Documentation

What this is

senclaw hub is a registry for things Claude Code agents install: skills, plugins, workflows and apps.

Every package has an immutable version, a checksum, and a declaration of what it expects to touch. That is the difference between installing from a registry and cloning a repository.

Installing

Plugins

The hub is a Claude Code marketplace, so plugins install with a command Claude Code already has:

/plugin marketplace add https://senclaw-web.nguyendinhbac35.workers.dev/marketplace.json
/plugin install <name>@senclaw

On that route Claude Code fetches the plugin from its source repository. It is convenient, and it does not pass through the hub's checksum and signature verification. For that, use the CLI.

Skills, workflows and apps

senclaw skill install <scope>/<name>
senclaw workflow install <scope>/<name>
senclaw app install <scope>/<name>

The CLI verifies the SHA-512 and the hub's signature before anything is written to disk, and refuses the install if either fails.

Publishing

Publishing requires a GitHub account. Sign in, choose a username, then:

senclaw login
senclaw skill publish ./my-skill

A published name@version is permanent. It can be deprecated or yanked, but never replaced with different bytes — otherwise pinning a version would mean nothing.

Versions must be valid semver. Upstream plugin manifests treat version as optional and fall back to a commit SHA; the hub does not, because without an ordered immutable version you cannot pin, yank, diff or attest.

Security

The registry is built around a specific failure: a marketplace where publishing was pure trust, nothing declared what a package would touch, and a malicious package reached thousands of agents within minutes.

What the hub does:

• Immutable versions. A version number, once published, always means the same bytes.
• Checksums. Every artifact carries a SHA-512, verified server-side by

streaming the stored object — not taken on trust from the publisher.

• Signatures. The registry signs each artifact; the CLI verifies against a

pinned public key before writing to disk.

• Declared permissions. Packages state the network hosts, paths, commands and

environment variables they expect. On upgrade the CLI shows a diff and asks before anything widens.

• No install scripts. Nothing executes at install time. There is no flag to

turn this off, because there is nothing to turn off.

• Account age gating and trust tiers, captured at signup rather than at

publish — an attacker controls when they publish, not when they signed up.

What it does not do: promise a package is safe. Automated checks find known patterns, not intent. A listing is not an endorsement, and the verified checkmark means the hub confirmed a publisher's identity — nothing about their code.

API

GET /api/v1/packages/{scope}/{name}     package document
GET /api/v1/search?q=&kind=             search
GET /marketplace.json                   Claude Code marketplace
GET /api/v1/ping                        health

Send Accept: application/vnd.senclaw.install-v1+json for the abbreviated document: versions, checksums and dist-tags without READMEs or manifest bodies. Responses vary on Accept.