Anthropic just open-sourced 11 production plugins for Claude Cowork (25K+ stars in days), exposing the internal agent-composition primitives they use to wire together Slack, HubSpot, Jira, and custom slash commands into coherent workflows. This is the first major vendor to publish their plugin architecture as reusable templates, and the repository structure reveals how they separate skills (reusable prompt fragments), connectors (OAuth-wrapped API clients), and sub-agents (delegated reasoning loops) into composable units.
The finance plugin provides a concrete case study. It bundles journal entry prep, budget tracking, and compliance workflows with connectors for Slack, Box, Egnyte, Jira, and Microsoft 365. Examining its manifest and connector wiring shows how Anthropic handles state handoff between Claude's main loop and connector-specific sub-agents, how slash commands map to plugin-defined tools, and what guardrails prevent a finance plugin from accidentally invoking a sales CRM connector.
Plugin Architecture: Four Primitives
Each plugin is a directory containing four types of components:
- Skills: Markdown files with role-specific prompt fragments (terminology, workflows, output formats).
- Connectors: Python modules wrapping third-party APIs with OAuth flows and rate-limit handling.
-
Slash commands: User-facing shortcuts that map to tool invocations (e.g.,
/journal-entrytriggers the finance plugin's GL prep workflow). - Sub-agents: Delegated reasoning loops that handle multi-step tasks within a connector's scope (e.g., the Box connector's sub-agent searches folders, filters by date, and extracts metadata before returning results to the main agent).
The manifest file (plugin.yaml) declares dependencies, connector permissions, and which slash commands are exposed. Here's a simplified structure from the finance plugin:
name: finance
version: 1.0.0
skills:
- journal_entry_prep
- budget_tracking
- compliance_review
connectors:
- slack
- box
- egnyte
- jira
- microsoft_365
slash_commands:
/journal-entry:
skill: journal_entry_prep
connectors: [box, slack]
description: "Prepare GL journal entries from uploaded receipts"
/budget-check:
skill: budget_tracking
connectors: [microsoft_365]
description: "Compare actuals vs. budget in Excel"
permissions:
box: read_write
slack: read_only
microsoft_365: read_only
State Handoff Between Main Loop and Sub-Agents
The finance plugin's journal entry workflow demonstrates the state management pattern:
- User invokes
/journal-entrywith a Slack thread link. - Claude's main loop parses the command and identifies required connectors (Box, Slack).
- The Slack connector's sub-agent fetches the thread, extracts file URLs, and returns structured metadata.
- The Box connector's sub-agent downloads files, runs OCR if needed, and extracts line items.
- The main loop synthesizes results into a journal entry draft, applying the
journal_entry_prepskill's formatting rules. - Claude returns the draft and asks for confirmation before posting to Jira.
State is passed as JSON between the main loop and sub-agents. Each sub-agent receives a scoped context (the thread ID, file paths, or search query) and returns a typed response. The main loop never sees raw API tokens or connector internals. This boundary prevents credential leakage and makes it easier to swap connectors (e.g., replace Box with Dropbox without changing the main workflow).
Connector Isolation and Permission Boundaries
The plugin manifest enforces connector permissions at load time. When the finance plugin initializes, Cowork checks that the user has granted OAuth access to Box, Slack, Egnyte, Jira, and Microsoft 365. If any connector is missing, the plugin loads in degraded mode (slash commands that depend on the missing connector are disabled).
Connectors are isolated in separate Python processes. The main agent communicates via IPC (inter-process communication) using a JSON-RPC protocol. This prevents a compromised connector from accessing other connectors' credentials or the main agent's memory. The finance plugin cannot invoke HubSpot (a sales connector) because HubSpot is not listed in its manifest, and the runtime enforces this at the IPC boundary.
Rate limits and retries are handled inside each connector. The Box connector includes exponential backoff and circuit-breaker logic. If Box is down, the connector returns an error to the main loop, which can either retry, skip the Box step, or ask the user for manual input. The main loop does not need to know Box's rate-limit rules.
Slash Command to Tool Mapping
Slash commands are syntactic sugar for tool calls. When a user types /journal-entry, Cowork translates it into a tool invocation:
{
"tool": "finance.journal_entry_prep",
"parameters": {
"slack_thread": "https://example.slack.com/archives/C123/p456",
"connectors": ["box", "slack"]
}
}
The main loop then orchestrates the sub-agents as described above. This mapping is defined in the plugin manifest and validated at load time. If a slash command references a connector that is not listed in the manifest, the plugin fails to load.
Custom slash commands can be added by editing the manifest and implementing the corresponding skill. For example, a company might add /expense-report that pulls data from Expensify instead of Box. The skill file would include prompt fragments for parsing Expensify receipts, and the manifest would declare the Expensify connector as a dependency.
Customization Layer for Multi-Tenant Deployment
The plugin marketplace includes a customization layer that lets companies inject their own tools, terminology, and processes. This is implemented as a separate overrides.yaml file that merges with the base plugin manifest:
company: acme-corp
overrides:
skills:
journal_entry_prep:
terminology:
"GL": "General Ledger (use account codes from SAP)"
"receipt": "expense voucher"
output_format: "Use Acme's standard journal entry template (link)"
connectors:
box:
folder_path: "/Finance/Receipts"
slack:
channels: ["#finance", "#accounting"]
slash_commands:
/journal-entry:
approval_required: true
approvers: ["cfo@acme.com", "controller@acme.com"]
At runtime, Cowork merges the base manifest with the company overrides. The journal_entry_prep skill now includes Acme-specific terminology and output formats. The Box connector defaults to the /Finance/Receipts folder. The /journal-entry command requires approval from the CFO or controller before posting to Jira.
This multi-tenant pattern keeps the base plugin generic while allowing per-company customization. The overrides file is stored in the company's workspace (not in the public repository), so sensitive data (folder paths, approver emails) stays private.
Observability and Failure Modes
Each connector logs to a structured JSON file. The finance plugin's Box connector logs every API call, response time, and error:
{
"timestamp": "2026-09-20T10:15:32Z",
"connector": "box",
"action": "download_file",
"file_id": "12345",
"duration_ms": 1234,
"status": "success"
}
If a connector fails, the main loop receives an error object with a retry_after field. The loop can decide whether to retry immediately, wait, or escalate to the user. The finance plugin's compliance workflow includes a fallback: if Box is down, it asks the user to upload files directly to Slack.
The main loop also logs tool calls and sub-agent invocations. This makes it possible to trace a workflow from the initial slash command to the final output. For example, a /journal-entry invocation might log:
- Slash command received.
- Slack connector invoked (thread fetch).
- Box connector invoked (file download).
- Skill applied (journal entry formatting).
- Jira connector invoked (ticket creation).
- Approval requested (CFO notified).
These logs are stored in the company's workspace and can be exported for auditing or debugging.
Trade-offs and Deployment Considerations
| Aspect | Benefit | Risk |
|---|---|---|
| Connector isolation | Prevents credential leakage, easier to swap connectors | IPC overhead, harder to debug cross-connector workflows |
| Slash command abstraction | User-friendly, consistent UX across plugins | Hides complexity, users may not understand what connectors are invoked |
| Customization layer | Multi-tenant without forking base plugins | Overrides can break when base plugin updates, versioning required |
| Sub-agent delegation | Keeps main loop simple, connectors own their retry logic | State handoff adds latency, sub-agents can't share context |
| Manifest-driven permissions | Declarative, easy to audit | Requires OAuth setup for every connector, friction for new users |
Technical Verdict
Use Anthropic's plugin architecture if you are building multi-tool agents for knowledge workers and need a reusable composition model. The separation of skills, connectors, slash commands, and sub-agents makes it easier to add new tools without rewriting the main loop. The customization layer is a clean solution for multi-tenant deployments where each company has different tools and workflows.
Avoid this pattern if your agent needs tight coupling between tools (e.g., a trading bot that must execute buy and sell orders atomically). The IPC boundary and state handoff add latency and make it harder to implement transactional workflows. Also avoid if you need sub-agents to share context (e.g., a research agent that builds a knowledge graph across multiple connectors). The isolated sub-agent model does not support shared memory.
The finance plugin is a good starting point for teams building accounting, compliance, or budget-tracking workflows. The journal entry prep and budget-check slash commands are production-ready examples of how to wire together document storage (Box), messaging (Slack), and spreadsheets (Microsoft 365) into a coherent workflow. The compliance review skill shows how to inject company-specific terminology and approval rules without forking the base plugin.
Top comments (0)