JetBrains plugin sources: Marketplace, disk and custom repositories

JetBrains IDEs install plugins from JetBrains Marketplace by default, but also from a local ZIP or JAR, from the command line, or from custom repositories. Each source has a different trust story, and you can restrict sources by pointing the IDE at a repository you control.

The sources, per the documentation

• Marketplace. Settings, Plugins, Marketplace, search and install.
• From disk. The gear icon, then Install Plugin from Disk, then pick the file.
• Command line. Quit the IDE, find the plugin ID on its Marketplace page, and run installPlugins followed by the ID from the IDE's bin directory.
• Custom repositories. Add the URL of an updatePlugins.xml file through Manage Plugin Repositories, or through the idea.plugin.hosts property, separating several URLs with semicolons.
• Bundled. Plugins that ship with the IDE. You can disable them but not uninstall them.

Trust story for each

Marketplace is the best default. Plugins are signed by the author and by Marketplace, as covered in plugin signing.

From disk depends entirely on where the file came from. The documentation offers it as a way to install a specific version when the latest is broken. If you do that, download from the Marketplace website or the author's official page.

Custom repositories are not re-signed by Marketplace. The IDE checks signatures against the JetBrains CA or against keys you add under Manage Plugin Certificates. Only add repositories you trust.

Restricting sources

The documentation describes the idea.plugins.host property, which points the IDE to a different default repository. Searches then cover only that repository and your custom ones. This gives an organisation a way to limit plugins to an approved list. The page itself includes no dedicated security guidance, so treat this as a mechanism, not a complete control.

Updates

You can update manually from the Installed tab, or choose Update Plugins Automatically. Updates apply on the next restart. As with any auto update, consider whether you want a plugin to change without review. The same trade offs apply as with VS Code auto update.

A team checklist

1. Decide which sources are allowed.
2. Host an approved repository if you need a list.
3. Disable unused plugins. The documentation notes that disabling unnecessary plugins can increase performance, which is a small bonus.
4. Audit regularly with an inventory.

Choosing a policy

A solo developer can use Marketplace and apply common sense. A small team can add a rule that disk installs need a second pair of eyes. A larger organisation can host an approved repository and point IDEs at it with idea.plugins.host, then review additions through a request process. Pick the lightest policy that matches the sensitivity of the code, and revisit it when the team grows.

Mistakes to avoid

Do not add a custom repository because a blog post or a chat message told you to. Do not install an older version from disk without checking why it is needed, since old versions may have known problems. And do not forget that a plugin you disabled is still on disk until you uninstall it.

Quick check

Sources

• Manage plugins, JetBrains documentation
• Plugin Signing

Last reviewed: 19 October 2026.