Claude turns MCP servers and skills into governed directory products
Anthropic's new submission portal accepts remote MCP connectors or GitHub-hosted plugin bundles, safety-scans them, tracks review, and exposes install, version and search analytics after publication.
By Parminder Kumar Sharma · · 5 min read
The directory now has a developer-facing route from submission to measurement
On 25 September 2026, Anthropic opened a directory submission portal to developers on paid Claude plans. Anthropic describes plugins as packages containing MCP connectors, Agent Skills or both. Approved submissions can be listed in the Claude directory.
Developers can submit a single remote MCP connector by pointing Claude at its server, or a plugin bundle hosted on GitHub. A bundle can combine MCP servers and skills; in Claude Code it can also include language-server integrations, commands, hooks and agents.
The portal validates and safety-scans a submission, shows review status and feedback, and leaves the final publication decision with the developer after approval. Once live, analytics report installs by product surface and version, listing views and the searches that led users to the plugin.
An MCP endpoint is becoming one component of a larger product
What the plugin wrapper adds around an MCP server
| Layer | What it provides | Developer responsibility |
|---|---|---|
| MCP connector | Tools, resources and prompts exposed by a remote server | Stable schemas, safe execution, authentication and availability |
| Agent Skill | Instructions and reusable workflows for how Claude should perform a task | Clear scope, test cases and resistance to unsafe inputs |
| Plugin bundle | A package that can combine connectors and skills | Version compatibility and a coherent user experience |
| Directory listing | Discovery, positioning and installation | Accurate claims, support information and useful examples |
| Portal review | Automated checks, safety scan and human feedback | Fix findings and resubmit without hiding material behaviour |
| Analytics | Installs, versions, surfaces, views and search terms | Use metrics without collecting unnecessary user content |
This packaging matters because successful connectors fail for product reasons as often as protocol reasons. Users need to understand what the plugin can read, what it can change, which account it acts as, and whether an action is reversible. Maintainers need release notes, support, compatibility testing and a way to distinguish a service outage from an authentication failure.
Search analytics also turn naming and documentation into part of distribution. A technically capable connector can remain invisible if its listing does not match the language people use to find the job it performs.
MCP 2.0 adds a stateless core, interactive apps and managed enterprise authentication
Anthropic says Claude supports the latest MCP specification, which it refers to as MCP 2.0, including a stateless core. Stateless operation can simplify horizontally scaled remote services because a request need not depend on hidden memory inside one long-lived server process. Application state still exists somewhere; the design question is whether it belongs in the client, an explicit session service, a database or another auditable store.
The announcement highlights two extensions. MCP Apps can present interactive user interfaces inside chat. Enterprise Managed Auth can provide zero-touch OAuth for enterprise users. Both improve usability while expanding the boundary that needs review. An embedded interface can collect input and initiate actions; managed authentication can grant access at organisational scale. Neither removes the need for least privilege, clear consent and logs.
A directory-ready plugin needs evidence beyond a working demo
Take this with you
Pre-submission review
- List every tool, resource, prompt and skill included in the submitted package
- Document the data each capability reads, writes, sends onward and retains
- Use narrow OAuth scopes and separate read actions from destructive or high-impact actions
- Require confirmation at the point where a user can understand the exact external effect
- Test malformed inputs, prompt injection, cross-tenant access, replay and unavailable dependencies
- Pin dependencies and define how plugin versions map to server and skill versions
- Provide deletion, revocation, support and incident-contact paths
- Keep directory claims, examples and screenshots accurate as the service changes
- Monitor failures, unusual tool use and authentication anomalies without logging unnecessary content
The distribution layer raises the value of narrow, trustworthy tools
A directory reduces the friction of discovery and installation. That can help small, well-designed connectors reach users without each developer building a separate acquisition channel. It also concentrates trust: users may interpret directory presence as a stronger guarantee than a point-in-time review can provide.
The strongest plugin products will keep their promise small enough to understand. A connector that publishes one validated article, checks one compliance record or reads one bounded dataset is easier to permission and audit than a connector that can act across an entire business account. Bundles can still provide rich workflows by composing several narrow capabilities rather than presenting one unrestricted tool.
Key facts
Sources
- PrimaryBuild plugins for Claude with the directory submission portalAnthropicaccessed 2026-09-27
- PrimaryModel Context Protocol specificationModel Context Protocolaccessed 2026-09-27
