[BUG] Marketplace URL credentials printed in cleartext in `/plugin` and `claude plugin marketplace list`

[shay-coh]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

claude mcp add masks a secret header value as [REDACTED] before printing it. Plugin
marketplaces get no such treatment, so a marketplace added over HTTPS basic auth has its
password printed in full in both places where marketplaces are listed:

1. claude plugin marketplace list prints Source: URL (https://user:PASSWORD@host/...).
2. /plugin then the Marketplaces tab prints the same URL under the marketplace name, wrapped
   over several lines.

There is no setting to suppress it.

For a url source marketplace no git remote is involved, so a credential helper never applies
and basic auth in the URL is the only way to reach a protected marketplace document. That makes
this the normal path for a private marketplace rather than a corner case. /plugin is also the
screen people open when a plugin misbehaves, which is often while sharing a screen or capturing
a screenshot for a bug report.

What Should Happen?

Mask the credential wherever a marketplace source URL is rendered, reusing the [REDACTED]
string the CLI already prints elsewhere. The rest of the URL keeps marketplaces identifiable and
should stay visible:

❯ acme-internal
  Source: URL (https://ci-user:[REDACTED]@marketplace.example.com/claude-marketplace.json)

Two things worth covering in the same fix:

• All render paths, so the TUI list, marketplace list, marketplace info, and any error or
  status message that echoes the source URL.
• Query parameters named like credentials, such as token, access_token, api_key, key,
  password, sig. A marketplace behind a signed URL carries its secret there instead of in
  the userinfo part.

Error Messages/Logs

$ claude mcp add --transport http example https://example.com/mcp --header "Authorization: Bearer sk-not-a-real-token"
Added HTTP MCP server example with URL: https://example.com/mcp to local config
Headers: {
  "Authorization": "[REDACTED]"     <- masked here
}

$ claude plugin marketplace list
Configured marketplaces:
  ❯ acme-internal
    Source: URL (https://ci-user:s3cr3t.p4ssw0rd@marketplace.example.com/claude-marketplace.json)
                         ^^^^^^^^^^^^^^^^ not masked here

Steps to Reproduce

1. Add a marketplace whose URL carries basic auth credentials. Any host works, and the fetch
   does not have to succeed for the entry to be listed afterwards:

   claude plugin marketplace add "https://ci-user:s3cr3t.p4ssw0rd@marketplace.example.com/claude-marketplace.json"

   Adding it through /plugin then Add Marketplace behaves the same, and that prompt offers
   https://example.com/marketplace.json as an accepted source.

2. Run claude plugin marketplace list. The full URL is printed with s3cr3t.p4ssw0rd visible.

3. Start claude, run /plugin, open the Marketplaces tab. Same unmasked URL on screen.

Claude Model

None

Is this a regression?

No, this never worked

Last Working Version

No response

Claude Code Version

2.1.228 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

#41438 reported this for the marketplace menu but had no reproduction steps, was written against
an SSH style source, and went stale at v2.1.88 before being closed and locked. Its closing
comment asks that a new issue be opened referencing it. #46018 was closed as a duplicate of
#44888, and both of those concern MCP connector URLs rather than plugin marketplaces.

#82351 makes the same point about claude mcp get printing raw header values while
claude mcp add masks them, and #64043 reported it for mcp get env values. Marketplace URLs
look like the surface where this convention has not been applied yet.

This is only about what gets printed. Storage of the credential is a separate topic, already
discussed in #49694.

[bcherny]

Reproduced on v2.1.233 (macOS).

Steps:

1. Serve a marketplace JSON behind HTTP basic auth (I used a local server on 127.0.0.1:18636).
2. claude plugin marketplace add "http://ci-user:s3cr3t.p4ssw0rd@127.0.0.1:18636/claude-marketplace.json" — succeeds.
3. claude plugin marketplace list
4. Start claude, run /plugin, switch to the Marketplaces tab.

Observed — the password is printed in full in both places:

  ❯ acme-internal
    Source: URL (http://ci-user:s3cr3t.p4ssw0rd@127.0.0.1:18636/claude-marketplace.json)

     ● acme-internal
       http://ci-user:s3cr3t.p4ssw0rd@127.0.0.1:18636/claude-marketplace.json
       1 available • Updated 8/15/2026

Expected: the credential masked (for example http://ci-user:[REDACTED]@127.0.0.1:18636/...), consistent with how claude mcp add masks header values.

One note: on 2.1.233 the exact URL from the report (marketplace.example.com, which returns 403) is not added at all — the add fails and nothing is listed — so a reachable basic-auth URL is needed to see the leak.

Assessment: This looks like a genuine bug, not a regression (it has never masked these). Claude Code already treats credentials embedded in a marketplace URL (basic-auth userinfo and token-style query parameters) as secrets: they are stripped from the download progress text, debug logs, and fetch error messages. The marketplace list output and the /plugin Marketplaces tab are the paths that were missed and still print the stored URL verbatim. Git-source marketplaces with a token in the URL have the same problem. The fix is to run the same masking wherever a marketplace source URL is displayed.

🤖 Generated with Claude Code

[bcherny]

Reproduced on the current release (v2.1.233, Linux).

With a marketplace added from a URL that carries basic-auth credentials:

• claude plugin marketplace list prints the full URL including the password in cleartext:

  ❯ acme-internal
    Source: URL (http://ci-user:s3cr3t.p4ssw0rd@…/claude-marketplace.json)
  

• /plugin → Marketplaces tab shows the same unmasked URL under the marketplace name.

One detail worth noting for whoever picks this up: the transient progress line shown while the marketplace is being added ("Downloading marketplace from …") already strips the credentials from the URL — so the masking convention exists on that path but isn't applied where the source URL is persistently rendered. claude mcp add's [REDACTED] treatment is the obvious precedent, and the suggestion to also mask credential-shaped query parameters (token, api_key, sig, …) for signed-URL marketplaces makes sense as part of the same fix.

One small difference from the report as written: on v2.1.233 an add whose fetch fails doesn't persist the entry, so the credential only shows up for successfully added marketplaces — which is still exactly the private-marketplace case this issue is about.

🤖 Generated with Claude Code