Waxell

Play · Security teams

Lock Claude Code to approved skills

One marketplaceon every managed machine,with sideloading off.

Waxell serves what you approved as a Claude Code plugin marketplace called waxell-approved. A managed-settings block registers it on every machine that receives it, makes it the only marketplace Claude Code accepts, and turns Required plugins on and revoked ones off wherever they were installed from.

Book a demo

30 minutes. No commitment.

SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF

  1. This play uses
  2. 03Enforce
  3. 05Prove
The situation

Who

A security team that has approved a set of plugins in Waxell and now needs Claude Code on a few hundred engineer laptops to use only that set.

What happened

An engineer installed a plugin from a public marketplace the day after the approved list went out, and the review queue never saw it.

What's at stake

An approved list that is advisory. Plugins arrive from any marketplace or a local folder, a revoke changes nothing on machines that already have it, and nobody can say which marketplace a laptop is fetching from.

The play
  1. 01Enforce

    Turn on the marketplace. Try it on your own Claude Code first.

    In Govern under Skills & Plugins, Settings, Approved marketplace, click Turn on and you get a private marketplace URL that serves only what you have approved. The Just you step gives you a /plugin marketplace add line to run in your own Claude Code; /plugin then lists your approved plugins, and nothing changes for anyone else. Anyone with the URL can read the approved list, so treat it like a shared link; Rotate URL replaces it immediately and the old one stops working. Claude Code 2.1.224 or later is required.

    /plugin marketplace add https://api.waxell.dev/api/waxell/v1/extensions/<your-token>/marketplace.json · /plugin · Rotate URL · Claude Code 2.1.224 or later

    claude code · just you
    $ /plugin marketplace add https://api.waxell.dev/api/waxell/v1/extensions/<your-token>/marketplace.json$ /plugin# lists only what your workspace approved.# Rotate URL replaces the link and the old one stops working.# Claude Code 2.1.224 or later.
  2. 02Enforce

    Apply the managed-settings block. It is a lockdown.

    The Claude Code step on the same page gives you a managed-settings block. Paste it into claude.ai Admin settings under Claude Code, Managed settings, or ship it as managed-settings.json through your device-management tool. extraKnownMarketplaces registers your approved marketplace on every managed machine and refreshes it automatically; strictKnownMarketplaces makes Claude Code accept only that marketplace; enabledPlugins turns on everything marked Required and off anything revoked, wherever it was installed from; disableSideloadFlags blocks loading a plugin any other way, including --plugin-dir. With the block applied, plugins from any other marketplace, including Anthropic's, stop working for everyone, so tell your team before you apply it.

    extraKnownMarketplaces · strictKnownMarketplaces · enabledPlugins · disableSideloadFlags · managed-settings.json

    managed-settings.json
    {  "extraKnownMarketplaces": {    "waxell-approved": {      "source": { "source": "url", "url": "<your marketplace url>" },      "autoUpdate": true    }  },  "strictKnownMarketplaces": [    { "source": "url", "url": "<your marketplace url>" }  ],  "enabledPlugins": {    "security-review@waxell-approved": true,    "old-deploy-helper@waxell-approved": false  },  "disableSideloadFlags": true}
  3. 03Prove

    New approvals arrive on their own. Revokes uninstall at the next session.

    Claude Code refreshes the marketplace in the background, so a new approval shows up and a revoked plugin is uninstalled at the next session without touching managed settings. Re-apply the block only when you change what is Required; the Settings page tells you when it has changed since you copied it. The top of the Approved marketplace panel shows when the marketplace was last fetched, how many times, how many plugins were downloaded, and which clients fetched it: Claude Code, Claude Desktop and claude.ai, scripts, or browsers. Every approve, reject and revoke carries its reason in your audit log.

    last fetched · fetch count · plugins downloaded · clients: Claude Code, Claude Desktop / claude.ai, scripts, browsers · re-apply only when Required changes

What the record shows
  1. /plugin install repo-janitorclaude code · a.patel-mbp · in waxell-approved · marked Requiredallow
  2. /plugin marketplace add community-pluginsclaude code · a.patel-mbp · strictKnownMarketplaces · only waxell-approved acceptedblock
  3. claude --plugin-dir ./my-pluginclaude code · j.lee-win · disableSideloadFlagsblock
  4. deploy-helper · still installedclaude code · r.ortiz-mbp · next session · revoked in Waxell · enabledPlugins off · uninstalledblock

Illustrative entries in the shape the product writes them.

Policies involved

Products in this play

Questions teams ask about this play

Four settings. extraKnownMarketplaces registers your marketplace everywhere, strictKnownMarketplaces makes it the only one Claude Code accepts, enabledPlugins turns Required plugins on and revoked ones off, and disableSideloadFlags blocks --plugin-dir and the like. Plugins from any other marketplace, including Anthropic's, stop working for everyone.

Related plays

Run this play this week.

Free for your first agents and devices, live in about thirty seconds. Or walk through it with someone who has run it before.

Book a demo

30 minutes. No commitment.

SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF