# Community Resources

URL: https://developertoolkit.ai/en/resources/community/
Description: Where Cursor, Claude Code, and Codex maintainers answer, where skills, plugins, and MCP servers are shared, and how to vet community fixes before adopting them.

Each coding agent has its own official channels where maintainers answer: the Cursor forum at forum.cursor.com, the Claude Developers Discord plus the `anthropics/claude-code` issue tracker, and GitHub Issues and Discussions on `openai/codex`. Skills, plugins, and MCP servers are shared through registries and curated lists, and anything taken from them needs vetting before a team adopts it.

A teammate pastes a Discord workaround for a hook bug into the shared settings. Three weeks later nobody remembers which version it was for, the upstream fix shipped in a release you already run, and the workaround now hides a different bug. This page is for developers and tech leads who want faster answers than the vendor docs give, and who need community fixes and extensions to enter the team setup with evidence attached.

## What this page gives you

- The verified official channel for each tool, and what each one is for.
- The places where MCP servers, skills, and plugins are shared across tools.
- A five-step routine, with three copy-paste prompts, for adopting a community fix or extension without reading every line of it.
- The ways community advice goes wrong, and how to recover.

## Where do each tool's maintainers answer?

The channels differ per tool, so each one gets its own tab. Every channel in these tabs was checked on 2026-09-26.

**Claude Code**

| Channel | Use it for |
| --- | --- |
| [Claude Developers Discord](https://anthropic.com/discord) | Questions and workflow discussion; the `anthropics/claude-code` README links it. |
| [`anthropics/claude-code` issues](https://github.com/anthropics/claude-code/issues) | Searching known bugs before you report one. The repository has no Discussions tab (checked 2026-09-26). |
| `/bug` in a session | Reporting a bug with session context. On Amazon Bedrock, Google Cloud's Agent Platform or Microsoft Foundry it writes a local bundle under `~/.claude/feedback-bundles/` that you forward yourself. |
| `/release-notes` in a session | Checking whether a fix already shipped in the version you run. |

**Codex**

| Channel | Use it for |
| --- | --- |
| [`openai/codex` issues](https://github.com/openai/codex/issues) | Bugs and feature requests. Search first, then include steps to reproduce, expected and actual behaviour, version, OS, and logs. |
| [`openai/codex` Discussions](https://github.com/openai/codex/discussions) | Questions and usage patterns. |
| [Codex releases](https://github.com/openai/codex/releases) | Checking whether a fix already shipped. |
| [OpenAI Developer Forum](https://community.openai.com) | Broader OpenAI questions; it also carries Codex threads. |

The Codex [contributing guide](https://github.com/openai/codex/blob/main/docs/contributing.md) says the project does not accept external code contributions. A detailed issue with a root-cause analysis is the contribution that lands.

**Cursor**

| Channel | Use it for |
| --- | --- |
| [Cursor forum](https://forum.cursor.com) | Bugs and feature requests; the `cursor/cursor` README sends both there. |
| [`cursor` GitHub organization](https://github.com/cursor) | Official repositories, including the `plugins` marketplace and `cookbook`. |
| `security-reports@cursor.com` | Security vulnerabilities. The README asks you not to post them publicly. |

What to put in a report for each tool is covered in [how to report bugs and request features](/en/resources/feedback/). For fixes you can try before you report, see the [troubleshooting guide](/en/resources/troubleshooting/).

## Where are skills, plugins, and MCP servers shared?

These sources cut across all three tools. Popularity here means attention, not quality, so vet each entry on its own.

| Source | What it holds | Notes |
| --- | --- | --- |
| [MCP Registry](https://registry.modelcontextprotocol.io) | Published MCP servers | A preview, not GA. See [MCP registries and gateways](/en/ecosystem/mcp/registry-and-gateways/). |
| [`modelcontextprotocol/servers`](https://github.com/modelcontextprotocol/servers) | Reference server implementations | Its README sends you to the Registry for the full list. |
| [MCP Discussions](https://github.com/modelcontextprotocol/modelcontextprotocol/discussions) | Q&A, ideas, working-group notes | Where spec changes are discussed before they ship. |
| [skills.sh](https://skills.sh) and [`vercel-labs/skills`](https://github.com/vercel-labs/skills) | Cross-agent skills directory and the `skills` CLI (1.7.0) | See [installing and managing skills](/en/ecosystem/skills/installing-managing/). |
| [`anthropics/claude-plugins-community`](https://github.com/anthropics/claude-plugins-community) | Anthropic-reviewed third-party Claude Code plugins | More marketplaces in [marketplaces and registries](/en/ecosystem/plugins/marketplaces-registries/). |
| [`hesreallyhim/awesome-claude-code`](https://github.com/hesreallyhim/awesome-claude-code) | Curated skills, hooks, workflows, and tools | A list of links, so vet each entry separately. |

## How do you adopt a community fix or extension safely?

Follow these steps whenever something from a forum, a Discord thread, or a registry is about to enter your repository or your team's shared settings. Steps 1 to 3 use different commands in each tool; the tabs after the steps list them.

1. Reproduce the problem on your own version. Compare the version you run with the one in the thread. Advice written for an older release often no longer applies.

2. Check whether upstream already fixed it in a release. If a release fixes it, upgrade instead of adopting the workaround.

3. List before you install. For skills in any of the three tools, `npx skills add OWNER/REPO --list` shows the skills in a repository without installing them. For plugins, use your tool's marketplace commands from the tabs below.

4. Have the agent audit the source and prove the fix with the prompts below. You review the audit and the reproduction result, not every line.

5. Record the source URL, the version it was tested on, the date, and the condition for removing it next to the change. The [release-watch routine in keeping a team current](/en/teams/keeping-current/) is where those removal conditions get checked each week.

`OWNER/REPO` is the GitHub repository that holds the skills, and `PLUGIN_NAME` is the plugin's name.

**Claude Code**

| Step | Command or place |
| --- | --- |
| 1. Version | `claude --version` in the terminal. |
| 2. Upstream fix | `/release-notes` in a session. |
| 3. Plugins | `claude plugin marketplace add anthropics/claude-plugins-community` adds the community marketplace. After a plugin installs, `claude plugin details PLUGIN_NAME` shows its components and projected token cost. |

**Codex**

| Step | Command or place |
| --- | --- |
| 1. Version | `codex --version` in the terminal. |
| 2. Upstream fix | The [Codex releases page](https://github.com/openai/codex/releases). |
| 3. Plugins | `codex plugin marketplace add` adds a local or Git marketplace, and `codex plugin marketplace list` shows the ones Codex is considering (checked on 0.157.1). `codex plugin list` shows the available plugins without installing any. |

**Cursor**

| Step | Command or place |
| --- | --- |
| 1. Version | Note the Cursor version you run and today's date, and compare both with the thread. |
| 2. Upstream fix | [Cursor's changelog](https://cursor.com/changelog). |
| 3. Plugins | Read `.cursor-plugin/marketplace.json` in the [`cursor/plugins`](https://github.com/cursor/plugins) repository to see the official entries without installing anything, then install one with `/add-plugin PLUGIN_NAME` in Agent chat. No Cursor CLI plugin command was verified on 2026-09-26. |

**Copy-paste prompt: audit a community skill or plugin before install**

```text
Before I install anything, audit the skill or plugin at https://github.com/OWNER/REPO.
Read every file it would add: SKILL.md files, scripts, hooks, MCP server
definitions, and plugin manifests. Report, as a table:
1. Every command or script it can run, and whether it runs automatically (hooks) or only on request.
2. Every network call, credential, or environment variable it reads.
3. Every file outside its own folder it can write.
4. Anything that fetches and runs remote code at install or run time.
Then give a verdict: install as-is, install with named changes, or do not install.
Do not install or run anything during this audit.
```

**Copy-paste prompt: prove a forum workaround before adopting it**

```text
A community thread (URL below) suggests this workaround for a problem we see.
1. Write scripts/repro-community-fix.sh that reproduces the problem on our
   current setup and exits non-zero while the problem is present.
2. Run it and show me the failing output.
3. Apply the workaround in the smallest possible change and run the script
   again; it must exit zero.
4. Run our full test suite and report any new failures.
5. Add a comment next to the change with the thread URL, the tool version we
   tested on, today's date, and the upstream issue to watch for removal.
If step 2 does not fail, stop and tell me: the workaround is not for our problem.
Thread: URL
```

**Copy-paste prompt: draft an upstream bug report**

```text
Draft a bug report for the problem we just hit. First search the tool's open
and closed GitHub issues for duplicates and list any you find with their links.
If none match, write the report with: a one-line summary, exact steps to
reproduce on a clean checkout, expected versus actual behaviour, the tool
version and OS, and the relevant log lines. Replace every token, API key,
email address, internal hostname, and customer name with a placeholder. Do
not submit it; show me the draft.
```

## How do you verify community advice without reading every line?

The evidence you keep is the reproduction script and your own gates, not a reviewer's read-through.

- **A failing-then-passing reproduction.** The script from the second prompt must fail before the change and pass after it. If it never failed, the fix addresses a different problem.
- **Your existing gates.** Tests, type checks, and lint run with the change applied. For a skill or plugin, compare a few representative tasks with and without it; `claude plugin eval` runs a plugin's eval cases against a no-plugin baseline.
- **An audit you can read in two minutes.** The first prompt reduces a skill or plugin to what it runs, reads, and writes.
- **A named owner.** The tech lead, or whoever owns the shared agent configuration, signs off on changes to team settings; individuals can trial anything in their user scope first.

## What goes wrong with community advice?

| Symptom | Cause | Recovery |
| --- | --- | --- |
| A command from a thread fails with an unknown-option error | The advice predates a removal: `codex exec --full-auto` was removed in Codex 0.147.0 | Check `--help` on the installed CLI and the release notes, then translate the advice to the current command. |
| A command from a thread runs but does something different | The advice predates a behaviour change: since Claude Code v2.1.223, `/review` is an alias of `/code-review` rather than a separate command | Read the command's entry in the vendor's command reference, then check the output matches what the thread expected. |
| A workaround stops working, or masks a new bug, after an upgrade | Nobody recorded why it existed or when to remove it | Re-run its reproduction script; if the script now passes without the workaround, delete the workaround. |
| A popular skill behaves unexpectedly | Stars and install counts measure attention, and aggregators re-list skills with their own counters | Audit the upstream repository, not the aggregator copy, and follow [skill supply-chain security](/en/ecosystem/skills/skill-security/). |
| Secrets or customer data appear in a public post | Logs and configs were pasted unredacted | Rotate the exposed credential at once, then ask the moderators to remove the post. Use the redaction step in the bug-report prompt next time. |
| A security bug is discussed in public | It was filed as a normal issue | Use the project's private channel instead: the `SECURITY.md` in `anthropics/claude-code` (HackerOne) or `openai/codex` (Bugcrowd), or `security-reports@cursor.com` for Cursor. |

## Where to go next

- [Report a bug or request a feature](/en/resources/feedback/) — The diagnostics each tool's maintainers need.
- [Keep a team current](/en/teams/keeping-current/) — A weekly release watch that retires stale workarounds.
- [Marketplaces and registries](/en/ecosystem/plugins/marketplaces-registries/) — Where plugins, skills, and MCP servers come from.
- [Skill supply-chain security](/en/ecosystem/skills/skill-security/) — What to check before a skill reaches your agent.