Claude Code Plugins: MCP, Hooks, and CCDV-F Developer Skills

What are Claude Code plugins?

When we write "Claude Code plugins", we mean the ecosystem of extensions that change what Claude Code can do in a session: MCP (Model Context Protocol) servers that expose new tools and resources, hooks that intercept and react to tool calls, custom slash commands that package reusable workflows, and CLAUDE.md configuration files that set persistent behaviour rules. These extension points matter both for production teams shipping Claude-powered developer tooling and for candidates preparing for the Claude Certified Developer, Foundations (CCDV-F) exam.

For the exam's Claude Code Configuration & Workflows domain, understanding how these mechanisms compose, how they conflict, and which to reach for in a given scenario separates a passing score from a high one.

Which CCDV-F domains cover Claude Code plugin knowledge?

Plugin knowledge is distributed across several of the CCDV-F exam's eight domains. The 53-item exam weights them as follows, from most to least relevant to plugins:

Domain 2 is the dominant weight at 33.1%, covering how plugins wire into complete application architectures. A candidate who studies only the Claude Code domain (3.1%) will miss most of the plugin questions on the exam.

How does MCP work as a plugin system for Claude Code?

MCP (Model Context Protocol) is the primary mechanism through which Claude Code gains new capabilities. Each MCP server exposes a set of tools, resources, and prompts. Claude Code reads these at session start, and the model can then call them when a user's request warrants it.

Configuration happens at three scopes, which the MCP Scoping Hierarchy covers in detail:

• User scope (global): stored in ~/.claude/settings.json, applies to all Claude Code sessions on the machine.
• Project scope: stored in .claude/settings.json within the repository, version-controlled with the codebase.
• System scope: managed by IT administrators, typically to enforce corporate policy.

Project scope is the right choice for team-shared tooling because it travels with the repo. A new team member cloning the project automatically gets the same MCP servers configured. A typical entry looks like this:

{
  "mcpServers": {
    "postgres": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-postgres"],
      "env": {
        "DATABASE_URL": "${DATABASE_URL}"
      }
    }
  }
}

The ${DATABASE_URL} pattern uses environment variable expansion to keep credentials out of version-controlled files. Hardcoding a database URL in .claude/settings.json is a security anti-pattern that CCDV-F exam items will flag explicitly.

Should you build or use an existing MCP server?

The Build vs Use Decision for MCP Servers is an active exam topic under Domain 8 (10.6% weight). The correct answer depends on scope, maintenance burden, and security requirements.

Use an existing MCP server when:

• The capability is well-covered by a maintained open-source or community package (GitHub, Linear, Slack, PostgreSQL).
• The server exposes the right level of tool granularity for your use case.
• You can accept the server's full tool surface without security exposure.

Build a custom MCP server when:

• You need domain-specific tools with precise descriptions that guide model selection reliably.
• Security policy requires you to control which operations are exposed, especially write operations.
• An existing server exposes too broad a scope for a narrow workflow.

The exam rewards proportionate solutions. If a team only needs to run read queries against a single internal API, a minimal custom MCP server is better architecture than adopting a general-purpose server that also exposes mutation endpoints.

What are Claude Code hooks, and how do they differ from MCP tools?

Hooks are shell commands that Claude Code executes at defined lifecycle points: before a tool call (PreToolUse), after a tool call (PostToolUse), and before Claude returns a response (PreResponse). Unlike MCP tools, which Claude selects based on context, hooks run deterministically. They fire regardless of what prompt Claude received.

This distinction matters for the CCDV-F exam and for production architecture:

For scenarios where compliance or data integrity is at stake, a hook is the correct choice because it cannot be overridden by prompt content. For stylistic preferences where occasional deviations are acceptable, a CLAUDE.md instruction is sufficient and carries no execution overhead.

A PostToolUse hook that audits file writes:

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Write",
        "hooks": [
          {
            "type": "command",
            "command": "python scripts/audit_write.py"
          }
        ]
      }
    ]
  }
}

The Hooks vs Prompts Decision Framework maps cleanly onto exam scenarios: when the stakes are high and consistency is non-negotiable, hooks are the correct answer.

How do custom slash commands work in Claude Code?

Slash commands package reusable multi-step workflows as Markdown files in .claude/commands/. A developer types /run-tests and Claude reads run-tests.md, following its instructions for that session.

.claude/
  commands/
    run-tests.md
    summarise-pr.md
    deploy-staging.md

Slash commands are prompt templates, not tool-call endpoints. They do not expose new capabilities to Claude Code; they organise existing ones into named, reproducible patterns. The exam tests this distinction: choosing a slash command when the scenario requires a new capability (which needs an MCP server) is a wrong-answer pattern.

What security risks do Claude Code plugins introduce?

Domain 7 (Security and Safety, 8.1%) tests how Claude Code's extension points expand the attack surface. Two risks appear frequently in exam scenarios.

Tool scope creep. An MCP server configured for a code-review workflow should expose only read operations. If write operations are included and Claude can call them, a poorly-specified prompt could trigger writes the developer did not intend.

Prompt injection via tool results. MCP tool responses flow directly into Claude's context window. A malicious or compromised tool response could contain text designed to redirect Claude's subsequent actions. The MCP Server Integration Best Practices concept covers the defences: treat tool results as untrusted input, restrict tool scope, and audit tool calls with hooks.

Two defensive patterns the exam rewards:

1. Expose the narrowest set of operations the workflow actually needs.
2. Use PostToolUse hooks to log or validate tool call outputs before they influence further model decisions.

How should CCDV-F candidates prioritise plugin study?

With a 120-minute window and 53 items, we recommend allocating study time to mirror domain weight. Across plugin-relevant domains:

1. Domain 2 first (33.1%). Study how MCP servers compose into production application architectures. What happens when a tool call returns an error? How do you handle partial failures in a multi-tool workflow?

2. Domain 6 (11.0%). Tool descriptions are Claude's primary tool-selection mechanism. A well-written description is the cheapest fix for tool misrouting, and exam items will ask you to identify descriptions that cause misrouting.

3. Domain 8 (10.6%). MCP configuration scoping, the isError flag pattern, and when to build vs. use an existing server.

4. Domain 7 (8.1%). Prompt injection and minimal-scope tool design.

5. Domain 3 last (3.1%). Hooks, CLAUDE.md, and slash commands. The domain is small but items tend to be precise. Hands-on experience with .claude/settings.json is more reliable preparation than reading descriptions of it.

The CCDV-F exam scores on a 100 to 1000 scale, with 720 as the passing mark. As of 3 June 2026, more than 10,000 individuals have earned certifications across the Claude Partner Network, which means the difficulty calibration has been validated at real scale.

What does the three-level configuration hierarchy mean for plugin management?

The Three-Level Configuration Hierarchy (user, project, system) determines which Claude Code plugins are active in any session and which settings take precedence when they conflict. Project scope overrides user scope for the same key. System scope can enforce policy that neither users nor projects can override.

This hierarchy has practical implications the exam tests directly:

• A developer's personal MCP config (user scope) that includes a tool the team's security policy prohibits is best addressed by a system-scope block, not by prompting Claude to ignore the tool.
• When a team wants to guarantee all members use the same MCP servers, committing .claude/settings.json to the repo is the correct approach, not sending configuration instructions in chat.

Configuration decisions belong in config files. Using prompt-based workarounds for settings that belong in files is a reliability anti-pattern and a wrong-answer signal on the CCDV-F exam.