In the same 48 hours in early August, the two coding agents most builders actually run made "plugin" a first-class install unit — and picked opposite defaults. Codex CLI 0.147.0 (Aug 7) bets on a searchable catalog. Claude Code v2.1.224 bets on a raw ZIP over HTTPS with a checksum. If you're publishing an extension, that difference decides two things: who finds it, and how they trust it.

Here's the fast answer, then the reasoning.

The decision in one line#

Neither is "better." They optimize for opposite things, and which you want depends on whether your problem is reach or trust.

What Codex shipped: a catalog#

Codex 0.147.0's headline line is: "Install portable Agent Plugins and search across local, personal, workspace, and remote plugin catalogs." That's a registry-shaped, discovery-first model. A plugin isn't just a file you point at — it's an entry that can be found and shared across four scopes, from your own machine up to a remote catalog your whole workspace pulls from.

Codex paired that with a migration ramp: the same release "imports Cursor-managed skills and synchronizes changes to imported Claude and Cursor conversations without creating duplicates." So an extension you already built elsewhere can come along — a continuation of the one-command import that quietly deleted switching cost a few weeks earlier. The strategic read is consistent: Codex wants to be the place your plugins live and get discovered.

What Claude Code shipped: a verifiable artifact#

Claude Code v2.1.224's plugin line reads: "Added archive plugin source: install plugins from a zip over HTTPS without git or npm, with optional SHA-256 pinning." That's a distribution-first, supply-chain-conscious model. You host the artifact wherever you like — an S3 bucket, a release page, your own CDN — and the optional hash pin means the installer verifies the ZIP is byte-for-byte what you published. A swapped or tampered archive fails.

That primitive matters because installing third-party agent extensions is exactly where agent-skill supply-chain risk lives: a plugin runs with your agent's permissions. A pinned hash is the cheapest defense there is — you approve one artifact, and you can prove it never changed underneath you. Claude Code isn't optimizing for a store; it's optimizing for you controlling and verifying the bytes you install.

The catch: they're not portable#

The honest limitation for anyone publishing: a Codex Agent Plugin is not a Claude Code archive plugin. There is no shared format. Codex's Cursor/Claude import moves your work in, but it's a one-way migration, not a two-way standard — the portability goes one direction, into Codex. If you target both agents, plan to maintain two manifests.

The durable move is the same one that survives every one of these format churns: keep the actual logic in a plain, agent-neutral core — a SKILL.md-style body of instructions and scripts — and treat each agent's plugin manifest as a thin wrapper around it. The wrappers are cheap to duplicate; the logic isn't. Build it that way and "Codex vs Claude Code plugins" stops being a bet you have to place and becomes two shipping labels on the same box.

If you're still deciding which agent to standardize your team on before you worry about extensions, that's the broader CLI comparison; and if you run more than one, note both of these releases also landed in the same permission-hardening week — worth a version bump regardless of which plugin model you pick.