Maven has some conventions about it, even if you do not configure anything in the project POM or in your settings.xml.
When you invoke a plugin that way in the command line, Maven tries to find the plugin by adding one of the following groupId's:
- org.apache.maven.plugins
- org.codehaus.mojo
For the artifactId, it also tries to complete the "prefix" you specify (here tomcat) with one of these:
- maven-${prefix}-plugin: (convetion for official plugins) -> maven-tomcat-plugin
- ${prefix}-maven-plugin: (convention for 3rd party plugins) -> tomcat-maven-plugin
And for the version, it just tries to get the latest available.
In your particular case, there is a match for the defaults: org.codehaus.mojo:tomcat-maven-plugin:1.1 (or any other available version).
A bit more detail here about the mechanics, and how you can also use these conventions for your own groupId's.