Marketplace
Use when the plugin is listed in an official or community catalog.Discover the capability, inspect what it adds (skills, MCP servers), then confirm the full-trust install from Plugins → Browse.
Install plugins
Choose the source. Zana records provenance.
Plugins use one installation boundary whether they arrive from an official catalog, a community git marketplace, or a local folder. After install they run in-process on the server — confirm that full-trust step before you continue.
Four routes, one trust boundary
Pick the distribution model that fits the work.
Local folder
Use during private development or team testing.Choose a folder containing package.json with a zcc block. PluginService path-installs it; a failed reload keeps the last good generation.
Git or npm pointer
Use when a registry is not part of the distribution path.Install via git: or npm: sources. The marketplace lists pointers only — refresh never executes plugin code.
Editable source
Use when you are actively authoring a plugin.Keep source connected locally. zcc plugin dev watches, rebuilds, and reloads while the plugin stays full-trust in-process.
Install is the trust gate
Confirm full trust before the plugin loads.
Plugins run in-process on the server after install. Zana lists skills, MCP servers, and extra the grant would add, then you confirm.
- Official catalogs install offline
- Community catalogs are npm/git pointers — refresh never executes plugin code
- A failed reload keeps the last good generation