Anthropic's Claude Marketplace Has 2,000+ Plugins — Built on the Exact Thing We've Warned About All Month

Anthropic launched Claude Marketplace on September 23 — a single catalog for connectors, plugins, AI-powered products, and consulting partners built on Claude. More than 2,000 connectors and plugins were live at launch, growing out of a smaller preview that started in March with just six partners. The numbers are the headline. The foundation underneath them is what this site has spent the month covering from the risk side.

What actually launched

Three sections, stitched into one catalog:

• Connectors and plugins — the integrations that let Claude reach into tools teams already run: Atlassian (Jira, Confluence), Google Workspace, Microsoft 365, Notion, Salesforce, and hundreds more, all live at launch.
• Agents and products — purchasable, Claude-powered software from companies including CrowdStrike, Cursor, Harvey, Legora, Lovable, and Snowflake.
• Service partners — a directory of consulting and implementation firms, including Accenture, Boston Consulting Group, and Deloitte.

Atlassian’s Jamil Valliani framed the pitch simply at launch: ask Claude a question and trust that it truly understands your world. That’s the product vision. Getting there depends entirely on what’s actually running behind each of those 2,000+ connectors.

The foundation is MCP and Agent Skills — which is exactly our point

Here’s the detail worth sitting with if you’ve read anything else on this site this month: developers build these connectors and plugins using Model Context Protocol and Agent Skills — the same open standards behind Bumblebee (the MCP security scanner we covered), Plugin4Shell (the SHA-pinning bypass affecting plugin marketplaces across Claude Code, Codex, Copilot, and Gemini CLI), and GitSpawn (the git-config exploit hitting seven coding agents). A 2,000-connector marketplace built on MCP isn’t a coincidence running alongside those stories — it’s the same ecosystem, at a much larger distribution scale, launched in the same month those vulnerabilities were disclosed.

That’s not a reason to avoid the marketplace. It’s a reason to read “2,000+ connectors” as “2,000+ pieces of MCP-based code now installable in one click by any Claude user,” and to bring exactly the scrutiny this site has been applying to MCP servers generally to anything you add from this catalog specifically.

What Anthropic actually built to address this

To Anthropic’s credit, the infrastructure isn’t nothing. A developer submission portal went live September 25 — two days after the marketplace itself — giving builders on Claude’s paid plans a structured path to list tools, complete with safety scans, review tracking, and post-launch usage analytics once a plugin is approved.

That’s a real step beyond “anyone uploads anything.” Safety scanning at submission time, specifically, is the kind of control that could catch some of what Plugin4Shell and GitSpawn exploited — if the scan is actually checking for those failure modes, which Anthropic hasn’t publicly detailed.

The honest open question

Here’s what the launch announcement doesn’t say, and it matters: no public detail on search ranking, discoverability criteria, or the specific quality/security review standard a connector has to clear before listing. Byte Iota’s analysis of the launch put this plainly — a catalog of 2,000 integrations is simultaneously an impressive launch number and a discoverability problem, and the announcement is silent on both how listings get ranked and what “reviewed” actually means in practice for a submitted MCP connector.

It’s also unclear from public reporting whether Anthropic takes a revenue cut from marketplace transactions, which would be a reasonable detail to know before assuming the marketplace’s incentives are purely about catalog quality rather than also being about transaction volume.

None of this means the marketplace is unsafe. It means the actual vetting standard is currently a black box from the outside, and “safety scans” without published criteria is a claim to verify over time through track record, not something to take as a settled guarantee on day one.

The business angle worth knowing

Procurement friction is explicitly part of the pitch. Snowflake’s own framing: the marketplace makes it easier for Anthropic customers to adopt Snowflake by letting them apply existing committed Claude spend toward it. If your organization already has a Claude enterprise agreement, this marketplace is partly designed to let you spend against that commitment rather than opening a new vendor contract — a real, practical procurement advantage if that’s a friction point your team has hit before.

What to actually do before adding anything from this marketplace

• Treat “listed in Claude Marketplace” as a starting point for vetting, not a substitute for it — the same standard this site has applied to any MCP server, applied here specifically because the underlying technology is identical.
• Check who built it, not just what it claims to do. A connector from Google, Atlassian, or Salesforce carries a different trust baseline than one from an unfamiliar third-party developer, even if both cleared the same submission scan.
• Watch for Anthropic publishing a more detailed vetting standard over time — the submission portal’s existence suggests the infrastructure for this exists; whether the criteria become public is the thing worth tracking, not assuming.
• Apply the same permission-scoping discipline covered in our Amazon Seller Central piece: know exactly what a connector can reach before installing it, regardless of where it was listed.

Official reference: Anthropic’s own Claude Marketplace announcement (anthropic.com), cross-checked against gHacks, BleepingComputer (via aiweekly.co), and Byte Iota’s analysis of the launch, all dated September 23-28, 2026. Marketplace policies and vetting standards are likely to evolve — check Anthropic’s current documentation before relying on any specific claim here.