Step 9: Package and Share as a Plugin

One-Line Summary: Polish the plugin for redistribution — version it, write the README, set up a marketplace via a git repo, and walk through what someone else (or your future self) would do to install it.

Prerequisites: Step 8 (permissions hardened)

What "Packaged" Means

In Claude Code's plugin model, a plugin is a directory. Packaging means:

1. The directory is in a git repository.
2. The repository can be added as a marketplace.
3. Users install via /plugin install <name>@<marketplace>.

There is no central registry to push to (that's a feature, not a bug — anyone can host a marketplace). Distribution is git clone, essentially.

Final Directory Audit

Your plugin directory should look like:

harness-codereview/
├── .claude-plugin/
│   └── plugin.json
├── .gitignore
├── LICENSE
├── README.md
├── agents/
│   ├── correctness-reviewer.md
│   ├── security-reviewer.md
│   └── style-reviewer.md
├── commands/
│   ├── review-explain.md
│   ├── review-strict.md
│   └── review.md
├── hooks/
│   ├── post-tool-use.sh
│   ├── pre-tool-use.sh
│   ├── session-start.sh
│   └── stop.sh
├── mcp-server/
│   ├── dist/
│   │   └── index.js
│   ├── package.json
│   ├── package-lock.json
│   ├── src/
│   │   └── index.ts
│   └── tsconfig.json
├── settings.example.json
└── workers/
    └── audit-worker.ts

Add a LICENSE file. MIT is the simplest and most permissive:

cd ~/dev/harness-codereview
curl -sL https://opensource.org/license/mit/ > /dev/null  # check
cat > LICENSE <<'EOF'
MIT License
 
Copyright (c) 2026 Your Name
 
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
 
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
 
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
EOF

Write the Real README

The README is the user's first experience. It should answer: what does this do, is it safe, how do I install, how do I use, how do I debug.

Replace the README stub from Step 2 with the full version:

# harness-codereview
 
A Claude Code plugin that turns Claude Code into a code-review swarm.
Three specialized sub-agents (style, correctness, security) run in
parallel via slash commands and produce a unified review report.
 
## What it does
 
When you type `/review` in Claude Code:
 
1. Three sub-agents spawn in parallel, each reviewing the current diff
   from a single perspective (style, correctness, security).
2. Each sub-agent uses a custom MCP tool server (eslint, ruff, semgrep,
   project tests) for its findings.
3. A `Stop` hook aggregates the three JSON outputs into a single markdown
   report.
4. A `SessionStart` background worker pre-flags suspicious recent
   commits whenever you open a session in the project.
 
Three slash commands:
 
- `/review` — full review of the current working tree
- `/review-strict` — same, with low-severity findings escalated
- `/review-explain <file>:<line> <category>` — deep explanation of one finding
 
## Install
 
```bash
# 1. Add the marketplace (any git repo works)
/plugin marketplace add https://github.com/your-handle/harness-codereview
 
# 2. Install
/plugin install harness-codereview@harness-codereview
 
# 3. Build the bundled MCP server (one time)
cd ~/.claude/plugins/harness-codereview/mcp-server
npm install
npm run build

Configure

The plugin ships with settings.example.json. Copy its hook and MCP sections into your project's .claude/settings.json (or your global ~/.claude/settings.json). Tools the plugin needs:

• eslint (npm install -g eslint) for JS/TS lint
• ruff (pip install ruff) for Python lint
• semgrep (pip install semgrep) for security scanning
• A working test command (npm test, pytest, etc.)

Missing tools degrade gracefully — the plugin still works, it just returns empty findings for the missing tool.

Safety model

• style-reviewer is denied Bash entirely (lint via MCP only).
• correctness-reviewer may only run test commands.
• security-reviewer is read-only (semgrep via MCP only).
• All sub-agents are denied Edit, Write, and WebFetch.
• Outputs are sanitized: prompt-injection markers and common secret patterns are redacted before findings are aggregated.
• Every tool call is logged to .claude/codereview-audit.log.

It is safe to run on projects you trust. For projects you don't trust (e.g. a stranger's repo), run Claude Code in a sandbox.

Debugging

Uninstall

/plugin uninstall harness-codereview
rm -rf .claude/codereview-* .claude/audit-*

License

MIT — see LICENSE.

 
## Bump the Version
 
Edit `.claude-plugin/plugin.json` to set the first real release:
 
```json
{
  "name": "harness-codereview",
  "version": "0.1.0",
  ...
}

Tag the release:

git add -A
git commit -m "v0.1.0 — first packaged release"
git tag v0.1.0

Push to a Marketplace

A marketplace is just a git repo. Push your plugin to GitHub (or any git host):

git remote add origin git@github.com:your-handle/harness-codereview.git
git push -u origin main
git push origin v0.1.0

Now anyone can install:

/plugin marketplace add https://github.com/your-handle/harness-codereview
/plugin install harness-codereview@harness-codereview

Walk Through a Fresh Install

The fastest sanity check is to install the plugin into a clean Claude Code setup as if you were a new user:

# In a clean test project
cd /tmp
mkdir test-install && cd test-install
git init
echo "console.log('hello');" > index.js
git add . && git commit -m "init"
 
claude
> /plugin marketplace add https://github.com/your-handle/harness-codereview
> /plugin install harness-codereview@harness-codereview

Once installed, try /review. The three sub-agents should fire, the report should land. If something doesn't work — especially anything that worked in your dev directory but not in a fresh install — that's a bug in the packaging. Common causes:

• Hardcoded paths in scripts.
• Missing chmod +x on hook scripts.
• The MCP server's npm install not run after install.
• Permissions config not copied into the user's settings.json.

A good plugin handles all of these in install instructions or in the plugin manifest's hooks.

What You Built

A working Claude Code plugin that:

• Defines three sub-agents (style, correctness, security) — Module 02 / 03.
• Coordinates them via four hooks — Module 02 / 03 / 06.
• Exposes static-analysis tools as a portable MCP server — Module 02.
• Surfaces three slash commands — Module 02.
• Runs a background audit worker on session start — Module 07.
• Defends against destructive commands and prompt injection — Module 06.
• Ships as a redistributable plugin via any git host — Module 02 / 08.

It's a small but real example of every harness-extension primitive the course covered. From here, the natural extensions are: more reviewer types (performance, accessibility, dependencies); a more sophisticated audit worker that uses the Claude Agent SDK; cross-machine federation if you have multiple developers wanting to share review history; methodology-as-plugin packaging (your harness-sparcreview if you wanted SPARC-shaped reviews).

You've used:

• Sub-agents as primitives
• Hooks and lifecycle events
• Slash commands
• MCP as universal tool bus
• Permission and tool scoping
• Plugin and marketplace systems
• Background worker pattern
• Prompt injection defense
• Settings and configuration files

That's most of Modules 02, 03, 06, and 07 of the course, applied in a single artifact.

Commit

cd ~/dev/harness-codereview
git add LICENSE README.md
git commit -m "v0.1.0 — final packaging, README, LICENSE"
git tag -f v0.1.0
git push --tags --force

What This Step Did

Exercised:

• plugin-and-marketplace-systems.md — git repo as marketplace.
• choosing-your-harness-stack.md — final decision: this plugin extends Claude Code; you've committed to that stack and shipped accordingly.

The plugin is now redistributable. You're done.

End of blueprint. Want to take this further? The course's Agent Harnesses & Orchestration module on background workers and methodology plugins covers what comes next.