Skip to main content
Step Code distributes extensions, Skills, themes, agents, and MCP servers through resource packages and plugin marketplaces.

​
Two distribution formats

Their installation entry points and lifecycles differ. step install and /plugin install are not the same command.

​
Packages: installation and management

These names and addresses illustrate source formats; replace them with trusted resources:
  • Installs default to user scope and write global configuration.
  • -l writes project .stepcode/config.toml; trusted projects automatically install missing packages on startup.
  • step -e <source> loads an extension temporarily without persisting configuration, but still executes its code.
  • step update --all updates Step and all packages; step update --extensions updates only packages and pinned Git refs.

​
Package sources and manifests

Declare extensions, skills, prompts, and themes resource paths in package.json, with glob and ! exclusion support. Without a manifest, same-named conventional directories are used. Paths are relative to the package root. User packages typically live in ~/.stepcode/agent/npm/ and git/; project packages in .stepcode/npm/ or .stepcode/git/. Do not keep your only uncommitted changes in managed clones; updates may realign pinned refs.

​
Dependencies and bundling

Put runtime dependencies in dependencies; installation uses npm install --omit=dev. Put runtime-provided core packages in peerDependencies: "*" rather than bundling them again. For dependencies on other Step packages, declare both dependencies and bundledDependencies, and reference resources through node_modules/ paths. Package and Git dependency installation may run package-manager operations. Review sources, versions, and install scripts. Markdown or JSON entry points do not imply that no code can execute.

​
Filtering and enabling packages

Limit loaded resources in config.toml:
Use glob patterns, ! exclusions, and exact +path / -path controls. step config provides interactive management; Tab switches global and project scope. Project entries override same-name global packages. Project resources remain subject to trust settings.

​
Plugin marketplaces

The native manifest is step.plugin.json, with compatibility for .claude-plugin/plugin.json and marketplace manifests in marketplace.json. Fields include id, name, description, version, entry, skills, agents, commands, mcpServers, and provision. id is required; the size limit is 512 KiB. entry records an executable entry point but is not loaded. Restart Step Code after installing or removing MCP plugins to start or stop their servers. Check results with /mcp.

​
StepPage: publishing static websites

The built-in steppage marketplace plugin publishes directories or ZIP files, lists sites and versions, promotes or rolls back versions, and generates preview links. It needs STEPFUN_API_KEY or a signed-in Step account. Missing steppage-mcp is installed through the official installer; automatic installation is not available on Windows. See steppage. Manage sites at platform.stepfun.com/sites. The built-in marketplace also offers the playwright browser-control plugin, using npx @playwright/mcp@latest.

​
Security notes

Extensions, packages, and stdio MCP servers can execute code with the current user’s system permissions. Skill and agent instructions can also lead to command execution. Install only trusted sources and provide the minimum necessary credentials. Step Code has no file-based Hooks. Use extension events such as tool_call, tool_result, and input for equivalent automation and interception.

​
Next steps