> ## Documentation Index
> Fetch the complete documentation index at: https://platform.stepfun.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Plugins and packages

Step Code distributes extensions, Skills, themes, agents, and MCP servers through resource packages and plugin marketplaces.

## Two distribution formats

| Format | Management | Content |
| - | - | - |
| Packages | `step install` and related commands | TypeScript extensions, Skills, prompt templates, themes |
| Plugin marketplace | `/plugin` | Declarative manifests, Skills, agents, commands, MCP |

## Install a plugin

1. Run `/plugin` to browse the configured marketplaces.
2. Install a selected plugin with `/plugin install <plugin-name>`.
3. For a plugin with MCP servers, restart Step Code, check `/mcp`, and verify the capabilities you need.

## Packages: installation and management

Packages use a separate command family. In the following syntax, the source is a local directory, npm package, or Git repository:

```text theme={"theme":{"light":"light-plus","dark":"dark-plus"}}
step install <package-source>
step list
step remove <package-source>
```

* Installs default to user scope and write global configuration.
* `-l` writes project `.stepcode/config.toml`; trusted projects automatically install missing packages on startup.
* `step -e <source>` loads an extension temporarily without persisting configuration, but still executes its code.

## Filtering and enabling packages

Limit loaded resources in `config.toml`:

```toml theme={"theme":{"light":"light-plus","dark":"dark-plus"}}
[[packages]]
source = "npm:@example/package"
extensions = ["extensions/*.ts", "!extensions/legacy.ts"]
```

Use glob patterns, `!` exclusions, and exact `+path` / `-path` controls. `step config` provides interactive management; Tab switches global and project scope.

Project entries override same-name global packages. Project resources remain subject to trust settings.

The built-in marketplace also includes the `playwright` browser-control plugin.

## Create a local resource package

Create `my-step-package` with these two files.

`my-step-package/package.json`:

```json theme={"theme":{"light":"light-plus","dark":"dark-plus"}}
{
  "name": "my-step-package",
  "version": "1.0.0",
  "private": true,
  "pi": { "skills": ["./skills"] }
}
```

`my-step-package/skills/project-summary/SKILL.md`:

```markdown theme={"theme":{"light":"light-plus","dark":"dark-plus"}}
---
name: project-summary
description: Summarize a supplied README when the user requests a project overview.
---

Read the supplied README and summarize its purpose and documented setup. Mark missing information as "not documented". Do not modify files.
```

Install from the parent directory of `my-step-package`:

```bash theme={"theme":{"light":"light-plus","dark":"dark-plus"}}
step install ./my-step-package
step list
```

In a project containing `README.md`, run `step @README.md`, then enter `/skill:project-summary` in the interactive input box, and compare the summary with the file. Keep the source directory in place: local packages are loaded by path.

## Package sources and manifests

| Source | Behavior |
| - | - |
| `npm:` | Install with the package manager; version-specific entries remain pinned |
| `git:` or repository URL | Clone the repository; configured tags or commits do not automatically move to new refs |
| Local file | Load as a single extension |
| Local directory | Discover content using package conventions |

Declare `extensions`, `skills`, `prompts`, and `themes` resource paths under `package.json.pi`, with glob and `!` exclusion support. Without a manifest, same-named conventional directories are used. Paths are relative to the package root.

User packages typically live in `~/.stepcode/agent/npm/` and `git/`; project packages in `.stepcode/npm/` or `.stepcode/git/`. Do not keep your only uncommitted changes in managed clones; updates may realign pinned refs.

See [Agent Skills](https://platform.stepfun.ai/docs/en/step-code/customization/skills.md) for the Skill format.

## Plugin manifest format

The native manifest is `step.plugin.json`, with compatibility for `.claude-plugin/plugin.json` and marketplace manifests in `marketplace.json`. Fields include `id`, `name`, `description`, `version`, `entry`, `skills`, `agents`, `commands`, `mcpServers`, and `provision`. `id` is required; the manifest file size limit is 512 KiB. `entry` records an executable entry point but is not loaded.

## Dependencies and bundling

Put runtime dependencies in `dependencies`; installation uses `npm install --omit=dev`. Put runtime-provided core packages in `peerDependencies: "*"` rather than bundling them again.

For dependencies on other Step packages, declare both `dependencies` and `bundledDependencies`, and reference resources through `node_modules/` paths.

## Plugin marketplaces

| Command | Action |
| - | - |
| `/plugin` | Open the management menu |
| `/plugin install <plugin>` | Install a plugin |
| `/plugin remove <plugin>` | Uninstall a plugin |
| `/plugin marketplace list` | List marketplace sources |
| `/plugin marketplace add` | Add a marketplace |
| `/plugin marketplace update` | Refresh marketplace indexes |
| `/plugin marketplace remove` | Remove a marketplace |

Restart Step Code after installing or removing MCP plugins to start or stop their servers. Check results with `/mcp`.

See [MCP](https://platform.stepfun.ai/docs/en/step-code/customization/mcp.md) for MCP server configuration fields.

See [Agents and subagents](https://platform.stepfun.ai/docs/en/step-code/customization/agents.md) for the custom agent format.

## Security notes

Extensions, packages, and stdio MCP servers can execute code with the current user's system permissions. Skill and agent instructions can also lead to command execution. Package and Git dependency installation may run package-manager operations. Review sources, versions, and install scripts. Install only trusted sources and provide the minimum necessary credentials.

Step Code has no file-based Hooks. Use extension events such as `tool_call`, `tool_result`, and `input` for equivalent automation and interception.
For shared approval and data-access rules, see [Permissions and safety](https://platform.stepfun.ai/docs/en/step-code/guides/permissions.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.