Mechanism
One catalog, two delivery paths, no runtime in the middle.
Skill Belt is a server that decides who is allowed to have what, and a client that puts it where each agent looks. Nothing sits in the request path between an agent and a model.
Path one: Claude Code reads the catalog natively
Claude Code can point at an HTTPS marketplace endpoint, and that endpoint is allowed to return a different plugin list per user. So entitlement is just a filtered array. We serve the catalog, Claude Code's own /plugin interface does the browsing and installing, and nothing about the experience is ours.
Authentication comes through headersHelper — our CLI, printing an authorization header. That helper has a ten-second timeout and runs from~/.claude, so the token read is a keychain lookup and nothing else.
Two sharp edges we design around
- A URL-served marketplace cannot use relative plugin paths, so every entry is an
archivesource pinned with asha256. You can verify what you downloaded matches what we published. - If a declared version does not change, clients keep their cached copy. Publishing always bumps the integer, so the version and the digest never disagree.
Archive sources need Claude Code v2.1.224 or newer. The CLI detects the version and tells you rather than failing quietly.
$ curl -H "Authorization: Bearer sk_…" https://api.skill-belt.com/marketplace.json { "name": "northwind", "plugins": [ { "name": "close-the-month", "version": "1.4.0", "source": { "type": "archive", "url": "https://api.skill-belt.com/plugins/close-the-month/1.4.0/archive", "sha256": "9c1f…" } } ] }✓ 200 · 6 plugins for [email protected] · audit 8f21cThe same URL, called with a different token, returns a different list. That request is also the audit record — every fetch arrives carrying an identity, so the log falls out of the architecture rather than being bolted onto it.
Path two
For everyone else, the CLI writes the files.
There is no marketplace protocol outside Claude Code, so the client does the work. It's a maintenance treadmill with no glory in it, which is exactly why we think it holds.
| Client | How it lands | Where it lands |
|---|---|---|
| Claude Code | Native marketplace endpoint | ~/.claude/plugins |
| Cursor | CLI writes to disk | ~/.agents/skills · .agents/skills |
| Codex CLI | CLI writes to disk | ~/.agents/skills · .agents/skills |
| Gemini CLI | CLI writes to disk | ~/.agents/skills · .agents/skills |
Cursor, Codex and Gemini CLI all read one shared folder — ~/.agents/skills/for a person, .agents/skills/ for a project — so the CLI writes each skill there once, in its own folder named for the plugin it came from. Hooks and MCP servers only work in Claude Code for now, and the CLI says what it skipped rather than dropping it silently.
The CLI is open source under MIT. It runs on your developers' machines, holds credentials in their keychains and writes into their agent directories, and we do not think a closed binary earns that permission. You can read it before you run it.
Details
What people ask before they install it.
Does the CLI need admin rights on a laptop?
No. It writes inside the user's home directory and the current project, and never touches a path some client isn't already reading.
Where do credentials live?
In the operating system keychain. Claude Code strips environment variables containing TOKEN, SECRET, KEY or AUTH from sandboxed commands, so a keychain read is the only mechanism that works reliably anyway.
What happens when we pull a version?
The next fetch stops returning it, the archive download starts returning 403, and re-running install removes the local copy. For Claude Code specifically we are still testing what happens to an already-installed plugin when it leaves the catalog, and we will not claim instant revocation until we have proved it.
Can we run this behind a proxy or in an air-gapped network?
The hosted catalog needs outbound HTTPS to skill-belt.com. A self-hosted control plane is an Enterprise conversation.
The price is on the page. That is the whole idea.
$99 a month for up to 50 people, cancelled from the billing page. If you've got a question first, ask it — a person answers.