Claude Code Skills and Agent Plugins: A European Dev Team Evaluation Guide for 2026

TL;DR: 10 Claude Code skills and agent plugins European dev teams adopt in 2026. A guide for technical leads evaluating AI coding extensions.

Claude Code's extension ecosystem has matured faster than most engineering leads anticipated. The platform now supports two distinct layers of extensibility: skills (callable scripts and sub-agents triggered by slash commands) and MCP-based plugins (Model Context Protocol servers that expose tools, resources, and prompts). For a 20-person software team in Warsaw or Lyon, choosing the wrong set of extensions can quietly erode developer confidence in AI tooling within weeks. This guide explains what each category is, covers 10 concrete examples that teams are putting into production, and flags the data-handling questions that matter specifically under GDPR.

Skills vs. MCP Plugins: The Distinction That Matters

A Claude Code skill is a markdown-defined callable script stored in ~/.claude/skills/ or committed to a project's .claude/skills/ folder. When a developer types /commit or /review-pr, Claude loads the skill file, follows its instructions, and executes a focused task within the current session context. Skills are portable, version-controlled, and require no external process.

MCP plugins are different. They run as separate processes (locally or remotely) and expose capabilities over the Model Context Protocol. Claude Code connects to them through configuration in settings.json. An MCP plugin might expose a Postgres database as a queryable resource, wrap a Jira API as a set of callable tools, or stream browser DevTools events into the coding session. The protocol boundary matters for EU teams: data leaving the local process to a remote MCP server may constitute a transfer under GDPR Article 44 if that server is outside the EEA.

For a practical starting point on configuring Claude Code for your team's environment, see the Claude Code CLAUDE.md configuration guide for engineering teams.

10 Skills and Plugins European Dev Teams Are Adopting

1. /commit (skill): Reads git diff, drafts a Conventional Commits message, and stages only non-sensitive files. Most teams commit this skill to their monorepo so it enforces house style automatically.

2. /review-pr (skill): Pulls the current branch diff, checks against a configurable rubric, and posts structured feedback. Teams using GitHub Actions pair this with a bot account that runs the skill on every PR open event.

3. github MCP plugin (Anthropic-managed): Exposes issues, PRs, and repo metadata as tools. Lets Claude draft release notes by reading merged PRs since the last tag. Anthropic manages the plugin; data flows to GitHub's API, which is covered by GitHub's DPA under GDPR.

4. postgres MCP plugin (community): Connects Claude to a read-only Postgres replica. Useful for schema-aware code generation and query review. EU teams should point this at an EEA-hosted replica, not a US-region database, to avoid cross-border transfer questions.

5. playwright MCP plugin (Anthropic-managed): Drives a real browser session from within Claude Code. Useful for end-to-end test generation: the developer describes a flow, Claude navigates the staging environment, and generates the Playwright test file. No data leaves the local machine unless the staging URL is external.

6. /spec-driven (skill): A spec-driven design workflow skill that forces Claude to write an interface contract before generating any implementation. Teams adopting this report fewer back-and-forth cycles on API shape.

7. context7 MCP plugin (Anthropic-managed): Resolves library and API version questions against live documentation. Prevents Claude from generating code against deprecated method signatures. Essential for fast-moving ecosystems like React or Pydantic v2.

8. /tdd (skill): Generates failing tests before implementation. The skill reads an issue or spec, produces a test file with clearly named cases, and waits for the developer to confirm before writing production code.

9. brave-search MCP plugin (manual key): Provides web search within the coding session. Teams use it for researching CVEs during dependency audits or checking whether a third-party API endpoint has changed. The Brave Search API is operated from the US; teams should review Brave's DPA before routing sensitive query strings through it.

10. vercel MCP plugin (Anthropic-managed): Exposes deployment status, environment variables (masked), and preview URL generation. Useful for CI-adjacent workflows where Claude confirms a deployment succeeded before running post-deploy checks.

For a broader view of how autonomous agent workflows connect these extensions, see Claude Code agent mode and autonomous workflows.

Production-Ready vs. Experimental: How to Classify What You Adopt

The line between production-ready and experimental is not set by Anthropic. It is set by your team's operational tolerance. A useful three-question test:

Does the plugin have a DPA or is it Anthropic-managed? Anthropic-managed plugins (github, playwright, vercel, context7) have a clear data processing agreement path through Anthropic's terms. Community plugins and manual-key plugins require independent DPA review before handling any data that could identify individuals or include business-confidential code.

Does it write or only read? Skills that write to git, file systems, or external APIs carry higher risk than read-only tools. Treat any write-capable skill or plugin as requiring explicit developer confirmation before execution, at least during the first 30 days of team adoption.

Is it version-pinned? Skills committed to the repository are version-pinned by definition. MCP plugins loaded from a remote server (as opposed to a locally installed process) can change behaviour without a repository commit. Pin remote plugin versions or run them from a local fork.

For a structured framework on evaluating AI coding tools across these dimensions, see how technical leaders should choose an AI coding agent.

GDPR Considerations Specific to Claude Code Extensions

Claude Code's core model inference runs through Anthropic's API. EU teams using the commercial API are covered by Anthropic's standard DPA, which includes GDPR-compliant data processing terms. The extension layer introduces additional processors.

Three points to check before deploying any plugin to a team:

First, identify every outbound network call the plugin makes. An MCP plugin that calls a US-hosted API is adding a data processor outside the EEA. If any code it processes contains personal data (even in comments or variable names referencing real users), you need a valid transfer mechanism: Standard Contractual Clauses, an adequacy decision, or confirmed EEA hosting.

Second, check whether the plugin logs requests server-side. Some community MCP servers log tool calls for debugging. Request logging of developer queries that contain business logic may constitute processing of confidential information.

Third, maintain an internal registry. Document each skill and plugin your team uses, who approved it, what data flows through it, and what the legal basis is for any cross-border transfer. This is the MCP equivalent of a data processor register, which GDPR Article 30 requires organisations with more than 250 employees to maintain formally.

The MCP marketplace guide covers the broader landscape of available MCP servers and how to evaluate them for enterprise use.

A Practical Adoption Sequence for Teams of 10-50 Engineers

Start with skills only for the first four weeks. Commit /commit, /review-pr, and one domain-specific skill (such as a spec writer or ADR drafter) to the repository. Measure developer adoption by counting how often the slash commands appear in session logs. If fewer than 60% of engineers use them in week three, investigate friction before expanding.

Add read-only MCP plugins in week five. Start with context7 (documentation lookup) and github (repo data). No write capabilities, no external data residency questions beyond what you have already cleared.

Introduce write-capable or externally networked plugins only after the team has a plugin registry and a lightweight DPA review process. Even a one-page checklist reduces the risk of a plugin silently routing production code to an unreviewed third-party server.

If your team is at the evaluation stage and not yet sure which extensions fit your architecture, an AI readiness assessment can identify the highest-value starting points before you commit to an integration path.

FAQ

Are Claude Code skills the same as MCP plugins?

No. Skills are markdown files that Claude reads and follows within a single session. They require no external process. MCP plugins are separate server processes that Claude connects to over the Model Context Protocol. Skills are simpler to audit and version-control; plugins are more powerful but introduce additional process boundaries and potential data flows.

Can European teams use Claude Code plugins without a GDPR-compliant DPA?

Only if no personal data or confidential code passes through the plugin. In practice, most code generation sessions involve business logic that qualifies as confidential, if not personal data. The safe approach is to review each plugin's data processing terms before team-wide deployment and record the review in your data processor register.

What is the simplest way to evaluate whether a skill is ready for production?

Check three things: it is committed to the repository (version-controlled), it does not make write operations without explicit developer confirmation, and it has been tested by at least two engineers over five real sessions. If all three are true, it is operationally ready. Legal readiness is a separate check involving data flow review.

Further Reading

• Claude Code CLAUDE.md Configuration Guide: How to configure project-level instructions and defaults for your engineering team.
• Claude Code Agent Mode and Autonomous Workflows: How to connect skills and plugins into multi-step autonomous pipelines.
• How Technical Leaders Should Choose an AI Coding Agent: A structured evaluation framework for AI coding tools across capability, cost, and compliance dimensions.
• MCP Marketplace Guide 2026: A curated overview of the Model Context Protocol server ecosystem and how to assess servers for enterprise use.