Anthropic's plugin marketplace runs four CI gates on supply chain risk, including a static pin check for auto-executing MCP launchers

GitHub·high signalXBlueskyLinkedInCopy link

The .github/workflows directory of anthropics/claude-plugins-community holds bump-plugin-shas.yml, owner-liveness-sweep.yml, validate-plugins.yml and close-external-prs.yml. Commit history shows the gates doing real work: a 2026-08-19 commit added a deterministic static pin check for auto-exec MCP launchers, and 2026-08-12 commits removed 10 entries whose upstream sources had gone unavailable and re-pointed one renamed source. For anyone running an internal skill or plugin registry, this is a working reference implementation of pin-plus-liveness enforcement rather than a policy document.