Claude Plugin Permission Preflight

• Observed: [Anthropic's community marketplace](https://github.com/anthropics/claude-plugins-community) is a read-only mirror of an internal review pipeline and says every plugin passes automated security scanning and distribution approval.
• Observed: [Claude skill/plugin scanning](https://support.claude.com/en/articles/15927065-get-started-with-skill-and-plugin-scanning) is an Enterprise beta that returns pass/warn/fail on upload/update at no extra cost.
• Observed: [Claude plugin submission docs](https://claude.com/docs/plugins/submit) require public source, run automated screening, and explicitly tell users to inspect MCPs, permissions, and third-party software.
• Measured SERP: the first five results for Claude Code plugins are claude.com, official docs, Anthropic GitHub, Reddit, and official discovery docs. Claude plugin marketplace also has Build with Claude, AITMPL, and pluginmarketplace.ai.
• Measured SERP: MCP security scanner already returns Snyk Agent Scan, Invariant MCP-Scan, mcpscan.ai, EnkryptAI, and GitHub tools. plugin security scanner is contaminated by WordPress intent.
• The only possible gap is a readable permission inventory plus version diff for non-Enterprise/private marketplaces. This is an inference, not evidence of subscription value.

Do Not Build

1. 1.The official directory and scanner directly cover the core and can expand beyond Enterprise.
2. 2.Exact scanner terms are only 10–30/month, while ecosystem head terms are officially controlled.
3. 3.Free open-source tools and security vendors already scan MCP/agent components.
4. 4.Static analysis cannot prove runtime safety; false positives/negatives damage trust.
5. 5.Private plugin uploads introduce sensitive source, credentials, and supply-chain responsibility.
6. 6.The project competes for the same developer-security channel as Agentic Workflow Injection Auditor, Model Eval Sandbox Guard, and AI Code Review Acceptance Lab.