pluginDir
/ pluginUrl (string[], optional): Load Claude plugins from local directories or URLs. Non-empty values are high-risk managed inputs.
How to use it
pluginDir is exposed by the Llm Cli Gateway MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the pluginDir tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.
Install Llm Cli Gateway
npm install -g llm-cli-gatewayOther tools in Llm Cli Gateway (39)
(string[], optional): Additional workspace directories. A non-empty value is a high-risk managed input.
(string, optional): Named sub-agent to run as. A non-empty value is a high-risk managed input because it can change tool and permission posture.
(string, optional): Inline agent definitions JSON. A non-empty value is a high-risk managed input for the same reason.
(string[], optional): Restrict Claude tools to this allow-list. A non-empty allow-list is a high-risk managed input because it can change the tool posture.
(string, optional): "legacy" (default) or "mcpmanaged". Managed mode uses acceptEdits by default and forces strictMcpConfig:true, so Claude uses only the gateway-generated MCP configuration. A direct full-permission request requires all of an explicit caller request, an approval-manager approval, an
ask one provider through the simplified surface.
(boolean, optional): Start Claude in minimal mode, skipping local customization discovery. true is a high-risk managed input.
Execute a Claude Code request with optional session management.
check whether providers agree with a claim.
(boolean, optional): Continue the active session. It has the same managed-approval requirement as sessionId. Because Claude --continue selects by cwd, it requires workingDir or a registered workspace selected explicitly, through caller-owned session metadata, or by the configured default. That works
(boolean, optional): Always create a new session
(boolean, optional): Deprecated, maps to permissionMode: "bypassPermissions"; permissionMode wins when both are set. It is a direct full-permission request under mcpmanaged.
(string, optional): Write Claude debug output to a file. A non-empty path is a high-risk managed input.
(string[], optional): Explicitly deny listed Claude tools
(string, optional): Reasoning effort (lowmediumhighxhighmax)
(boolean, optional): Trim dynamic system prompt sections
(string, optional): Auto-fallback model when the default is overloaded
(boolean, optional): Fork the resumed session instead of appending to it. Under mcpmanaged, it is a high-risk native-fork input that requires approval and LLMGATEWAYAPPROVALALLOWBYPASS=1, but stays bounded.
and jobresult: poll and collect validation job outputs.
(string, optional): JSON Schema literal constraining structured output
list the models each provider CLI exposes through the simplified surface.
(number, optional): Budget cap in USD for the request
(integer, optional): Agent-loop turn cap
(string, optional): Model name or alias (use listmodels for available values; supports latest)
(boolean, optional): Ephemeral session (not persisted to disk)
(string, optional): Output format (textjsonstream-json), default: stream-json — the gateway parses NDJSON usage events for token/cost observability; override to text only when you want unparsed stdout
(string, optional): Claude permission mode (defaultacceptEditsplanautodontAskbypassPermissions); preferred over dangerouslySkipPermissions. bypassPermissions is a direct full-permission request under mcpmanaged.
(string, optional): The prompt to send (1-100,000 chars). Exactly one of prompt or promptParts is required (mutually exclusive)
challenge a plan, answer, or document for risks and failure modes.
capture one complete Git review artifact, fence repository
(boolean, optional): Start Claude with local customizations disabled, including CLAUDE.md, skills, plugins, hooks, MCP, commands, and agents. true is a high-risk managed input.
ask one provider to review an answer.
(string, optional): Specific session ID to use. Under mcpmanaged, native continuation is a high-risk input because it can inherit an unverified provider posture; it requires approval and LLMGATEWAYAPPROVALALLOWBYPASS=1, but does not select a full-permission profile.
/ settings / tools (optional): Setting sources to load, settings JSON path/literal, built-in tool restriction. Non-empty setting sources, settings, or tool selections are high-risk managed inputs.
run an explicit judge model after provider results have
/ appendSystemPrompt (string, optional): Replace or extend the system prompt. A non-empty value is a high-risk managed input.
/ appendSystemPromptFile (string, optional): Replace or extend the system prompt from a file. A non-empty file path is a high-risk managed input.
ask two or more providers to independently validate a question.
retrieve the canonically hashed immutable receipt of a terminal cross-LLM validation run by validationId (returns minted pending verificationfailed expiredunminted notfound, own-or-not-found). verificationfailed means a stored receipt exists but disagrees with its durable run, which is a defect to i