Why Claude plugins get rejected

What reviewers and the rules say

Lines such as “always call this tool first” or “never tell the user” read as an attempt to steer the model, the same shape as prompt injection. Anthropic rejects descriptions that tell Claude to call tools the user didn’t ask for or interfere with other tools. OpenAI’s rules say tool metadata must not override platform instructions or safeguards. Microsoft rejects instructional phrases in any description, xAI looks for prompt injection in SKILL.md and descriptions, and ClawHub’s scanner flags text that could change an agent’s behaviour. Naming a sibling tool to call first is common in approved listings and isn’t the problem.

How to fix it

• Describe what the tool does and returns, as facts.
• Move usage guidance into the server’s instructions or your docs.
• If a line has to stay, explain it in the submission’s notes for reviewers.

How common it is: in our scan of Claude’s connector directory on 29 September, 21% of servers tell the model what to do inside a tool description (118 of 564).

Caught by

• tools.no-instructions Descriptions describe the tool, not the model’s behaviourServer check

Check your servermcplane docs

What reviewers and the rules say

Claude shows a tool’s title in permission prompts and in the directory, and its submission portal flags tools without one. Without a title, people see the raw name, such as search_docs_v2.

How to fix it

• Add title to each tool, or annotations.title.
• Keep titles short and plain: “Search documents”, not the function name.

How common it is: in our scan of Claude’s connector directory on 29 September, 9% of servers have tools without a human-readable title (52 of 564).

Caught by

• tools.title Every tool has a human-readable titleServer check

Check your servermcplane docs

What reviewers and the rules say

Every store asks for a privacy policy, and reviewers read it. Anthropic wants it to cover data collection, usage and storage, third-party sharing, retention and contact information. OpenAI asks for the categories of personal data you collect, why you use them, who receives them, how long you keep them and what users can do about it. Data your tools return that the policy doesn’t mention counts as a gap.

How to fix it

• Link a page that loads without signing in.
• Cover collection, use, sharing, retention, user controls such as deletion, and how to contact you.
• Mention the data your tools return and any free-form content users send, not only what they type into forms.

How common it is: in our scan of Claude’s connector directory on 29 September, 4% of servers link a privacy policy that doesn’t load (145 of 3,283).

Caught by

• listing.privacy The privacy policy covers what reviewers look forServer check
• listing.privacy-content Free-form content is covered by the privacy policyServer check

Check your servermcplane docs

What reviewers and the rules say

Each store enforces its own limits, some without telling you until review. ChatGPT’s display name and subtitle stop at 30 characters each, and it takes up to three starter prompts. Claude caps names at 100 characters, one-liners at 200, descriptions at 2,000 and tool names at 64. Microsoft wants three to five prompts per command, none over 128 characters.

How to fix it

• Keep a shorter name for ChatGPT if yours runs past 30 characters.
• Write up to three distinct starter prompts for ChatGPT, without @mentions.
• Rename any tool over 64 characters.

How common it is: in our scan of Claude’s connector directory on 29 September, 3% of servers have a name longer than ChatGPT’s 30 characters (92 of 3,283).

Caught by

• listing.name Display name fits (30 characters)Server check
• listing.claude-name Name for Claude fits (100 characters)Server check
• tools.name-length Tool names are 64 characters or fewerServer check
• listing.prompts Starter prompts are short, unique and free of @mentionsmcplane CLI
• listing.subtitle Subtitle fits (30 characters)mcplane CLI
• listing.one-liner One-liner fits (200 characters)mcplane CLI

Check your servermcplane docs

What reviewers and the rules say

Stores scan what you upload. A key in an MCP server’s headers or a token in a config file blocks the submission: Claude’s plugin validation reports “Secret in MCP headers”. ClawHub’s scanner also flags lines that only look like a secret, such as a command that reads a password from the user.

How to fix it

• Ask for keys at install time. Claude plugins use a userConfig entry marked sensitive: true.
• Keep credentials out of the ZIP, the repository and skill files.
• Rewrite examples that look like real keys.

Caught by

No script can see this one. A server check rules out the mechanical causes first.

Check your servermcplane docs

What reviewers and the rules say

Stores that take plugins read them from a public GitHub repository at a pinned commit, and validate it before anyone reviews it. A private repository, a missing manifest, README or licence, a branch instead of a commit, or a failing CI run leaves nothing to review. Gemini CLI’s gallery skips a repository that fails validation without saying so.

How to fix it

• Host the plugin in its own public GitHub repository. A private monorepo can’t be pinned.
• Claude: add .claude-plugin/plugin.json, a README of at least 40 words and a LICENSE, then run claude plugin validate --strict.
• Don’t leave a SKILL.md at the root beside a skills/ folder. Claude loads it as a single-skill plugin and hides the rest.
• Grok: pin a full 40-character commit SHA, not main or a tag.
• Docker: use a licence that lets people run the server, such as MIT or Apache 2.0, and get CI green before asking for review.
• Gemini CLI: put gemini-extension.json at the root and add the gemini-cli-extension topic.

Caught by

• repo.public The plugin repository is publicmcplane CLI
• repo.claude-manifest .claude-plugin/plugin.json existsmcplane CLI
• repo.root-skill No root SKILL.md shadowing the plugin’s skillsmcplane CLI

Check your servermcplane docs

What reviewers and the rules say

Some reviews end without an explanation. ChatGPT rejection emails have arrived with an empty details section, Claude’s old plugin portal showed “Rejected” with no notes, Grok and Docker maintainers often close pull requests without a comment, Gemini CLI’s crawler skips repositories silently, and Cursor’s publish form sends no confirmation.

How to fix it

• ChatGPT: reply to the rejection email with your case ID and ask for the specific finding.
• On a pull request, ask what would make it acceptable.
• Rule out the mechanical causes with a server check before you resubmit.

Of the 6 pull requests maintainers closed in the Grok and Docker queues we track, none had a comment saying why (checked 1 October).

Caught by

No script can see this one. A server check rules out the mechanical causes first.

Check your servermcplane docs