General

Installation

Install the ccpp CLI from the official signed release, add the ccpp marketplace to Claude Code and set your first profile.

ccpp has two parts to install: the ccpp binary, and the Claude Code plugins that route hooks to it. Both come from the official release host, https://s3.ccpp.dev/ccpp-public. One version covers the CLI and every plugin.

Requirements


System	Linux x64. The installer also knows Linux arm64 and macOS, but no release ships those builds yet. Windows is not supported.
Tools	`curl` and OpenSSL 3 (the installer checks the release signature with `openssl`).
Claude Code	2.1.224 or later: the marketplace is a single `marketplace.json` with archive sources.

1. Install the CLI

curl -fsSL https://s3.ccpp.dev/ccpp-public/install.sh | sh

The installer reads the version of the stable channel, then, before installing anything:

checks the Ed25519 signature of that version's manifest against the public key written in the script;
downloads the binary for your platform and checks its size and SHA-256 against the signed manifest;
runs the binary once.

Only then does it move it to ~/.local/bin/ccpp. Any failed check stops the install. Add ~/.local/bin to your PATH if the installer says so.

Variable	Default
`CCPP_INSTALL_DIR`	`~/.local/bin`	Where the binary goes.
`CCPP_VERSION`	the channel's version	Install this version instead, for instance `0.6.0`.
`CCPP_CHANNEL`	`stable`	`beta` for pre-releases (`0.7.0-rc.1`), once one is published.

curl -fsSL https://s3.ccpp.dev/ccpp-public/install.sh | CCPP_INSTALL_DIR=/usr/local/bin sh

The script is served by the host whose files it verifies: it protects you from a tampered binary, not from a tampered host. To review it first, download it, read it, then run sh install.sh.

2. Add the plugins to Claude Code

claude plugin marketplace add https://s3.ccpp.dev/ccpp-public/marketplace.json
claude plugin install cpo@ccpp

The marketplace is named ccpp. Each plugin entry points to a ZIP archive of the release, pinned by its SHA-256, which Claude Code checks. No settings.json edit is needed: Claude Code registers the plugin's hooks.

The archives hold no binary: the plugin's launcher runs the ccpp found on PATH. Without it, hooks fail open and tell you how to install it; a missing binary never blocks Claude Code. See How plugins work.

3. Check the install

ccpp about     # version, build and the plugins compiled into this binary
ccpp doctor    # the environment ccpp depends on; exit 1 when a check fails

4. Set your first profile

Profiles are downloaded from ccpp.dev, which needs an account on the builder or team plan. Log this machine in, then set a profile from inside Claude Code:

ccpp login
! ccpp cpo profile set secrets-baseline
ccpp cpo view

Browse the profiles at ccpp.dev/marketplace/profiles, or write your own policies: CPO quick start.

Updates

The CLI and the plugins update separately.

ccpp update --check                     # the version available on your channel; downloads nothing
ccpp update                             # install it
ccpp update --restore                   # put back the previous binary (ccpp.previous)
claude plugin marketplace update ccpp   # refresh the catalog
claude plugin update cpo@ccpp           # install the plugin version it lists

ccpp update checks the same signature, size and SHA-256 as the installer, and leaves the installed binary untouched when a check fails. Claude Code does not auto-update third-party marketplaces unless you enable it. See ccpp update for rollbacks and downgrades.

From source

Contributors can compile ccpp from a checkout of the repository instead; such a binary updates with ccpp update --mode source (pull, install, recompile). Official releases are the supported install.

Edit this page on GitHub