Anthropic

Plugins reach Anthropic surfaces through the org’s GitHub-backed plugin marketplace. This page covers connecting that marketplace to a Claude org, distributing plugins to Claude Code and Claude Cowork, and wiring up the observability plugin’s telemetry so sessions are attributed to users.

The observability plugin and Claude’s OTEL exporter together are the prerequisite for most governance features on Anthropic surfaces: observability of AI usage across the company (tokens, cost, clients, MCP, skills), security flagging and blocking, shadow MCP detection, and more. Claude Code and Claude Cowork are configured separately.

In Claude and Cursor, a plugin marketplace is a shareable, configurable collection of plugins backed by a GitHub repo. The platform hosts a marketplace on the org’s behalf containing the observability plugin and any custom plugins. Once the marketplace is connected to the Claude org, each plugin can be enabled, disabled, or required from Claude admin settings.

Access requirements

Publishing the marketplace requires the project:write scope and creating the API key requires the org:admin scope, both held by the default Admin role. The Claude-side steps require admin access to the Claude organization. Only an Owner or Primary Owner of the Claude organization can see Claude Code managed settings.

Why OTEL is required

The platform uses Claude’s OTEL exporter to associate Claude sessions with users. Without it there is no way of knowing who performed which action, so most features will not work. The same telemetry powers cost and token metrics when that setting is enabled. A project-scoped data export can send the normalized OTLP signals to an external collector.

Create an API key

In the dashboard, open Organization settings > Settings > API Keys (see API keys) and create a new key with the Hooks scope. Copy the key. It replaces the <MY_KEY> placeholder below, producing a header string like "Speakeasy-AI-Project=default,Speakeasy-AI-Key=gram_live_abc...". The same key works for both Claude Code and Cowork.

Claude Code

Alternative paths

The device agent applies the same marketplace, plugin, and OTEL settings to Claude Code on its own and reapplies them every minute, so organizations running it can skip this section for Claude Code on developer machines. It writes the user-level settings file rather than the admin-owned managed settings, and the telemetry block only lands once Claude Code has cloned the marketplace on its next launch. These settings can also be distributed via MDM, which gives more control over the rollout at the cost of a more involved setup.

Claude Code on the web does not use this laptop path. Instrument those sessions with the device agent in a shared Anthropic-hosted environment; see Claude Code on the web.

Claude Cowork is not covered by either alternative, so the Claude Cowork steps below always apply.

In the Claude org settings, open the Claude Code tab (claude.ai/admin-settings/claude-code), scroll to Managed settings, and click Manage. Merge the following JSON into the dialog. Replace <marketplace-name>, <marketplace-git-url>, and <org> with the values shown in the Install instructions sheet on the dashboard’s MCP Gateway > Plugins page (open the Install menu on the Observability card and choose GitHub installation (preferred), then Claude Code). Replace <MY_KEY> with the key created above.

{
  "extraKnownMarketplaces": {
    "<marketplace-name>": {
      "source": {
        "source": "git",
        "url": "<marketplace-git-url>"
      },
      "autoUpdate": true
    }
  },
  "enabledPlugins": {
    "<org>-observability@<marketplace-name>": true
  },
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "FORCE_AUTOUPDATE_PLUGINS": "1",
    "OTEL_EXPORTER_OTLP_ENDPOINT": "https://ai.speakeasy.com/rpc/hooks.otel",
    "OTEL_EXPORTER_OTLP_HEADERS": "Speakeasy-AI-Project=default,Speakeasy-AI-Key=<MY_KEY>",
    "OTEL_EXPORTER_OTLP_PROTOCOL": "http/json",
    "OTEL_LOGS_EXPORTER": "otlp",
    "OTEL_METRICS_EXPORTER": "otlp"
  }
}

Use the exact marketplace name

The extraKnownMarketplaces key and the @ suffix in enabledPlugins must both be the marketplace name shown in the dashboard, not the GitHub repository name. On a mismatch, Claude Code skips auto-update or the plugin without an error.

The default marketplace name is <org>-speakeasy, or <org>-<project>-speakeasy outside the default project, unless it was changed with Publish now or Rename.

The autoUpdate setting keeps the observability plugin current, and FORCE_AUTOUPDATE_PLUGINS keeps it updating when DISABLE_AUTOUPDATER is set.

Trust prompt

Claude treats the OTEL exporter settings as sensitive. After this step, everyone in the Claude org is asked whether they trust the settings the next time they start Claude Code, and must mark them as trusted to continue (this just requires hitting Enter).

Install or update a role plugin

An organization administrator opens the role’s plugin under MCP Gateway > Plugins and selects Install > GitHub installation (preferred) > Claude Code. The generated settings register the project’s marketplace, enable that plugin, and turn on automatic updates. Marketplace installation settings are administrator-only.

For individual installations, the administrator selects Just me and sends the generated settings to the intended members through an approved private channel. Each member merges those settings into ~/.claude/settings.json, preserving existing settings, or creates the file with the supplied snippet. For an administrator-managed installation, the administrator selects My organization and applies the snippet through managed settings instead. Use the exact marketplace name in the snippet and keep its installation URL private because it can contain a credential.

Restart Claude Code, then open /plugin and check Installed for the role’s plugin. For an existing marketplace installation, confirm that the generated auto-update settings are still present and restart Claude Code after Speakeasy publishes a change. Check the plugin and its MCP servers in the new session. A session that is already running may still have the earlier configuration.

If a server requests sign-in, complete its authorization flow and any required upstream connection.

Confirm the plugin is installed

Restart Claude Code and confirm the plugin appears under /plugin → Installed (it may require scrolling).

Confirm telemetry is flowing

• Execute any tool call: use an MCP server, or ask Claude to run echo hi there.
• Open Tool Logs in the dashboard. The tool call should appear immediately (for a local tool call, set the Type filter to include local tools).

Claude Cowork

Add a user to the plugin marketplace

On the dashboard’s MCP Gateway > Plugins page, click Manage collaborators on the marketplace card, enter a GitHub username under GitHub Usernames, and click Add collaborators. (If the marketplace has never been published, Publish now asks for a marketplace name first and then opens the Publish Plugins dialog, which takes the same usernames.) Then follow the link to the plugin repo and accept the invitation to collaborate (check email or GitHub notifications if it doesn’t appear). Collaborators are added as repository admins, which is what Claude, Cursor, and other marketplaces require of the person connecting the repository. Only the user who will add the marketplace to the company Claude org needs this step.

Add the marketplace to Claude Cowork

In the Plugins tab of the Claude organization settings, click Add Plugins, then Sync from GitHub. If a message appears about enabling the GitHub connector for the Claude org, enable it and repeat this step. In the repo dropdown, select the org’s plugin repo, which is named <speakeasy-org>-<speakeasy-project>-plugins under the speakeasy-plugins GitHub org. The repository link on the marketplace card opens the same repo.

Update plugin availability

Scroll down to the newly added marketplace. It may say “Syncing plugins from repository…” for a short while. Once the plugins load, a plugin named after the org (for example, <org> observability) appears. It contains the agent hooks that power most control plane features, so mark it Required for a real rollout (Available to install works for a proof of concept). Set any other plugins, such as default MCPs, to Available to install so users can opt in.

Enable OTEL export

In the Cowork tab of the Claude org settings, scroll to Monitoring and set:

• OTLP endpoint: https://ai.speakeasy.com/rpc/hooks.otel
• OTLP protocol: http/json
• OTLP headers: Speakeasy-AI-Project=default,Speakeasy-AI-Key=<MY_KEY>

Save the settings.

Verify

Restart Claude Desktop, use a connector or MCP server from the Cowork tab, and confirm the call appears immediately in Tool Logs.

Manually enable a non-required plugin

Skip this step for plugins marked Required. In the Claude Desktop app’s Cowork tab, click Customize in the left nav, click the + icon next to Organization plugins, and in the modal click the + icon on the desired plugin’s card.