You install a plugin for one task, then find a bundle of instructions attached to it. The catalogue contains 16,285 plugin entries. Choosing between them means checking what each bundle contains and what it costs per session.
One install can bring a whole bundle
A plugin is a manifest: a small file listing the mods it ships. It gives you one install point, but not necessarily one behaviour.
A skill is a folder of instructions the model opens when it decides it needs them. A hook is a shell command your agent runs for you when something happens. Some plugins also ship commands, subagents, and connections to outside services.
Some bundles react to filenames. A glob is a filename pattern, like *.tsx. That detail can determine when one part becomes relevant to your work.
Across the 16,285 entries, ask what the plugin brings, which parts you need, and what those parts can do. Popularity is not enough.
The plugin bill is still unmeasured
Plugin cost depends on the mods it preloads, not the manifest’s size. A token is the unit your AI plan bills by, about three quarters of a word.
The records contain no measured token reading for any plugin. The middle cost, high-end figure, and maximum are therefore unavailable. The most expensive plugin cannot be named honestly.
For reference, the catalogue’s median CLAUDE.md file is 1,296 tokens. Across 10 sessions a day, that reference becomes 12,960 tokens. It is a comparison, not a plugin estimate.
What the scan found in 16,285 plugins
The scan gave 16,252 plugins grade A, 11 grade B, and 22 grade C or D. No entry received grade E or F.
The warnings cover network calls in 31 entries, recursive force deletes in 14, and reads from agent configuration directories in 9. Seven ask for root access, 6 download and execute remote code, and 2 contain hidden instructions. Single entries send data externally, harvest environment variables, reach for credential files, or read MCP configuration.
The examples show why the line matters. safety-hooks is grade C for recursive force delete. claude-forge is grade C for remote code execution and network calls. marketplace is grade D for root access, MCP configuration, and recursive deletion.
The scan gives you a line from the file to inspect. It reports what it found, not whether the whole plugin suits your work.
Five plugins worth a first look
No token reading is recorded for these picks. The original is the first copy of a file we saw; everything matching it afterwards is a copy.
- nextjs: instructions for Next.js caching, partial page loading, and checks against a running development server. Tokens not recorded, 22 lines, original, 0 copies.
- superpowers: a bundle of skills for test-driven development, debugging and collaboration. Tokens not recorded, 21 lines, original, 6 copies.
- humanizer: rewrites machine-sounding prose while keeping its meaning. Tokens not recorded, 16 lines, original, 2 copies.
- claude-plugins-official marketplace: a directory of Claude Code extensions for development, productivity, and outside-service connections. Tokens not recorded, 4,081 lines, original, 1 copy.
- container: explains Apple’s container tool and maps Docker, Lima, Colima, and Podman concepts on macOS. Tokens not recorded, 23 lines, original, 0 copies.
When a plugin is the wrong container
Use another kind of mod when you need one narrow behaviour. A hook suits a shell command that must run at a chosen event. A skill suits guidance that should open only for a particular task.
The context is everything the model can see while it answers you. A context-focused mod suits work where the main need is recovering earlier information, rather than adding a broad bundle.
A plugin cannot make an unknown package’s token cost known. It cannot turn every shipped part into a feature you understand. If you need one action, check whether a smaller mod is clearer.
Questions people ask
Does installing one plugin install all its parts? Yes, the plugin brings its shipped parts as one package. The catalogue marks 15,646 entries as original, so check the source and copy status before choosing.
Can I know the token cost before installing? Not for these records. Run npx agentmods cost after the mod is in your project, and treat a missing reading as unknown rather than zero.
Should a C or D grade stop me? Not automatically, and it is rare here: 22 of the 16,285 plugins carry one, compared with 16,252 at A. Inspect the warning further, or reject the plugin, when you cannot explain a warning about remote code, credentials or root access.
Do it now
Run npx agentmods add <slug> for a chosen plugin, then compare the bundle in all Claude Code plugins.