Plugin marketplace validates MCP env vars for plugins that aren't installed

Bug Description

Claude Code validates environment variables referenced in .mcp.json files for all plugins in a marketplace registry, even when those plugins are not installed or enabled. This causes persistent errors that cannot be dismissed.

Steps to Reproduce

1. Have the official claude-plugins-official marketplace registered (default)
2. Do not install the github plugin
3. Open /plugin → Errors tab

Expected Behavior

Plugins that are not installed/enabled should not have their MCP configs validated. The error should only appear if the user explicitly installs/enables the github plugin.

Actual Behavior

The Errors tab permanently shows:

github
  Invalid MCP server config for 'github': Missing environment variables: GITHUB_PERSONAL_ACCESS_TOKEN
  Check MCP configuration in .mcp.json or manifest

This error persists across /reload-plugins and even after explicitly uninstalling the plugin via /plugin.

Root Cause

The file at ~/.claude/plugins/marketplaces/claude-plugins-official/external_plugins/github/.mcp.json contains:

{
  "github": {
    "type": "http",
    "url": "https://api.githubcopilot.com/mcp/",
    "headers": {
      "Authorization": "Bearer ${GITHUB_PERSONAL_ACCESS_TOKEN}"
    }
  }
}

Claude Code appears to validate ${GITHUB_PERSONAL_ACCESS_TOKEN} at marketplace load time rather than at plugin install/enable time.

Environment

• macOS (Darwin 25.3.0)
• Claude Code (latest as of 2026-03-18)

Workaround

Delete the marketplace file manually:

rm ~/.claude/plugins/marketplaces/claude-plugins-official/external_plugins/github/.mcp.json

(File returns on next marketplace sync.)