Claude Code Plugin Marketplace: Skills for CCDV-F

The claude code plugin marketplace is not a single storefront you browse like an app store. It is the growing ecosystem of Claude Code Skills, MCP servers, and third-party integrations that extend what Claude Code can do inside a developer's workflow. Understanding that ecosystem is directly relevant to the Claude Certified Developer, Foundations (CCDV-F) exam, which tests whether you can make sound judgements about integrations, tool selection, and agentic workflows in realistic scenarios.

This post maps the plugin and skills landscape to the eight CCDV-F domains, explains which integrations appear in exam-style scenarios, and gives you a study framework grounded in the official exam structure.

What exactly is the Claude Code plugin marketplace?

The phrase "plugin marketplace" is shorthand for two overlapping things. First, Claude Code Skills: pre-built, composable skill packages that teams install to give Claude Code domain-specific capabilities such as TDD cycles, security scanning, or infrastructure generation. Second, the broader Model Context Protocol (MCP) ecosystem, where any developer can publish an MCP server that Claude Code can call as a tool.

Neither is a curated app store with a single URL. Skills are distributed as configuration packages; MCP servers are distributed as code repositories or hosted endpoints. What unifies them is the MCP transport layer, which means the same tool-selection and error-handling logic applies to both.

For the CCDV-F exam, the distinction matters: Skills are higher-level workflow abstractions, while MCP servers are lower-level tool endpoints. The exam tests both layers.

How does the CCDV-F exam weight the relevant domains?

The CCDV-F has eight domains with exact percentage weights. Three of them cover the territory most directly touched by the plugin and skills ecosystem.

Domain 2 (Applications and Integration) carries 33.1% of the exam, making it the single heaviest domain. Domain 8 (Tools and MCPs) adds another 10.6%. Together they account for nearly 44% of your score, which is why understanding the plugin ecosystem is not optional preparation.

Which Claude Code Skills appear in exam scenarios?

The exam does not name specific commercial products in its task statements, but it does test the categories of capability that Skills packages deliver. Here is how the major skill categories map to exam domains.

Test-driven development and red-green-refactor cycles

TDD Skills give Claude Code the ability to write a failing test, implement the minimum code to pass it, then refactor. The exam tests this pattern under Domain 4 (Eval, Testing, and Debugging, 2.6%) and Domain 1 (Agents and Workflows, 14.7%). A typical scenario presents a partially implemented function and asks which agentic loop design correctly sequences test generation before implementation.

The key judgement the exam rewards: Claude should write the test first, confirm it fails, then produce implementation code. Reversing that order is a common distractor. This is also a case where fixed sequential pipelines outperform dynamic decomposition, because the red-green-refactor sequence is deterministic by design.

Security scanning with automated remediation

Security Skills such as Snyk Fix integration give Claude Code the ability to call a vulnerability scanner, receive structured findings, and propose or apply patches. This maps directly to Domain 7 (Security and Safety, 8.1%).

Exam scenarios in this category typically ask you to distinguish between three responses to a scanner finding:

1. Apply the patch automatically without human review (usually wrong for high-severity findings).
2. Surface the finding with a structured error payload and route to a human (usually correct for high-severity findings).
3. Suppress the finding because the dependency is indirect (usually wrong unless the scanner explicitly marks it as non-exploitable).

The exam consistently rewards deterministic, proportionate responses. For high-stakes security findings, programmatic enforcement beats prompt-based guidance. See High-Stakes Enforcement Decision Rule for the underlying principle.

GitHub PR review with the gh CLI

PR review Skills connect Claude Code to the GitHub CLI (gh) to fetch diff context, run checks, and post structured review comments. This sits in Domain 2 (Applications and Integration) and Domain 8 (Tools and MCPs).

# Typical gh CLI invocation a Skill might wrap
gh pr diff 42 --patch | claude -p "Review this diff for logic errors and security issues. Output JSON with fields: severity, file, line, comment."

The exam tests whether you understand the tool boundary: Claude Code reads the diff and produces structured output; the gh CLI posts it. Conflating those two responsibilities is a common distractor. The -p flag (non-interactive mode) is the correct pattern for CI integration.

Infrastructure as code generation

IaC Skills such as HashiCorp Agent Skills let Claude Code generate Terraform configurations from natural-language descriptions. This maps to Domain 2 and Domain 1.

A representative exam scenario: a team wants Claude Code to generate a Terraform module for a new VPC. Which approach is correct?

• Generate the full module and apply it immediately (wrong: no human review gate).
• Generate the module, run terraform plan, surface the plan output for human approval, then apply (correct: prerequisite gate before destructive action).
• Refuse to generate IaC because it is too risky (wrong: disproportionate).

The Prerequisite Gate Design pattern is the conceptual anchor here.

Web quality and performance skills

Web quality Skills run Lighthouse or similar audits and feed Core Web Vitals, accessibility scores, and SEO signals back into Claude Code's context. This is Domain 2 territory.

The exam tests whether you can design a feedback loop correctly. The right pattern is: run the audit, parse structured output, identify the highest-impact finding, generate a targeted fix, re-run the audit to confirm improvement. The wrong pattern is to generate fixes for all findings simultaneously, which creates attribution problems when scores change.

How do MCP servers extend the plugin ecosystem?

MCP servers are the lower-level primitive that Skills often wrap. Any developer can build an MCP server and expose it to Claude Code. The MCP scoping hierarchy determines which servers are available in which contexts: user-level, project-level, or organisation-level configuration.

{
  "mcpServers": {
    "snyk": {
      "command": "npx",
      "args": ["-y", "@snyk/mcp-server"],
      "env": {
        "SNYK_TOKEN": "${SNYK_TOKEN}"
      }
    }
  }
}

The environment variable expansion pattern (${SNYK_TOKEN}) is tested in Domain 8. The exam asks you to identify the correct configuration scope for a server that should be available to all developers on a project but not to personal Claude Code sessions. The answer is project-level configuration committed to the repository, not user-level configuration on individual machines.

For a deeper treatment of configuration scoping, see Environment Variable Expansion in MCP Config and the Three-Level Configuration Hierarchy.

What role does planning with files play in the SDLC workflow?

Persistent task planning, sometimes called Manus-style planning, uses a markdown file (often PLAN.md or a scratchpad) to maintain state across Claude Code sessions. This matters for the CCDV-F because Domain 1 (Agents and Workflows) tests multi-step SDLC scenarios from epic decomposition through quality gates.

The pattern works as follows:

1. Claude Code reads the current plan file to understand completed and pending tasks.
2. It executes the next task in the sequence.
3. It updates the plan file with the result before ending the session.
4. The next session resumes from the updated plan.

This is a form of summary injection for fresh sessions: the plan file serves as the structured context that prevents stale-context failures across long-running workflows.

The exam tests whether you can identify when this pattern is necessary (multi-day, multi-session tasks with dependencies) versus when it is over-engineering (single-session tasks that fit in one context window).

How should you balance AI-driven judgement with human design decisions?

Domain 5 (Model Selection and Optimisation, 16.8%) and Domain 6 (Prompt and Context Engineering, 11.0%) together test a subtler skill: knowing when to let Claude Code make a decision autonomously and when to route to a human or use a more constrained tool.

The exam's consistent principle is that AI-driven judgement is appropriate for:

• Generating options for human review.
• Classifying inputs against explicit criteria.
• Producing structured output that a downstream system validates.

Human design decisions are required for:

• Architectural choices with long-term lock-in.
• Security remediations above a defined severity threshold.
• Any action that is irreversible at scale.

This maps to the Model-Driven vs Pre-Configured Decision Making concept. The exam rewards candidates who can identify the boundary, not those who default to either extreme.

How does tool description quality affect plugin selection?

One of the most testable mechanics in Domain 8 is how Claude Code selects among available tools when multiple tools could plausibly handle a request. The answer is tool descriptions: Claude reads the description field of each tool definition and routes the request to the best match.

Poor descriptions cause misrouting. A security scanner tool described as "runs code analysis" will compete incorrectly with a linter tool described as "analyses code quality." The fix is specificity: "runs SAST vulnerability scanning using Snyk and returns findings in SARIF format" is unambiguous.

The Tool Descriptions as Selection Mechanism concept covers this in depth, and Writing Effective Tool Descriptions gives the practical patterns. Both are high-yield for Domain 8.

What is the fastest way to build exam-ready knowledge of the plugin ecosystem?

Given that Domain 2 alone is 33.1% of the exam, we recommend the following study sequence:

1. Map each plugin category (TDD, security, IaC, PR review, web quality) to its primary CCDV-F domain.
2. For each domain, work through the relevant concepts in the concept library, focusing on tool design and MCP integration patterns.
3. Practice identifying the correct tool boundary in scenario questions: what does Claude Code do, what does the external tool do, and where does the human review gate sit?
4. Review error-handling patterns, particularly the MCP isError Flag Pattern and Four Error Categories, which appear across Domains 2 and 8.

The CCDV-F exam has 53 items and a 120-minute time limit, which works out to roughly 2 minutes 15 seconds per item. Scenario-based items require you to eliminate distractors quickly. The fastest path to that skill is deliberate practice on scenarios, not re-reading documentation.

Note: AI Skill Certs currently offers live prep for the CCAR-F (Architect Foundations) exam. Our CCDV-F (Developer Foundations) prep is in development. The concept library at /concepts covers material relevant to both tracks, and we will announce CCDV-F-specific practice when it launches.