Point Claude Code Setup at a repository and it does something quietly opinionated: it reads your dependency graph and maps specific signals to specific automations. React shows up, so does Playwright MCP; Stripe or auth code shows up, so does a security reviewer.
How the recommender links React to Playwright MCP and Stripe to a reviewer subagent
Claude Code Setup is a first-party Anthropic plugin that scans a codebase and recommends tailored Claude Code automations without touching a single file. The pairing is deterministic, not vibes: when React or Next.js appears in package.json, Playwright MCP surfaces as the top frontend-testing integration, and when Stripe, authentication libraries, or payments code is present, a security-reviewer subagent is recommended — both are hardcoded entries in the bundled skill's internal decision tables (source: claude.com/plugins).
Quick Answer: Claude Code Setup is a read-only Anthropic plugin (version 1.0.0) that scans your repo and maps stack signals to automations — React/Next → Playwright MCP, Stripe/auth → security-reviewer subagent — returning the top 1–2 picks across five categories without modifying any file.
The engine is a bundled skill named claude-automation-recommender. It identifies your stack by reading every major manifest format — package.json, pyproject.toml, Cargo.toml, go.mod, and pom.xml — plus directory layout (src, components, pages, api, tests) and any existing .claude/ config or CLAUDE.md (source: anthropics/claude-plugins-official). The same signal logic drives other dependency pairs:
| Detected signal | Recommended automation | Category |
|---|---|---|
React / Next.js in package.json | Playwright MCP | MCP Servers |
| Stripe / auth / payments code | security-reviewer subagent | Subagents |
| Prisma | database MCP | MCP Servers |
| Sentry | Sentry MCP | MCP Servers |
| GitHub Actions | GitHub MCP | MCP Servers |
Mappings per the plugin's official listing (source: claude.com/plugins).
Output is deliberately narrow: the top 1–2 highest-value picks across five categories — MCP Servers, Skills, Hooks, Subagents, and Slash Commands. Want more options in one category? Ask for an expanded list of 3–5. Crucially, the skill is strictly read-only: its frontmatter grants only Read, Glob, Grep, and Bash, so it analyzes but never writes, edits, or creates a file — you implement (or reject) each recommendation yourself.
The routing itself is simple to reason about. The illustrative Python model below — executed successfully, though it is a simplified stand-in for the skill's internal logic, not the plugin's source — shows the two headline mappings resolving from a file list and a request string:
def detect_stack(files):
return "react" if any(f.endswith(("package.json", ".jsx", ".tsx")) for f in files) else "unknown"
def route_task(files, request):
plan = []
if detect_stack(files) == "react":
plan.append("React detected -> use Playwright MCP for browser validation")
if any(word in request.lower() for word in ("payment", "payments", "stripe", "checkout")):
plan.append("Payments detected -> delegate review to security subagent")
return plan
if __name__ == "__main__":
for step in route_task(["package.json", "src/App.tsx"], "add Stripe checkout payments"):
print(step)From zero to a recommendation list with claude-code-setup
Getting that routing logic as a recommendation takes one command, but it assumes a paid Claude tier first. Claude Code has no free option — you authenticate through Anthropic Console billing, a Claude Pro or Max plan, or an enterprise platform such as Bedrock or Vertex AI . With that in place, the rest is fast.
The official claude-plugins-official marketplace auto-loads when Claude Code starts . If it is absent — a blocked network, for example — add it manually, then refresh if the catalog is stale:
/plugin marketplace add anthropics/claude-plugins-official/plugin marketplace update claude-plugins-official(only if the catalog looks stale)/plugin install claude-code-setup@claude-plugins-official— the single install command/reload-plugins— activates it mid-session without a restart
Because claude-code-setup ships as an auto-loading skill rather than a slash command, you trigger it with plain language: "recommend automations for this project," "what hooks should I use?", or "help me set up Claude Code" all activate it . Claude then reads your manifests and returns the top one or two picks per category. Want more options in a category? Ask "show me 3–5 subagent options" to expand the list .
Nothing auto-applies. As the bundled skill states, "This skill is read-only — it analyzes but doesn't modify files" . You implement each chosen item yourself or ask Claude to build it, staying in control of what actually lands in .claude/.
Four things to consider before you adopt any recommendation
The recommender is read-only, but the items it suggests are executable machinery — review each before wiring it in. Four properties deserve attention.
- Hooks alter live Claude behavior the moment they're wired in. Hooks fire on events like PreToolUse and PostToolUse, and an exit code of 2 blocks the triggering action. A blocker on
.envedits or lock-file writes takes effect immediately and silently, so a stalled edit may be the hook working as designed rather than a bug . - MCP configuration carries credential scope. Setup lands in project-scoped
.mcp.jsonor user-scoped~/.claude.json; secrets expand from environment variables, and Claude Code prompts for approval before using project-scoped servers. Check what credential scope each server requests . - Subagents carry their own grants. Each ships with tool, model, and permission choices. code-reviewer activates automatically for repos over 500 files, and security-reviewer triggers on auth or payments signals — confirm each declared permission set before enabling .
Above all, treat every recommended server as code you are approving to run. Anthropic is explicit on this point:
"Plugins run with your user privileges and can execute arbitrary code," and Anthropic states it cannot independently verify third-party MCP servers or files bundled in external plugins (source: Claude Code docs).
Broadening from the recommendation list: MCP depth, LSP plugins, and companion choices
The default recommender surfaces only the top one or two automations per category, so ask for an expanded list of 3–5 to see the full MCP roster . Beyond Context7 (docs lookup) and Playwright, that includes Supabase, GitHub, Linear, AWS, Slack, Memory, Sentry, and Docker — each mapped to a detected dependency or directory signal rather than offered blindly .
The recommendations pair naturally with complementary first-party plugins — github, gitlab, vercel, supabase, linear, sentry, figma, notion, slack, plus dev-workflow plugins like commit-commands and pr-review-toolkit. For in-context language diagnostics, add the LSP plugins pyright-lsp, typescript-lsp, and rust-analyzer-lsp .
As of mid-July 2026 the marketplace listed roughly 256 entries (about 36 first-party plus ~220 external), and the catalog crossed 20,000 GitHub stars within days of its May 22, 2026 launch . Browse the rest yourself via /plugin → Discover or at claude.com/plugins. The takeaway: let the recommender narrow the field to what your stack actually needs, then expand deliberately — one reviewed plugin at a time.
Frequently asked questions
Does claude-code-setup modify any files in my repository?
No. The plugin is explicitly read-only — the catalog and README both state it "analyzes but doesn't modify files" . The bundled skill (claude-automation-recommender) is granted only Read, Glob, Grep, and Bash tools, which it uses to inspect manifests and directory structure before printing a recommendation list . Nothing is written, created, or edited. You accept, reject, or request alternatives, and every implementation is your explicit action or a separate request to Claude.
Why does a React project trigger a Playwright MCP recommendation?
Because the skill carries internal decision tables that map detected dependency signals to the highest-value automation in each category. React and Next.js signals map to Playwright MCP as the frontend browser-testing integration; the same logic maps authentication or payments code — such as Stripe — to a security-reviewer subagent . Detection comes from reading package.json, language files, and directory structure, then matching against signals including React, Vue, FastAPI, Django, Prisma, Supabase, and Stripe.
Is claude-code-setup free to use?
The plugin itself lists no separate price in the official catalog . But there is no free-tier path to running it: Claude Code requires authentication through a paid Claude Pro or Max plan, Anthropic Console billing, or an enterprise platform such as Amazon Bedrock or Google Vertex AI. So "free plugin" is accurate for the plugin, not for the environment it runs in.
How is this different from manually browsing the Claude Code marketplace?
Scope. By mid-July 2026 the claude-plugins-official marketplace listed roughly 256 undifferentiated entries — about 36 first-party plus ~220 external . Browsing means scanning all of them yourself. The recommender instead narrows to the top 1–2 automations per category, filtered for your detected stack — React, FastAPI, Prisma, Stripe, and so on — so you evaluate a short, relevant shortlist rather than the full catalog. You can ask for an expanded 3–5 list per category when you want more choices.
Can I automatically trust an MCP server the plugin recommends?
No. Anthropic states it cannot verify third-party MCP servers or files bundled in external plugins, and that plugins run with your user privileges and can execute arbitrary code . A recommendation is a suggestion, not an endorsement. Review each server before enabling it — especially any that handle credentials via .mcp.json or ~/.claude.json, expand environment-variable secrets, or reach external networks — and rely on Claude Code's approval prompts for project-scoped servers.
Enjoyed this article? Subscribe to get new stories by email whenever they're published.
