xAI Ships Grok Build Plugin Marketplace With MongoDB, Vercel, Sentry, Chrome DevTools, Cloudflare, and Superpowers Plugins at Launch

0 0 4 minutes read

Today, xAI launched the Grok Build Plugin Marketplace. It is a built-in catalog of plugins for Grok Build, the company's code repository agent. The plugin combines capabilities, slash commands, agents, hooks, MCP servers, and LSPs in one package. You browse, install, and update these packages without leaving the terminal.

Plugin Marketplace

Grok Build is an xAI coding agent and CLI for software engineering work. The marketplace adds an acquisition and distribution layer on top. Before this, developers were putting together one integration at a time. Now a single command pulls the entire stack from the agent. The catalog remains in the open xai-org/plugin-marketplace on GitHub. That repo is a reference. It points to the plugin sources so that Grok Build can download it.

Inside the Plugin

A plugin is a directory that includes any combination of six components. Each type maps to a specific file or folder. The table below is self-explanatory.

Element	Location	The purpose
Skills	`skills/`	`SKILL.md` abilities
Instructions	`commands/`	Slash Commands
Agents	`agents/`	Subagent Definitions
Hooks	`hooks/hooks.json`	Lifecycle hooks
MCP servers	`.mcp.json`	The MCP server is processing
LSP servers	`.lsp.json`	Language server settings

Optional plugin.json A manifest adds metadata or overrides component methods. So a single installation can extend the agent in several ways at the same time.

How to Install It Works

Inside Grok Build, type /marketplace to browse the catalog. Press i to install the selected plugin. You can also run commands directly from the shell:

grok plugin marketplace list
grok plugin install  --trust

The installation command carries a --trust the flag. That's important because plugins can run code and access data on your system.

Introduce plugins and use cases

The marketplace opens with six plugins from partners across the stack. Each directs a physical workflow.

MongoDB – explore data, manage collections, and expand queries.
Vercel – manage deployments, check build status, and configure domains.
The watchman – analyze stack trace and debug production errors.
Chrome DevTools — control the live browser, record performance traces, and check network requests.
Cloudflare – Staff Skills, Durable Items, and more.
Great power – popular agent-driven workflow.

Example: a data scientist hits a slow MongoDB query. They install the MongoDB plugin, and ask the agent to configure it. For example: a lead developer installs Chrome DevTools to test network requests during rendering failures. Example: a developer on the phone installs Sentry to check the stack trace from production.

Security Model: SHA Pinning

Every remote control plugin pins a 40-character SHA. Grok Build reconfirms git rev-parse HEAD == sha after cloning. Without a pin, a force-push or repo compromise can deploy new code silently. A pin closes that way during installation. The repo also separates first-party plugins, maintained by xAI, from other third parties. xAI claims that it does not write, control, or endorse third-party plugins. They ship AS-IS, and you do so at your own risk.

Publishing Your Plugin

The catalog is open for donations. To add a plugin, edit .grok-plugin/marketplace.json and open a pull request. The installation of the remote control looks like this:

{
  "name": "my-plugin",
  "description": "What the plugin does.",
  "category": "development",
  "source": {
    "source": "url",
    "url": "
    "sha": "0000000000000000000000000000000000000000"
  },
  "homepage": "
  "keywords": ["my-plugin"]
}

Produced plugin-index.json records the components of each plugin. You don't manually edit that file. Redo it with python3 scripts/generate-plugin-index.py. CI uses the same script with --check and fails on old files.

How it compares

The idea of integration is similar to the use of an agent, such as Claude Code. The table shows the market versus green MCP setup.

Power	Grok Build Marketplace	Synthesis of green MCP
Includes skills, commands, agents, hooks, MCP, LSP	Yes	No, only MCP servers
Browse inside terminal and install	Yes, with `/marketplace`	Automated programming
Commit to SHA for pin verification	Yes, it is forced to install	It is not built in
Open public catalog based on PR	Yes	It's not worth it
Review the method	`grok plugin` review the flow	Manual

Note: the table shows a written design, not a hands-on benchmark.

Power and trade

Power

A single installation adds capabilities, commands, agents, hooks, MCP, and LSP support.
SHA pinning provides a concrete supplychain guard for executable code.
The open catalog lowers the bar for plugin offerings.

Exchange

Grok Build access still sits behind the premium SuperGrok and X Premium Plus tiers.
The catalog is small at launch, with six plugins.
xAI validates the pin, not the behavior of the plugin, so the trust comes to you.