Skills + MCP in one folder · plugin.json · security left out · six-step runbook
On August 6, 2026, OpenAI, Vercel, Microsoft, Amazon, and Cursor's maker Anysphere jointly published Agent Plugins 1.0.0: a vendor-neutral package format that lets a single AI agent extension — bundling Agent Skills and MCP servers — run across ChatGPT, Cursor, GitHub Copilot, VS Code, and Kiro without a rewrite. Google joined the steering committee the same day. If you ship extensions across clients — or worry what a thin packaging standard leaves out — this piece gives you a timeline, fact table, predecessor comparison, six-step runbook, and the security fight the launch materials mostly skipped. As of 2026-08-07
Every agent client currently expects a different folder layout for extensions. Agent Plugins does not invent a new capability — it standardizes the container. The launch settles almost nothing about security or trust; those questions were deliberately left out of scope.
March 2023: OpenAI launches ChatGPT Plugins, an early open third-party extension model.
January 2024: OpenAI shuts down Plugins in favor of the closed GPTs Store.
November 2024: Anthropic releases MCP to standardize how agents connect to external tools and data; later donated to the Linux Foundation.
March 2025: OpenAI and Google both adopt MCP, cementing it as the de facto tool-connection layer.
October 16, 2025: Anthropic launches Agent Skills inside Claude Code as SKILL.md folders; December 18 they spin out at agentskills.io; Microsoft and OpenAI ship support within 48 hours.
2026: March — Skills adoption crosses 32 tools; July 24 — Agent Plugins 1.0.0 as a working draft; August 6 — public launch with a five-company steering committee; Google joins as a core maintainer the same day.
Cross-client extension work still hits the same five frictions:
Skills teach, packaging does not travel: Agent Skills solve reusable procedures; each client still invents its own discovery layout.
MCP connects, configs stay sticky: Tool wiring works, but configs are often locked to one IDE or agent product.
Build once, package N times: The same extension needed separate packaging for ChatGPT, Cursor, Copilot, and VS Code.
Narrow scope ≠ low risk: Install, sandbox, and provenance stay client-owned — the hard safety questions are explicit omissions.
Fake skills already shipped: One month before launch, AIR demoed a malicious Agent Skill that bypassed major scanners; Snyk found flaws in 36.8% of nearly 4,000 published skills.
| Item | Detail |
|---|---|
| Spec version | Agent Plugins 1.0.0 (status: Working Draft) |
| Proposal initiator | Vercel |
| Steering committee | Amazon (AWS), Anysphere/Cursor, Microsoft, OpenAI, Vercel; Google added Aug 6, 2026 |
| Component types covered | Exactly two: Agent Skills, MCP servers |
| Core files | Root plugin.json; skills/ directory; mcp.json for MCP server config |
| Clients at launch | ChatGPT and Codex, Cursor, GitHub Copilot, Kiro, VS Code |
| Governance | Open license, public GitHub repo (agentplugins/agent-plugins-spec); no single company controls the roadmap |
| Explicitly out of scope | Installation, distribution/marketplaces, permission models, sandboxing, trust/provenance verification, UX |
Source: Vercel blog, agent-plugins.org specification, Google Developers Blog — all published August 6, 2026.
| Standard | Backed by | Problem it solves | Status today |
|---|---|---|---|
| ChatGPT Plugins (2023) | OpenAI only | Let third parties add ChatGPT functionality | Discontinued 2024, replaced by the closed GPTs Store |
| MCP (2024) | Anthropic, later Linux Foundation | Protocol for agents to call external tools/data | De facto industry standard; adopted by OpenAI, Google |
| Agent Skills (2025) | Anthropic, spun out as open standard | Packaging reusable instructions/workflows for agents | 32+ tools support it, still expanding |
| Agent Plugins (2026) | Vercel + 5-company steering committee | Unified packaging/discovery for Skills + MCP servers | Just launched as 1.0 working draft; Google already onboard |
Agent Plugins is not competing with MCP or Agent Skills — it sits on top of both, solving distribution friction rather than redefining how agents call tools or learn procedures.
A plugin is a directory with a plugin.json manifest at its root. Skills live in skills/ and must conform to Agent Skills. MCP servers are declared in mcp.json, supporting stdio, Streamable HTTP, or legacy HTTP+SSE. Use this runbook from inventory to distribution:
Inventory what you already ship: List Agent Skills and MCP servers that need to run on ChatGPT, Cursor, Copilot, or VS Code without a rewrite.
Normalize Skills first: Ensure each skill folder has a compliant SKILL.md and frontmatter. Unknown or invalid components are skipped — the whole plugin is not rejected.
Add the root manifest: Create plugin.json declaring which Agent Plugins spec version the package targets.
Declare MCP servers: Put transports and endpoints in mcp.json, matching what your target clients actually support.
Isolate client-private extras: Use reverse-domain namespaces (for example com.cursor.xxx/) so proprietary bits do not leak into the portable core.
Security review before distribute: The spec defines no install, sandbox, or provenance checks. Prefer official marketplaces, verify source, and never trust star counts alone.
my-agent-plugin/
├── plugin.json
├── mcp.json
└── skills/
└── example-skill/
└── SKILL.md
Note: At launch: ChatGPT, Codex, Cursor, GitHub Copilot, Kiro, and VS Code. Google committed support across Antigravity, Gemini CLI, and its Data Agent Kit, represented on the TSC by DeepMind engineer Kevin Hou.
The manifest declares which spec version a package targets; components live in fixed, predictable locations. A client that does not recognize a component type simply skips it rather than rejecting the whole plugin — keeping the format forward-compatible as new component types get added later.
The spec text is blunt: v1 defines no install mechanism, no distribution protocol, no permission model, no sandboxing requirements, no trust or provenance verification, and no user experience. Google's own announcement calls these deliberate omissions. A narrow scope is what let five competing companies agree in months. The tradeoff: whether a specific plugin is safe to run is pushed entirely onto each client.
Agent Skills alone had already spread to 32+ tools within five months of going open. At that scale, every client re-solving packaging independently stops being a minor inefficiency and starts being real duplicated engineering cost.
Security timing is uncomfortable: One month before launch, AIR demonstrated a fake Agent Skill called brand-landingpage that borrowed credibility from a 36,000-star repository, passed scanning at Cisco, Nvidia, and skills.sh, and reached an estimated 26,000 deployed agents — some on corporate accounts — via a classic TOCTOU gap. Separately, Snyk's audit of nearly 4,000 published skills found security flaws in 36.8%, with 13.4% containing critical-severity issues. Agent Plugins contains zero provisions for provenance verification or runtime attestation.
Competitive energy in AI is shifting from model benchmarks toward the unglamorous plumbing underneath them.
A shared package format lowers distribution friction, but install trust, sandboxing, and 24/7 agent-host stability stay outside the spec. Laptops are a poor always-on host for multi-client agent stacks; VMs add performance loss and licensing risk. For a more stable production environment suited to iOS CI/CD and AI agent automation, VpsMesh Mac Mini cloud rental is usually the better fit: physical Apple Silicon, root access, and predictable monthly cost that pairs with Cursor, Codex, or Claude Code as a "standard plugin package + always-on host" setup. See Mac Mini M4 rental pricing and the help center.
Sources: Vercel "Introducing Agent Plugins" and Changelog; agent-plugins.org Spec 1.0.0; Google Developers Blog; The Next Web / Virtualization Review; Anthropic Agent Skills updates; AIR / Snyk ToxicSkills / Help Net Security; 36Kr and Alibaba Cloud developer coverage of MCP in China; OpenAI GPT-5.6 Sol blog and TechCrunch. Compiled as of 2026-08-07 — verify latest details before publishing.
No. MCP is a protocol that defines how an agent talks to an external tool or data source at runtime. Agent Plugins is a packaging format that defines how you bundle an MCP server's configuration (along with Agent Skills) into one portable folder that different agent clients can discover. MCP and Agent Skills still define the actual behavior; Agent Plugins just standardizes how they are shipped.
No — it depends on it. Any skill inside an Agent Plugins package must conform to the existing Agent Skills specification (SKILL.md format, frontmatter, directory layout). Agent Plugins adds a manifest and folder convention on top so that a skill or an MCP server can travel between clients without separate packaging for each one.
Not automatically. The specification explicitly does not define trust, provenance, or sandboxing — that is left entirely to whichever client you are using. Given that a fake Agent Skill bypassed Cisco, Nvidia, and skills.sh scanners and reached roughly 26,000 agents in a documented 2026 test, treat any third-party plugin the way you would treat an unfamiliar npm package. For always-on agent hosts, see Mac Mini M4 rental pricing.
At launch (August 6, 2026): ChatGPT, Codex, Cursor, GitHub Copilot, Kiro, and VS Code. Google has committed to adding support across Antigravity, Gemini CLI, and its Data Agent Kit, but had not shipped it at announcement time.
The public announcements from Vercel, Google, and the specification site do not list Anthropic among the founding maintainers, despite Agent Skills — one of the two component types Agent Plugins packages — originating at Anthropic. None of the launch materials explain the omission, and Anthropic has not issued a public statement on Agent Plugins as of this writing. Deployment notes: help center.