Factory Plugins
The official Factory marketplace for Droid CLI: plugins for security review, TypeScript, debugging and pull requests.
- 125 ★ on the repository
- Last commit
Broad access
Why this level
- The `droid-control` plugin drives the terminal, browser and desktop, including keyboard and mouse input.
- The `code-review` and `autoresearch` plugins edit code, push branches and open pull requests in an autonomous loop.
Install
Manual install
droid plugin marketplace add https://github.com/Factory-AI/factory-pluginsThen `droid plugin install security-engineer@factory-plugins` installs the plugin you want. The catalog opens with `/plugins`.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The `droid-control` plugin drives the terminal, browser and desktop, including keyboard and mouse input.
- The `code-review` and `autoresearch` plugins edit code, push branches and open pull requests in an autonomous loop.
This is third-party code. Review the repository files before installing.
What it does
Factory Plugins is a marketplace from Factory with plugins for Droid CLI. Each plugin gathers skills around one task. `security-engineer` runs STRIDE security reviews, builds threat models, scans commits and validates found vulnerabilities. `typescript` removes `as` type assertions, replaces `useEffect` and fixes unused exports from a `knip` report. `code-review` opens pull requests following Conventional Commits and carries them to merge. `debugging` intercepts HTTP traffic through HTTP Toolkit. Three more plugins. `droid-control` drives the terminal, browser and desktop and adds the `/demo`, `/verify` and `/qa-test` commands. `autoresearch` runs a loop of measurable experiments. `droid-evolved` bundles skills for human-sounding writing, design and browser automation. The `core` plugin comes preinstalled in Droid CLI.
Who it is for. Factory Droid users who want ready skills for security review, pull requests and debugging without building their own plugins.
Good fit when
- A commit or pull request needs a STRIDE vulnerability review with the findings confirmed.
- A TypeScript codebase has too many `as` casts and needless `useEffect` calls.
- A demo or QA run of a terminal app needs a recorded session and checks of the claimed behavior.
- Outgoing requests of a CLI or service have to be intercepted and inspected at the request and response level.
Not a fit when
- You work in Claude Code or Cursor, and the plugins use the Factory format.
- You need one specific skill and the whole marketplace is excess.
- Your security policy forbids the browser and desktop automation that `droid-control` performs.
Example request
Review this pull request for vulnerabilities using STRIDE and validate each finding before it goes into the report.Limitations
Installation is described only for Droid CLI through the `droid plugin marketplace add` and `droid plugin install` commands. Skills sit in `skills/` as folders with `SKILL.md`, and other agents need them copied by hand. The repository has no license file and GitHub detects none, so check reuse terms with Factory. The skills depend on outside tools: HTTP Toolkit, Slidev, `nanobanana` and `agent-browser`. The `droid-control` plugin carries its own third-party license notices in `CUA-LICENSE.md` and `NOTICES.md`.
How to disable. Remove the plugins with the Droid CLI plugin manager and delete the marketplace from its list. The preinstalled `core` plugin stays.
FAQ
How do I add the marketplace to Droid CLI?
Run `droid plugin marketplace add https://github.com/Factory-AI/factory-plugins`. After that, plugins install by name and the catalog opens with `/plugins`.
Which plugins are in the marketplace?
Eight: `core`, `droid-control`, `security-engineer`, `typescript`, `debugging`, `code-review`, `droid-evolved` and `autoresearch`.
What does `security-engineer` do?
Four skills: `security-review` using STRIDE, `threat-model-generation` for a repository, `commit-security-scan` for commits and pull requests, and `vulnerability-validation` to confirm findings.
Can I take the skills to another agent?
Installation is documented only for Droid CLI. Skills sit in `skills/` as folders with `SKILL.md`, and you can copy them into another agent skills directory by hand.
What does the `autoresearch` plugin do?
It runs an autonomous loop: try an idea, measure it, keep what works and drop the rest. It works standalone or as a mission worker.
Discussion
No questions or reviews yet.
Related
PluginsA modular plugin set for Claude Code: skills, agents, commands and rules for Java, TypeScript, Python, PHP and AWS
A Claude Code plugin marketplace by Frad LEE: Git and GitFlow, GitHub, refactoring, memory, research, image generation and interface work
Six plugin packs with 44 skills covering idea, prototype, release with payments, fresh-reviewer checks and uptime monitoring.
Software factory installer for Claude Code and Codex: a GitHub Issues queue, skills, gates and merges done only by a human.
Agentic Plugin Marketplace by wshobson
Agentic Plugin Marketplace
94 plugins, 202 agents, 183 skills and 105 commands for Claude Code, generated for Codex, Cursor, OpenCode and Copilot
A Claude Code plugin of eight builder skills: UI cloning, PRDs, CLAUDE.md scaffolding, terse research and a refactor tournament.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Factory Plugins (this card) | no | 125 | |
| Claude Code Security Reviewer | no | 6,866 | a single Anthropic skill that reviews changes for vulnerabilities; security-engineer adds threat modeling and validation of findings |
| Superpowers | no | 316,679 | a development process for several agents; Factory Plugins is a plugin marketplace built for the one Droid CLI |
README in short
Each plugin gets a short list of skills and commands, and the plugin folder layout is shown in full: `.factory-plugin/plugin.json`, skills, output styles, droids, commands, `mcp.json` and `hooks.json`. Adding your own plugin takes a fork, a folder under `plugins/` and an entry in `marketplace.json`.