, and /skills lists the bundled skill-creator and plugin-creator skills, which do the jobs of skill-creator and plugin-dev. To use Anthropic’s skill-creator itself, install it as a skill:

npx skills add anthropics/skills --skill skill-creator -a codex

For the job claude-security does, openai-curated lists OpenAI’s own codex-security plugin. Install it from /plugins in the TUI; the codex plugin add codex-security@openai-curated shell form was not verified on 0.157.1, because the curated marketplace only appears in a signed-in session. The Codex security page covers it.

Cursor

None of these plugins is in Cursor’s first-party cursor-plugins marketplace (cursor/plugins manifest, 94 entries, read 2026-09-26). For pull request review, Cursor’s own tool is Bugbot, and the manifest lists a Cursor-authored pr-review-canvas plugin; for plugin authoring, cursor/plugins documents /add-plugin create-plugin in Agent chat. Anthropic’s skill-creator installs as a skill:

npx skills add anthropics/skills --skill skill-creator -a cursor

Cursor’s in-app plugin controls were not verified on 2026-09-26 because cursor.com was unreachable from the writing environment.

Run /feature-dev:feature-dev on a small feature

feature-dev is a slash command with seven phases: Discovery, Codebase Exploration, Clarifying Questions, Architecture Design, Implementation, Quality Review and Summary. It stops for you three times, and those stops are the point: it will not design before you answer its questions, and it will not write code before you pick an architecture.

The example feature: login rate limiting on an Express API.

/feature-dev:feature-dev Add rate limiting to POST /api/login: at most 5 failed attempts per IP and per email in 15 minutes, then 429 with a Retry-After header. Successful login resets the email counter. Acceptance: tests in tests/auth/rate-limit.test.ts cover the limit, the reset, and the Retry-After value, and npm test passes.

What you see, phase by phase:

1. Discovery. Claude creates a todo list for all seven phases and restates the feature. If your description is thin, it asks what problem you are solving first.
2. Exploration. Two or three code-explorer agents run in parallel, each tracing a different angle (existing middleware, the auth flow, how tests are set up), and each returns five to ten files to read. Claude reads them and summarises the patterns it found.
3. Questions. A numbered list of what the request left open. For this feature, expect: which store holds the counters (memory, Redis, the database), whether the limit applies behind a proxy (X-Forwarded-For), and what a locked-out user sees. Claude waits. If you answer “whatever you think is best”, it gives a recommendation and asks you to confirm it.
4. Architecture. Two or three code-architect agents propose a minimal change, a clean-architecture version and a pragmatic middle. Claude compares them, recommends one and asks which you want.
5. Implementation. Only after your explicit approval. It follows the chosen blueprint and the conventions the explorers found.
6. Quality review. Three code-reviewer agents look at simplicity, correctness and project conventions; each reports only issues it scores at 80 or more out of 100. Claude asks whether to fix now, fix later or proceed.
7. Summary. What was built, the decisions made, the files changed and suggested next steps.

The explorer, architect and reviewer agents run on the sonnet model alias; the orchestration runs on your session’s model. The command itself never runs your tests: phase 6 is agents reading code. That is why the acceptance line in the prompt names the test file and the command. Without it, “done” means “three agents found nothing”, not “the behaviour works”.

Copy-paste prompt: feature-dev with a test gate

/feature-dev:feature-dev Add CSV export to the reports page: a "Download CSV" button exports the currently filtered rows, columns in the on-screen order, dates in ISO 8601, and the file is named report-YYYY-MM-DD.csv. Acceptance: write the tests first (one for the filter, one for column order, one for an empty result), show them failing, then implement until they pass. In the quality review phase, run the full test suite, the type checker and the linter, and treat any failure as a Critical finding before you ask me what to fix.

Chain the plugins from feature to merged pull request

Each plugin owns one step and leaves something checkable behind. The order below differs from “install order” on purpose: pr-review-toolkit finds the files to review with git diff --name-only, which lists only unstaged changes, so it runs before you stage or commit anything.

1. Guard the session. With security-guidance installed, three layers run without you asking. Edits that match about 25 dangerous patterns (yaml.load, pickle.load on untrusted data, raw innerHTML, hardcoded secrets) get an instant warning. When a turn ends, a background review of the diff re-wakes the session with high-severity findings. On git commit and git push (and Graphite gt commands), an agentic reviewer reads related files to trace data flow across the codebase.
2. Build. Run /feature-dev:feature-dev with acceptance criteria, as above. With an LSP plugin installed, Claude resolves definitions and references through the language server instead of text search.
3. Verify. Run the tests, type checker and linter yourself or through CI. These are the gate; the plugins are reviewers, and reviewers can be wrong.
4. Review locally. Run /pr-review-toolkit:review-pr tests errors types before you stage or commit. It picks agents by what changed: pr-test-analyzer when tests changed, silent-failure-hunter when error handling changed, type-design-analyzer when types were added. Findings come back as Critical, Important and Suggestions.
5. Ship. Run /commit-commands:commit-push-pr. It creates a branch if you are on main, makes one commit, pushes and runs gh pr create. The security-guidance commit and push reviews run in the background and report back into the session.
6. Second review on the PR. Run /code-review:code-review on the PR branch. It checks eligibility, runs five parallel reviewers (CLAUDE.md compliance, obvious bugs, git blame and history, comments on earlier PRs that touched these files, code comments), scores each finding from 0 to 100 and posts one PR comment with the ones at 80 or above, linked by full commit SHA. If nothing clears 80, it posts nothing.
7. Learn. Run /claude-md-management:revise-claude-md. It reflects on what this session had to discover, drafts one-line additions and shows them before it edits CLAUDE.md.

Copy-paste prompt: turn review findings into proof

Run /pr-review-toolkit:review-pr tests errors types on my unstaged changes. For each Critical and Important finding: state the input that triggers it, add a failing test that shows it, then fix the code and rerun that test. Finish with the full test suite and the type checker. Report a table with columns finding, agent, test name, fail-before, pass-after. Findings you cannot reproduce with a test go in a separate "not reproduced" list with your reasoning; do not change code for them.

Who signs off, and on what evidence?

The plugins reduce what a human reads; they do not replace the decision. The PR author owns the acceptance criteria and the tests. The reviewer approves on evidence: green CI, the finding-to-test table from the prompt above, the code-review comment (or its absence) and any security-guidance findings acknowledged in the PR description. A human reads the code only in the escalation cases your team defines, such as authentication, payments or a migration. The agent PR review workflow and the evidence bundle define that package.

code-review deliberately skips issues that a linter, type checker or test run would catch, and general test-coverage or security remarks unless CLAUDE.md asks for them: its instructions assume CI runs those separately. A repository without CI gates therefore gets less from it, not more.

Configure security-guidance for your codebase

security-guidance (plugin version 2.0.8 in the official marketplace on 2026-09-26) is configured through environment variables and one optional rules file, and none of it is required for the defaults.

Setting	Effect
.claude/claude-security-guidance.md	Project rules added to the stop-hook diff review, meant to be committed. ~/.claude/claude-security-guidance.md holds user rules, and .claude/claude-security-guidance.local.md local overrides. The three are concatenated into an 8 KB budget, and the commit reviewer does not read them
SECURITY_REVIEW_MODEL	Model for the diff review. The plugin README gives claude-opus-4-7, a Legacy model, as the default; set claude-opus-5-5 (the Claude Code default from v2.1.280 on the latest channel). On Bedrock, Google Cloud or Foundry, use that provider’s model ID form. SG_AGENTIC_MODEL does the same for the commit reviewer
ENABLE_STOP_REVIEW=0	Keeps commit and push reviews, drops the per-turn review. Use it when several agents share one worktree, because another agent can move HEAD between turns
ENABLE_PATTERN_RULES=0 · ENABLE_COMMIT_REVIEW=0	Turn off only the regex warnings, or only the agentic commit review
SG_DUAL_OR=on	Runs two review calls in parallel and keeps the union of findings. The README reports a few percentage points more recall at roughly twice the API cost per review; reserve it for repositories that handle payments or credentials
SECURITY_GUIDANCE_DISABLE=1	Kill switch for the whole plugin

Write rules the model cannot infer from code: “calls to requests.get(url) with a user-controlled url go through acme.net.safe_request”. Each review sends the changed paths, diff hunks and relevant file contents to your configured model endpoint (Anthropic’s API, your gateway or your cloud provider), and the rules file goes with every review, so keep secrets out of it. The model hub has current model names and prices.

Enforce “tests ran” with a hookify rule

hookify turns a sentence into a hook rule stored as .claude/hookify.NAME.local.md, and the rule applies on the next tool call without a restart. Rule events are bash, file, stop, prompt and all; actions are warn and block. This rule, adapted from the plugin’s own require-tests-stop example (which ships with enabled: false), blocks Claude from ending a turn while none of npm test, pytest or go test appears anywhere in the session transcript:

---
name: require-tests-run
enabled: true
event: stop
action: block
conditions:
  - field: transcript
    operator: not_contains
    pattern: npm test
  - field: transcript
    operator: not_contains
    pattern: pytest
  - field: transcript
    operator: not_contains
    pattern: go test
---

No test run found in this session. Run the test suite and report the result before you stop.

Two details decide whether this rule works, both read from hookify/core/rule_engine.py in the official marketplace on 2026-09-26:

• not_contains is a literal substring test, not a regex. A single condition with pattern: npm test|pytest|go test looks for that exact string, never finds it, and blocks every stop, even after the tests ran (the upstream example uses the same | alternation: npm test|pytest|cargo test). Conditions are ANDed, so one not_contains per command blocks only when all three are missing. Use regex_match when you need alternation.
• The transcript includes your own prompts and Claude’s messages. The rate-limiting prompt earlier on this page says “npm test passes”, which satisfies the rule with no test run at all. Keep test commands out of your prompts, or match a string only your runner prints, such as pytest’s passed in. Writing the rule file in a session also puts npm test into that session’s transcript, so test the rule in a fresh session.

Save it as .claude/hookify.require-tests-run.local.md, or ask for it in words:

Copy-paste prompt: hookify a verification rule

/hookify:hookify Block stopping when the transcript has no run of npm test (one literal not_contains condition per test command, no | alternation), and warn whenever a Bash command runs git push --force. Show me both rule files before you save them.

List rules with /hookify:list and switch them on or off with /hookify:configure. Running /hookify:hookify with no arguments makes the conversation-analyzer agent mine the session for behaviour you corrected and propose rules for it. The hooks automation guide covers hand-written hooks when a regex rule is not enough.

Use the rest of the set where it fits

• claude-security runs Anthropic’s Claude Security scanning inside your session. /claude-security:claude-security offers three jobs: scan the codebase, scan changes (a branch, a PR’s diff or one commit) and suggest patches. Every candidate finding goes to verifier agents told to disprove it, and the results land in CLAUDE-SECURITY-TIMESTAMP/ as Markdown, JSONL and SARIF 2.1.0 for GitHub code scanning. Its README recommends Claude Opus 5.5 or Claude Fable 5.1. It runs under your permissions with no isolation of its own, so scan untrusted repositories only inside a sandbox. The security gates page places it next to the other scanners.
• code-simplifier is a single agent for after a feature is green: “use the code-simplifier agent on the files I changed in this branch”. Rerun the tests afterwards; “preserves behaviour” is an instruction to the model, not a guarantee.
• claude-code-setup is for the first week in a repository: ask “recommend automations for this project” and get one or two hooks, skills, MCP servers and subagents per category, each with a reason. The skill is read-only and changes no files.
• plugin-dev is for writing your own plugin: /plugin-dev:create-plugin scaffolds it and the plugin-validator agent checks it. At ~2,349 always-on tokens, enable it while you author and disable it after. Follow up with claude plugin validate --strict in CI, as building plugins shows.
• skill-creator writes a skill, runs evals with and without it, and benchmarks the variance. Use it before you share a skill, so the team adopts it on a measured difference. See building custom skills.

Copy-paste prompt: scan a branch before the PR

/claude-security:claude-security scan the changes on this branch against main at high effort. When the report is written, list each finding with severity, file and line, and the exploit precondition. For HIGH and CRITICAL findings, suggest patches but do not apply them; I will review the patch files first.

Traps checked on Claude Code 2.1.283 on 2026-09-26

• /code-review (and its alias /review), /simplify and /security-review are built-ins. The plugins are /code-review:code-review, the code-simplifier agent and the security-guidance hooks.
• README shorthand such as /hookify, /commit, /review-pr and /claude-security does not appear in the command list; use the /PLUGIN:COMMAND form.
• claude plugin add is an unknown command; the verb is install.
• typescript-lsp and pyright-lsp register typescript-language-server and pyright-langserver from your PATH and do nothing when the binary is missing.
• ralph-wiggum@claude-plugins-official does not exist; the official loop plugin is ralph-loop.

What goes wrong with Anthropic’s plugins, and how to recover

• The first session after installing security-guidance hangs at start. Its SessionStart hook prepares a Python environment with the Claude Agent SDK under ~/.claude/security/, with a 180-second timeout. Let it finish once. If reviews never report anything, check ~/.claude/security/log.txt and, on Bedrock, Google Cloud or Foundry, set SECURITY_REVIEW_MODEL to that provider’s model ID form.
• feature-dev asks questions you consider settled. It is instructed never to skip phase 3. Put decisions in the first prompt (“use Redis, trust X-Forwarded-For from our load balancer”) and the questions shrink to what is really open.
• /pr-review-toolkit:review-pr says there is nothing to review. It lists files with git diff --name-only, which shows only unstaged changes, so staged and committed work are both invisible to it. Run it before you stage anything, or ask “review the changes on this branch against main with /pr-review-toolkit:review-pr”.
• code-review posted nothing. That is the designed result when no finding scores 80 or more, or when the PR is closed, a draft, trivial or already reviewed. If you expected a comment, check gh auth status.
• commit-push-pr committed a file you did not want. Its tools allow git add on anything in the working tree. Run git status first and keep generated files in .gitignore. To fix it before anyone pulls, run git reset --soft HEAD~1, then git restore --staged <file> and add the file to .gitignore, then git commit -m "<message>", then git push --force-with-lease. Pushing straight after the reset would remove the whole commit from the PR branch instead of just the file.
• security-guidance keeps flagging code you know is safe. Add a comment on that line explaining why it is safe; the diff reviewer treats inline justifications as exclusions. For a whole class of false positives, write the exception into .claude/claude-security-guidance.md so every developer gets it.
• Parallel agents each report the same security finding. Set ENABLE_STOP_REVIEW=0 in each agent’s environment and rely on the commit review, or give each agent its own worktree.

Where to go next with Anthropic’s plugins

Plugins and marketplaces overview What a plugin bundles, the commands in each agent, and how a team allowlists marketplaces.

The plugins worth installing The 20 most-installed plugins, including vendor bundles, with measured context cost.

AI code review bots compared Where the code-review plugin sits next to managed Code Review, Bugbot and third-party bots.

Build a plugin or a private marketplace Package your own review commands and hooks and pin them for the team.