Tip: Claude Code Plugins Can Declare defaultEnabled:false for Security-First Opt-In Activation

Claude Code Changelog·medium signal

Plugins can now set `defaultEnabled: false` in plugin.json or marketplace entries, meaning they won't activate until explicitly enabled via `/plugin` or `claude plugin enable`. Dependencies of enabled plugins still auto-enable. This is the building block for security-sensitive plugin workflows — install a scanning plugin, leave it dormant until the right project context, then enable per-repo.