Anthropic Turns Claude Into an AI Marketplace With 2,000+ Plugins and Connectors

Anthropic Consolidates Claude's Ecosystem Into a Single Marketplace

Anthropic has turned Claude into a full-blown software storefront. On September 23, 2026, the company launched the Claude Marketplace, a unified hub that brings together more than 2,000 plugins and connectors, Claude-powered products from partner companies, and consulting services from systems integrators — all in one place for enterprise buyers to browse, install, and in some cases purchase directly. Two days later, on September 25, 2026, Anthropic followed up with a formal developer submission portal, giving builders a trackable path to get their own tools listed.

The marketplace isn't entirely new. Anthropic quietly piloted it on March 6, 2026 with just six partners, including GitLab and Snowflake. The September relaunch is a dramatic scale-up of that original catalog, and it arrives as Anthropic reports that MCP (Model Context Protocol) usage across Claude products has grown 110x so far this year.

At a Glance

What's Actually in the Marketplace

Add: Connectors and Plugins

The largest section of the marketplace is "Add" — the catalog of 2,000+ connectors and plugins that link Claude directly to workplace apps and data sources. Popular listings include Google Drive, Gmail, Microsoft 365, Notion, and Slack, alongside offerings from Atlassian and Salesforce. These are built using MCP and Agent Skills, the two open standards Anthropic has been pushing as the connective layer between Claude and the outside world.

Buy: Claude-Powered Products

The "Buy" section is where the marketplace starts to look less like a plugin directory and more like an actual storefront. Companies such as CrowdStrike, Cursor, Harvey, Legora, Lovable, and Snowflake offer full Claude-powered products that customers can purchase — and notably, qualifying customers can apply a portion of their existing Anthropic spend commitment toward these partner purchases. Anthropic cites CodeRabbit applying part of its commitment toward Vercel, and both Power Digital and ThoughtSpot applying theirs toward Snowflake, as examples. Anthropic has not disclosed what share of a commitment is eligible.

Scale: Consulting and Systems Integration

The "Scale" section connects organizations with consulting and systems-integration partners — Accenture, Boston Consulting Group, and Deloitte among them — for companies that want help deploying Claude across their operations. Firms join the Claude Partner Network to appear in this part of the marketplace.

The New Developer Submission Portal

Two days after the marketplace's public debut, Anthropic opened a dedicated submission portal for builders on Pro, Max, Team, and Enterprise plans. It offers two distinct submission paths: a single remote MCP connector for developers exposing one specific tool or data source, or a full plugin bundle hosted on GitHub for more comprehensive integrations that package multiple components together. Anthropic also says Claude now supports MCP 2.0, which adds MCP Apps for interactive in-chat UI and Enterprise Managed Auth for centralized credential control.

Why Now

The move is widely read as Anthropic borrowing the app-store playbook — a discovery layer plus a distribution channel, similar in spirit to the Play Store. Anthropic is reportedly trying to avoid the stumble OpenAI had with its own apps marketplace, which struggled to gain traction, by keeping submissions open to essentially anyone rather than gating the catalog to a handful of marquee partners. The timing also lines up with Microsoft rolling out its own Agent Store inside Microsoft 365 Copilot, making late 2026 a genuine distribution race between the major AI platforms.

Security Considerations: What IT and Security Teams Should Evaluate

For a publication that covers supply-chain risk, the marketplace's most important story isn't the partner logos — it's what happens when an organization's employees start freely installing hundreds of third-party connectors that pipe data in and out of an LLM.

MCP Is a Supply-Chain Attack Surface, Not Just an Integration Layer

Security researchers tracking the broader MCP ecosystem describe it as a supply-chain problem first and a prompt-injection problem second. That's because an MCP server's tool descriptions are fed directly into the model's context — meaning a malicious or compromised connector can embed instructions Claude may act on without the user ever seeing them. Underlying MCP servers also ship as ordinary npm or PyPI packages, so they inherit every familiar open-source risk: vulnerable transitive dependencies, unmaintained code, and typosquatted look-alike package names.

The Broader Ecosystem Already Has a Track Record

It's worth distinguishing Anthropic's own reviewed marketplace listings from the wider, decentralized MCP and "skills" ecosystem that has grown up around Claude — but the latter shows what happens without a vetting gate. Antiy CERT has confirmed 1,184 malicious skills across the third-party marketplace ClawHub. Separately, Trend Micro found 492 MCP servers exposed to the internet with zero authentication. A Snyk audit published in February 2026, dubbed ToxicSkills, reviewed 3,984 skills hosted on ClawHub and found 13.4% (534) contained a critical security issue. None of those incidents occurred inside Anthropic's own marketplace — but they illustrate the risk profile of the same underlying protocol, and enterprises evaluating vetted and unvetted connectors alike need to apply the same scrutiny.

Vetting Helps, But It Isn't a Silver Bullet

Anthropic applying listing review to its own marketplace connectors is a meaningful step — it shifts trust verification from a bespoke, per-vendor negotiation into a standing, continuously reviewed gate, which is the only model that scales at the rate enterprises are adopting Claude. Security practitioners caution against treating that as blanket reassurance, though: approving an MCP server effectively approves every operator in its supply chain, and there's typically no per-component re-prompt if a connector's backend changes after approval. A badge like "Anthropic-listed" or "scanned" on one surface shouldn't be assumed to carry over to a different plugin, a different version, or a different distribution channel.

Impact Assessment

Recommendations

For IT and Security Teams

1. Inventory before you enable. Treat the marketplace like any new SaaS integration point — maintain a list of which connectors and plugins are actually approved for use, not just installed.
2. Check maintainer activity and access scope before approving any connector, vetted or not: how active is the publisher, does it require OAuth or nothing at all, and how much data access does it request.
3. Prefer read-only connector configurations where the option exists. A connector that can send messages or write data as the user becomes an exfiltration path if Claude is manipulated via prompt injection.
4. Pin plugin and connector versions where the marketplace allows it, and treat updates to production connectors with the same change-management rigor as application code — a vetted server today doesn't guarantee the same code tomorrow.
5. Use enterprise allowlisting. Deploy a managed allowlist of approved MCP servers/connectors via MDM or equivalent controls so individual users cannot add unapproved ones.
6. Isolate credentials per connector. Avoid shared API keys or token passthrough between MCP servers — a compromise in one should not reach every system a broader credential touches.

For Developers Submitting to the Marketplace

• Prefer the GitHub-hosted plugin bundle path for anything beyond a single tool, since it keeps tool definitions version-controlled and auditable.
• Document exactly what data your connector accesses and why, ahead of any customer security review.
• Scope OAuth requests to the minimum required — broad, unscoped grants are the fastest way to fail an enterprise vetting process.

For End Users

• Don't install connectors or skills from outside your organization's sanctioned catalog, even if they appear on Anthropic's marketplace.
• Review the permissions a plugin requests before granting access to email, documents, or messaging tools.
• Report unexpected data requests or unusual Claude behavior after installing a new connector to your security team promptly.

Key Takeaways

1. Anthropic launched the Claude Marketplace on September 23, 2026, consolidating 2,000+ plugins and connectors, partner products, and consulting services into three sections: Add, Buy, and Scale.
2. A developer submission portal opened September 25, 2026, letting Pro, Max, Team, and Enterprise builders submit either a single MCP connector or a full GitHub-hosted plugin bundle.
3. The marketplace lets qualifying customers apply committed Anthropic spend toward partner purchases — a purchasing mechanic, not just a directory.
4. MCP usage across Claude products is up 110x this year, and Claude now supports MCP 2.0 with in-chat UI apps and Enterprise Managed Auth.
5. The broader MCP/skills ecosystem has a documented history of malicious and vulnerable third-party listings (ClawHub, exposed unauthenticated servers), underscoring why marketplace vetting — while valuable — shouldn't replace an organization's own connector review process.
6. IT and security teams should treat every new connector as a supply-chain decision: scope permissions, pin versions, allowlist approved tools, and isolate credentials.

Sources

• Anthropic turns Claude into an AI marketplace with 2,000+ plugins and connectors — BleepingComputer
• Claude Marketplace: plugins and connectors, products and agents, and service partners — Anthropic
• Anthropic Opens Claude Plugin Portal With 110x MCP Growth This Year — AlphaSignal

Related Reading

• Anthropic MCP Design Vulnerability Enables RCE, Threatening the AI Supply Chain
• Trojanized MCP Server Deploys StealC Infostealer in First Major MCP Supply Chain Attack
• Shadow AI Is Everywhere — Here's How to Find and Secure It