Claude Report — 2026-09-28

🚀 Anthropic Official

Build plugins for Claude with the directory submission portal (Sep 25)

Opens a public submission portal for developers on paid plans to publish either a single MCP connector (pointing to a remote MCP server) or a full plugin bundle (MCP servers + Agent Skills, hosted on GitHub), with auto-validation, review-status tracking, and post-publish usage analytics. Confirms Claude now runs on "MCP 2.0" — a stateless core spec that drops the initialization handshake/session state so servers can run serverless/behind load balancers — plus two extensions: MCP Apps (interactive UI inside chat) and Enterprise Managed Auth (admin authorizes a connector once, maps it to identity-provider groups, zero-touch OAuth on first sign-in; supports Datadog, Notion, Slack, Asana, Atlassian, Canva, Figma, Granola, Linear, Supabase). This makes plugins "the main way to build third-party extensions for Claude," effectively superseding the anthropics/claude-plugins-official repo, which was archived Sep 15.

Claude Code v2.1.283 (Sep 25)

Adds an x-claude-code-prompt-id gateway header for grouping requests within one user prompt; new managed-settings availableModelsMatch (exact-match model allowlisting) and deniedModels (explicit model blocking); a new /doctor prompt-audit (/checkup prompt-audit) command that audits CLAUDE.md/skills/agents/commands for prompt patterns written for older models; a mantle upstream provider for Amazon Bedrock's Mantle endpoint; adds path to --plugin-dir load-failure entries in stream-json output; plus fixes to MCP progress notifications, SDK multi-session handling, and permission prompts.

claude-agent-sdk-python v0.2.160 (Sep 25)

Fixes follow-up turns failing after background subagents when using query() with hooks/can_use_tool/SDK MCP servers, by listening for CLI session_state_changed messages and keeping stdin open until the CLI reports idle (configurable wait ceiling, default 10 min via CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS). Bundles Claude CLI 2.1.283.

claude-agent-sdk-typescript v0.3.283 (Sep 25)

Adds plugin_errors (with failed-entry path) to SDKSystemMessage; fixes getSessionMessages()/forkSession() mishandling rewound-away branches; surfaces mid-turn warnings as system/informational stream-json messages. Changes set_max_thinking_tokens semantics — omitting the field now leaves the thinking budget unchanged instead of resetting it, so callers must send null explicitly to reset. Synced to Claude Code v2.1.283.

anthropics/skills — code-modernization hardening + Security Plugin v0.12.0 (Sep 25)

Merges a batch of code-modernization skill commits (rule-consolidation auditing, injection-safety hardening, per-Python-version failure counting, harden-scan coverage reporting) and bumps the bundled Claude Security Plugin to v0.12.0, the same day as the plugin-directory launch.

🔌 Claude Code Plugins

Plugin install-count tracking skipped this run (official marketplace cache unavailable), per instructions. Note found while researching Anthropic Official: the canonical anthropics/claude-plugins-official repo was archived Sep 15 and is now superseded by the new public Plugin Directory (see above) — top-10 install-count tracking will need to be rebuilt against the new directory once its analytics surface is accessible.

🛠️ Skills

addyosmani/agent-skills

Lands 14 commits (Sep 25 01:31 → Sep 26 04:19 UTC) culminating in a bump to plugin manifest v0.6.11: strips every negated trigger clause instead of just the first, enforces skill-anatomy layout rules, validates manifest versions against the root plugin.json, guards spec/plan/todo artifact paths on all command surfaces, and fixes an eval so code-review-and-quality fires correctly on pasted diffs.

anthropics/skills

Merges PR #6309 bundling code-modernization rule-review hardening and the Claude Security Plugin v0.12.0 bump (Sep 25) — see Anthropic Official above.

kharmanskyi/open-steps

Ships releases 0.4.4 and 0.4.5 (Sep 28) fixing a census pre-approval mismatch and clarifying error messages when ${CLAUDE_SKILL_DIR} isn't set, for this "translate your coding agent's output into plain language" skill set (989 stars).

Unchanged in window: cloudflare/security-audit-skill (last commit Sep 14), K-Dense-AI/scientific-agent-skills (only an automated scan-report commit Sep 28, no substantive change since Sep 13).

🤖 Agents & Subagents

nicobailon/pi-subagents

Ships four releases in one day — v0.72.0, v0.72.1, v0.73.0, v0.73.1 (all Sep 27) — adding thinking-level-colored subagent spinners, external inspector registration, agentOverrides-based advertising, and a post-upgrade "what's new" screen, plus ~15 further unreleased commits through Sep 28.

davila7/claude-code-templates

Adds mods across three straight days: jev-auto-mode (JSON-policy permission layer), agent-flow (live tree view of agents with context passed between them), and git-sidebar (Sep 25); a chess mod where Jev can play instead of Claude, jev-vercel-sandbox (runs risky Bash inside a Vercel Sandbox), and a catalog fix stopping partial download-count publishing (Sep 26); an llm-architect enhancement (Sep 27).

wshobson/agents

Makes the default Cedar policy deny under protect-mcp 0.7, fixes the audit trail to work with Claude Code hooks and protect-mcp 0.7.4, and adds plugin-eval tooling that generates synthetic prompts and runs isolated skill traces (Sep 25-26, 40k-star repo).

Unchanged in window: VoltAgent/awesome-claude-code-subagents (last commit Sep 21), anthropics/commerce-agents (last commit Aug 31).

🔗 MCPs & Integrations

DeusData/codebase-memory-mcp

Merges a dense wave of fixes Sep 26-27: primary-callee dispatch fix, a CLI JSON-array-args fix, a Windows unicode git-root fix, removal of a definitions-walk cap, a quadratic-complexity LSP array-access fix, plus a scoop-manifest bump to 0.11.0 — the most active repo in this tracking group by a wide margin.

upstash/context7

Documents the port 3000 default for local Docs7 dev (Sep 28), continuing its documentation push after the Sep 24-25 pricing/custom-domains updates.

graygnatconsole/mcp-audit-tool

Ships a new dependency-light Python CLI that statically scans Claude Desktop/Cursor/VS Code MCP configs for 12 vulnerability classes from the "OWASP MCP Top 10" (tool poisoning, unpinned installers, hardcoded secrets, command injection, overpermissioned filesystem roots), outputting SARIF for CI integration (created Sep 26, 118 stars in ~2 days).

Unchanged in window: ChromeDevTools/chrome-devtools-mcp (last commit Sep 25), oraios/serena (last commit Sep 24), github/github-mcp-server (last commit Sep 16), modelcontextprotocol/servers (last commit Sep 22, only a "shorten descriptions" housekeeping edit on the linked awesome-mcp-servers list Sep 27).

💡 Community — Workflows & Ideas

dzhng/jevgrep

Ships a CLI that lets coding agents find code by describing "what it does" via semantic discovery instead of literal grep, with three releases (v0.1.0 Sep 26 → v0.4.2 Sep 28) and 1,042 stars in three days.

mikehasa/golive-skill

Releases an open-source Agent Skill plus zero-dependency Node CLI that ships an agent-built app to production on the user's own accounts (hosting, DB, domain, email, payments) via a detect-plan-approve-apply-verify pipeline with no vendor backend or telemetry; alpha releases Sep 26-27, 1,028 stars.

Avinash-jetwani/jevmem

Ships automatic, persistent project memory for Claude Code (also works with Cursor/Codex), with releases v0.5.3-v0.5.7 (Sep 25-26); reached 61 points/40 comments on Hacker News the same window.

yonatangross/orchestkit

Bundles 106 skills, 36 agents, and 171 hooks into a Claude Code toolkit with a stable ork channel and a daily-shipping ork-alpha channel, publishing beta v10.0.0-beta.125 on Sep 28.

lemomo-ai/lemo-opuscar

Publishes 39 reusable "film style" prompts plus code that renders short films entirely via Claude Opus 5.5 — pick a style, bring a story, let the agent direct (created Sep 26, 451 stars).

📰 Quick Mentions

• withmcp — adds a docs command, per-server/profile env_passthrough, and export-to-all-harnesses to this MCP-toggling CLI; tagged v0.1.0 (Sep 26-27).
• tenjin-agent — adds an anonymous install-id telemetry ping (Sep 27), following its router feature from the prior cycle.
• theCity — ships v0.10.0/v0.10.1 with faster department-hiring skill matching and cached materials/box meshes (Sep 28).
• quicksilver — Claude Code skill that batches judgment calls into one review page, claiming 86% fewer tokens on a 12-task benchmark (created Sep 25, top r/ClaudeCode post).
• since-cutoff — CLI/MCP server/GitHub Action that statically diffs pinned Python deps against the model's training cutoff, no model calls needed (created Sep 25).
• archiver-rag — self-hosted MCP server turning an Obsidian vault into a queryable knowledge graph shared across Claude Code, Cursor, Gemini CLI (posted Sep 28).
• saas-motion-kit — toolkit for generating promo/motion videos for software products via Claude Code, with a 24-transition atlas and 100 storyboard themes (created Sep 25).