External plugins from marketplace load as MCP servers even when enabledPlugins is empty

Description

External plugins from the official marketplace directory (~/.claude/plugins/marketplaces/claude-plugins-official/external_plugins/) appear to be loaded as MCP servers even when enabledPlugins is {} in settings.json and installed_plugins.json has no plugins.

Steps to Reproduce

1. Have "enabledPlugins": {} in ~/.claude/settings.json
2. Have "plugins": {} in ~/.claude/plugins/installed_plugins.json
3. The marketplace repo is auto-cloned to ~/.claude/plugins/marketplaces/claude-plugins-official/ via known_marketplaces.json
4. Start a new Claude Code session
5. The GitHub MCP server (and possibly others) from external_plugins/ appears to be loaded despite nothing being enabled or installed

Expected Behavior

When enabledPlugins is empty and no plugins are installed, no external plugin MCP servers should be loaded.

Actual Behavior

The GitHub MCP server from external_plugins/github/.mcp.json is visible/loaded in new sessions.

Workaround

Empty known_marketplaces.json to {} and delete the marketplaces/ directory to prevent auto-cloning.

Environment

• Platform: Linux (Arch)
• Claude Code: latest