Skip to content
palmpalmpalm

Install plugins and marketplaces

Claude Code, Cursor and Codex plugins ship in repositories, often listed in a marketplace.json. Each harness’s own installer serves only that harness. palm reads the same repository and installs a plugin’s skills, agents (subagents), hooks and MCP servers for all your harnesses at once.

When you finish, one plugin is installed for Claude Code and Codex, its hook script is committed, and one skill is excluded for the team:

  • Folder.agents/
    • Folderskills/
      • Foldertest-driven-development/
        • Folderscripts/
          • …
        • SKILL.md
        • testing-anti-patterns.md
      • Folderwriting-skills/
        • Folderexamples/
          • …
        • SKILL.md
  • Folder.claude/
    • Folderskills/
      • Foldertest-driven-development/
        • Folderscripts/
          • …
        • SKILL.md
        • testing-anti-patterns.md
      • Folderwriting-skills/
        • Folderexamples/
          • …
        • SKILL.md
    • settings.json
  • Folder.codex/
    • hooks.json
  • Folder.palm/
    • Folderassets/
      • Folderobra__superpowers/
        • Foldersuperpowers/
          • …
  • palm.lock.yaml
  • palm.yaml

The session on this page ran against palm’s fixture that mirrors obra/superpowers.

Before you start

Section titled “Before you start”
  • A project with its targets set, for example palm init --target claude,codex.
  • The repository that holds the plugin or the marketplace.

Steps

Section titled “Steps”

  1. See what the repository offers.

    Terminal window
    palm install anthropics/claude-plugins-official
    ~/project
    $ palm install anthropics/claude-plugins-official
    i 5 notes from indexing anthropics/claude-plugins-official (see: palm describe source anthropics/claude-plugins-official)
    anthropics/claude-plugins-official  main (bc94689)   3 plugins, 2 skills, 1 agent, 1 hook, 3 MCP servers
      plugin  agent-sdk-dev           2 skills, 1 agent, 1 hook   (also hook agent-sdk-dev: name it plugin:agent-sdk-dev)
      plugin  github                  1 MCP server   (also mcp github: name it plugin:github)
      plugin  context7                2 MCP servers   (also mcp context7: name it plugin:context7)
      skill   sdk-helper              Helps with Agent SDK questions.
      skill   new-sdk-app             Create and setup a new Claude Agent SDK application
      agent   agent-sdk-verifier-py   Use this agent to verify a Python Agent SDK app. Examples: <example>C…
      hook    agent-sdk-dev           claude: PreToolUse -> python3 hooks/guard.py   (a program; asks before installing)   (also plugin agent-sdk-dev: name it hook:agent-sdk-dev)
      mcp     github                  http: https://api.githubcopilot.com/mcp/   (also plugin github: name it mcp:github)
      mcp     context7                http: https://mcp.context7.com/mcp   (also plugin context7: name it mcp:context7)
      mcp     fs                      stdio: npx -y @modelcontextprotocol/server-filesystem .   (a program; asks before installing)
    Nothing written. Install some:
        palm install anthropics/claude-plugins-official sdk-helper new-sdk-app
        palm install anthropics/claude-plugins-official --all

    A marketplace lists plugins. palm indexes each plugin kept in the same repository and lists its members. A plugin hosted elsewhere gets a warning with the palm install line that declares its repository as a source of its own. palm never fetches it by itself. A name that belongs to both a plugin and a member, such as a skill, is marked in the listing. On a terminal palm asks which one you mean; without one, write plugin:<name> or skill:<name>.

  2. Install the plugin.

    Terminal window
    palm install obra/superpowers plugin:superpowers

    plugin: selects every member. palm records plugins: [superpowers] in palm.yaml, and each member’s lock entry says via: plugin:superpowers. To take only some members, name them instead, or add only: to the plugin entry.

  3. Review the hook, and consent.

    A plugin’s hook runs a program on every matching event. palm shows the command, the targets and every script, and asks. Without a terminal it stops and prints the --allow-exec line.

    ~/project
    $ palm install obra/superpowers plugin:superpowers
    This install adds 1 program that will run on your machine.
    

      1. hook superpowers  from obra/superpowers  (commit 083545e, v4.0.3, 2026-09-28)
         SessionStart  startup|clear|compact  CLAUDE_PLUGIN_ROOT="$CLAUDE_PROJECT_DIR"/.palm/assets/obra__superpowers/superpowers "$CLAUDE_PROJECT_DIR"/.palm/assets/obra__superpowers/superpowers/hooks/run-hook.cmd session-start
         targets: claude (.claude/settings.json), codex (.codex/hooks.json)
         scripts: 2 files, 355 B  ->  .palm/assets/obra__superpowers/superpowers/  (committed with your repo)
           hooks/run-hook.cmd  755   50 B  sha256:94db96e9
           ... 1 more  (--review shows every script)
    

    palm never runs this itself. If you say yes, its hash goes into palm.lock.yaml,
    so teammates and CI install it without being asked; any change asks again.
    x 1 program needs your consent and there is no terminal
      review:  palm install obra/superpowers plugin:superpowers --dry-run --review
      then:    palm install obra/superpowers plugin:superpowers --allow-exec hook:superpowers@obra/superpowers=sha256:b48cbe63031365a952411e29c59221210e4f41802b5c66b0cec3dc2ed5cf37eb
    $ palm install obra/superpowers plugin:superpowers --allow-exec hook:superpowers@obra/superpowers=sha256:b48cbe63031365a952411e29c59221210e4f41802b5c66b0cec3dc2ed5cf37eb
    This install adds 1 program that will run on your machine.
    

      1. hook superpowers  from obra/superpowers  (commit 083545e, v4.0.3, 2026-09-28)
         SessionStart  startup|clear|compact  CLAUDE_PLUGIN_ROOT="$CLAUDE_PROJECT_DIR"/.palm/assets/obra__superpowers/superpowers "$CLAUDE_PROJECT_DIR"/.palm/assets/obra__superpowers/superpowers/hooks/run-hook.cmd session-start
         targets: claude (.claude/settings.json), codex (.codex/hooks.json)
         scripts: 2 files, 355 B  ->  .palm/assets/obra__superpowers/superpowers/  (committed with your repo)
           hooks/run-hook.cmd  755   50 B  sha256:94db96e9
           ... 1 more  (--review shows every script)
    

    palm never runs this itself. If you say yes, its hash goes into palm.lock.yaml,
    so teammates and CI install it without being asked; any change asks again.
    

    allowed by --allow-exec: hook:superpowers@obra/superpowers (sha256:b48cbe63)
    i ref ^4.0 saved to palm.yaml (latest tag v4.0.3); edit ref: to track main
    + skill  brainstorming             .agents/skills/brainstorming/, .claude/skills/brainstorming/   2 files   from obra/superpowers v4.0.3   (claude gets its own copy in .claude/skills)
    + skill  test-driven-development   .agents/skills/test-driven-development/, .claude/skills/test-driven-development/   6 files   from obra/superpowers v4.0.3
    + skill  writing-skills            .agents/skills/writing-skills/, .claude/skills/writing-skills/   4 files   from obra/superpowers v4.0.3
    + hook   superpowers               .palm/assets/obra__superpowers/superpowers/, .claude/settings.json +1   2 files +2 merged   from obra/superpowers v4.0.3
    ~ trusted hook superpowers sha256:b48cbe63
    4 installed. Commit palm.yaml, palm.lock.yaml, .agents/, .claude/, .palm/ and .codex/ together.
    $ palm remove brainstorming
    x skill brainstorming from obra/superpowers: brainstorming belongs to plugin superpowers: exclude it for the team, or remove the plugin
      palm remove obra/superpowers skill:brainstorming --exclude
    $ palm remove obra/superpowers brainstorming --exclude
    - skill  brainstorming   .agents/skills/brainstorming/, .claude/skills/brainstorming/   2 files
    1 removed.
    $ cat palm.yaml
    targets: [claude, codex]
    sources:
      obra/superpowers:
        ref: ^4.0
        plugins: [{name: superpowers, exclude: [skill:brainstorming]}]

    If you answer no, palm installs the rest of the plugin and exits 0. It writes the hook into the plugin’s exclude: list in palm.yaml, so the decline shows up in review, and bare installs keep it out.

  4. Drop a member for everyone.

    Terminal window
    palm remove obra/superpowers brainstorming --exclude

    Removing a plugin member by name alone stops and names both choices. --exclude adds skill:brainstorming to the plugin’s exclude: list, so a teammate’s bare install and the next update keep it out.

Where hook scripts go

Section titled “Where hook scripts go”

palm copies what a hook runs into .palm/assets/<source>/<hook>/. That is the folder that holds the hook definition, plus every file a command names or a script reads. The review lists the files a script reads as reads:, so a hook that loads a skill’s text at session start works in every harness. It never copies AGENTS.md or plugin manifests, and .palm/assets is no folder a harness scans, so no harness finds a second copy there. Commands point at the copy through each harness’s project directory variable, such as "$CLAUDE_PROJECT_DIR", never through an absolute path. You commit the folder, so a clone without palm has working hooks.

Member names

Section titled “Member names”

palm installs a plugin’s members as loose entities, each under its own name. Claude Code’s own plugin installer shows the same skill with the plugin as a prefix, such as superpowers:brainstorming.

Where The skill is called
palm install, palm remove, palm describe brainstorming or skill:brainstorming
the harness’s skill list, after palm installed it brainstorming
the plugin’s own text, and Claude Code’s plugin installer superpowers:brainstorming

superpowers:brainstorming is not a palm name. palm reads superpowers: as a kind and stops with "superpowers" is not a kind. palm copies a skill’s text as the source wrote it, so a sentence such as use the superpowers:brainstorming skill stays as it is. The skill it points at is installed, under the plain name.

Harnesses without plugins

Section titled “Harnesses without plugins”

Gemini CLI and OpenCode get a plugin’s members as loose files. OpenCode has no declarative hooks, so palm skips a plugin’s hooks there, says so, and installs the rest.

Check the result

Section titled “Check the result”
Terminal window
palm get
palm remove obra/superpowers plugin:superpowers

palm get lists each member, and palm describe <member> shows selected by plugin:superpowers. palm remove ... plugin:superpowers removes every member, the merged hook entries and the asset folder. A member that another installed plugin also declares stays, and palm says which command removes both.

When a plugin you installed starts to ship a new hook or MCP server, palm update lists it as i new program available, with the command that installs it. Nothing that runs a program joins your setup without your naming it.

Next steps

Section titled “Next steps”