Plugins and marketplace

Your agent, on your actual computer.

Codewhale plugins add reviewed capabilities to the agent you already run — from the first-party Codewhale catalog, a GitHub repository, or a tarball. Nothing executes until you read the manifest and trust it yourself.

Browse the Codewhale catalog Plugin authoring guide

First-party plugin · macOS beta

Computer Use: eyes and hands for the agent.

The agent stops being blind to your desktop. It observes the apps you choose, reads their controls through the accessibility tree, types and clicks where you point it — then reports every action with a receipt. macOS is the qualified beta platform; Windows, Linux and HarmonyOS backends remain experimental and source-only.

/plugin marketplace install codewhale computer-use

36 MCP tools: observation, actions, screenshots and zoom, keyboard and pointer, clipboard, recording, browser control over CDP, window frames, the installed-app catalog, sessions and computer switching.

Works in the background: On macOS the agent can drive a selected app without touching your pointer or stealing focus — process-directed input while you keep using the machine. Foreground control is a separate, explicit grant.
Reads the UI, not just pixels: The accessibility tree (macOS AX, Windows UIA, Linux AT-SPI) returns controls, values, and advertised actions — a text-only model can drive a whole app without a single screenshot.
Sees when it has to: Screenshots and zoom feed compatible vision models; on macOS, local OCR reads window text on-device — no remote service, no vision model required.
One agent, many computers: Control the local machine, registered SSH hosts (the remote agent installs itself), or HarmonyOS devices over hdc. Every receipt names the computer it happened on.
Permissions stay yours: Accessibility and Screen Recording grants live in System Settings under your control. The agent asks once what it is missing — it never pops dialogs.
Fails closed, with receipts: Stale observations, unexpected foreground changes, and unavailable capabilities refuse with a receipt instead of guessing. Each task owns its session; stopping releases every held input.
Drives a browser, in its own profile: A Chromium-family browser is driven over the DevTools protocol in a self-owned profile — clicked by CSS selector or page pixel, screenshotted from the page itself. Your own profile, tabs and logins are never attached to.
Watch it, bound it, replay it: A live preview shows the bound app while a session works, and list_sessions names every live session on the machine. The stop switch halts input, kill_app quits a named app by exact identity, trajectories record every call — refusals included — for faithful replay, and a launch-time capability grant fixes what a session may ever call.

First-party catalog

The Codewhale marketplace.

An offline snapshot of the Codewhale catalog ships with the terminal and the app, so browsing never fetches or executes anything. Install from it with one command.

/plugin marketplace list

WhaleWikiRepository and concept documentation the agent can consult while it works./plugin marketplace install codewhale whalewiki Cloudflare DocsCloudflare documentation lookup inside a session./plugin marketplace install codewhale cloudflare-docs Skill bundleThe bundled Codewhale skills the terminal ships with, kept in sync with the catalog.#path=skills

Catalog source: github.com/Hmbown/codewhale-plugin-marketplace. A local catalog named codewhale takes precedence over the bundled snapshot.

Install sources

Any GitHub repository can be a plugin.

Point /plugin install at a directory, a repository, or a tarball. The fetched tree must hold exactly one bundle root — a plugin.json, a compatible kimi.plugin.json or .claude-plugin/plugin.json, or a legacy plugin.toml.

GitHub repositoryArchive of the repository’s default branch — the marketplace catalog uses the same mechanism./plugin install github:owner/repo

Local directoryCopied from disk. The fastest loop while authoring your own bundle./plugin install ./path/to/bundle

Tarball URLDirect archive download, gated by the per-domain network policy — an unknown host is refused until you allow it./plugin install https://example.com/x.tar.gz

Trust lifecycle

Installed is not enabled.

Every bundle lands disabled and untrusted. Review the manifest and declared capabilities, then trust and enable it. An update with changed bytes requires review again.

Review/plugin show <name> prints the manifest, declared capabilities, and install receipt — including the source and bundle selector.

Trust/plugin trust <name> marks your decision. Official catalog provenance grants no execution or network permission on its own.

Enable/plugin enable <name> activates the bundle. Plugin-contributed MCP servers run under namespaced <plugin>-<server> identities with the stricter boundary.

Downloads are tarball-only with a size cap and no symlinks; traversal, ambiguous roots, and changed plugin identities are rejected. /plugin suggest ranks installed and catalog bundles against a task without installing anything.

Command reference

Plugin authoring guide

The full lifecycle lives in the terminal. The documented commands:

/plugin marketplace list
/plugin marketplace show codewhale
/plugin marketplace install codewhale <name>
/plugin install github:owner/repo
/plugin show <name>
/plugin trust <name>
/plugin enable <name>
/plugin update <name>
/plugin suggest <task>