Skip to main content
Step Code distributes extensions, Skills, themes, agents, and MCP servers through resource packages and plugin marketplaces.

​
Two distribution formats

​
Install a plugin

  1. Run /plugin to browse the configured marketplaces.
  2. Install a selected plugin with /plugin install <plugin-name>.
  3. For a plugin with MCP servers, restart Step Code, check /mcp, and verify the capabilities you need.

​
Packages: installation and management

Packages use a separate command family. In the following syntax, the source is a local directory, npm package, or Git repository:
  • Installs default to user scope and write global configuration.
  • -l writes project .stepcode/config.toml; trusted projects automatically install missing packages on startup.
  • step -e <source> loads an extension temporarily without persisting configuration, but still executes its code.

​
Filtering and enabling packages

Limit loaded resources in config.toml:
Use glob patterns, ! exclusions, and exact +path / -path controls. step config provides interactive management; Tab switches global and project scope. Project entries override same-name global packages. Project resources remain subject to trust settings. The built-in marketplace also includes the playwright browser-control plugin.

​
Create a local resource package

Create my-step-package with these two files. my-step-package/package.json:
my-step-package/skills/project-summary/SKILL.md:
Install from the parent directory of my-step-package:
In a project containing README.md, run step @README.md, then enter /skill:project-summary in the interactive input box, and compare the summary with the file. Keep the source directory in place: local packages are loaded by path.

​
Package sources and manifests

Declare extensions, skills, prompts, and themes resource paths under package.json.pi, with glob and ! exclusion support. Without a manifest, same-named conventional directories are used. Paths are relative to the package root. User packages typically live in ~/.stepcode/agent/npm/ and git/; project packages in .stepcode/npm/ or .stepcode/git/. Do not keep your only uncommitted changes in managed clones; updates may realign pinned refs. See Agent Skills for the Skill format.

​
Plugin manifest format

The native manifest is step.plugin.json, with compatibility for .claude-plugin/plugin.json and marketplace manifests in marketplace.json. Fields include id, name, description, version, entry, skills, agents, commands, mcpServers, and provision. id is required; the manifest file size limit is 512 KiB. entry records an executable entry point but is not loaded.

​
Dependencies and bundling

Put runtime dependencies in dependencies; installation uses npm install --omit=dev. Put runtime-provided core packages in peerDependencies: "*" rather than bundling them again. For dependencies on other Step packages, declare both dependencies and bundledDependencies, and reference resources through node_modules/ paths.

​
Plugin marketplaces

Restart Step Code after installing or removing MCP plugins to start or stop their servers. Check results with /mcp. See MCP for MCP server configuration fields. See Agents and subagents for the custom agent format.

​
Security notes

Extensions, packages, and stdio MCP servers can execute code with the current user’s system permissions. Skill and agent instructions can also lead to command execution. Package and Git dependency installation may run package-manager operations. Review sources, versions, and install scripts. Install only trusted sources and provide the minimum necessary credentials. Step Code has no file-based Hooks. Use extension events such as tool_call, tool_result, and input for equivalent automation and interception. For shared approval and data-access rules, see Permissions and safety.