2026 AGENT
PLUGINS_
PACK_STD.

Lead: Pain: every agent client expects a different folder layout for extensions. Verdict: on August 6, 2026, OpenAI, Vercel, Microsoft, Amazon, and Anysphere (Cursor) published Agent Plugins 1.0.0—one vendor-neutral package for Agent Skills and MCP servers across ChatGPT, Cursor, Copilot, VS Code, and Kiro. Google joined the same day. Security, install, and trust were left out on purpose. Below: timeline, fact table, design tradeoffs, comps, controversies, a five-step checklist, and FAQ—strictly from the source brief.

1. Pain points: why packaging became the bottleneck

1. Skills teach, MCP connects—packaging still forks. Developers still rewrite manifests and folder trees for Claude Code, Cursor, and Copilot.
2. Cross-client distribution equals duplicated engineering. One capability should travel once; until now it did not.
3. Trust did not ship with the format. A month earlier, AIR showed a fake skill bypassing multiple scanners—Agent Plugins inherits that gap unchanged.

2. Timeline: this did not come out of nowhere

Date	Milestone
2023-03	OpenAI launches ChatGPT Plugins
2024-01	Plugins shut down in favor of the closed GPTs Store
2024-11	Anthropic releases MCP; later donated to the Linux Foundation
2025-03	OpenAI and Google adopt MCP
2025-10-16	Anthropic launches Agent Skills (SKILL.md) in Claude Code
2025-12-18	Agent Skills becomes an open standard at agentskills.io
2026-03	Agent Skills adoption crosses 32+ tools
2026-07-24	Agent Plugins 1.0.0 working draft
2026-08-06	Public launch with five-company TSC; Google joins as core maintainer

MCP solved connecting agents to tools. Agent Skills solved teaching reusable procedures. Agent Plugins targets the packaging and discovery gap between those layers.

3. Key facts at a glance

Item	Detail
Spec version	Agent Plugins 1.0.0 (Working Draft)
Proposal initiator	Vercel
Steering committee	Amazon (AWS), Anysphere/Cursor, Microsoft, OpenAI, Vercel; Google added Aug 6, 2026
Component types	Exactly two: Agent Skills, MCP servers
Core files	Root plugin.json; skills/; mcp.json
Clients at launch	ChatGPT and Codex, Cursor, GitHub Copilot, Kiro, VS Code
Governance	Open license, public repo agentplugins/agent-plugins-spec
Explicitly out of scope	Installation, distribution/marketplaces, permission models, sandboxing, trust/provenance, UX

Source: Vercel blog, agent-plugins.org specification, Google Developers Blog — all published August 6, 2026.

4. Why the design is deliberately narrow

4.1 One manifest, two component types

A plugin is a directory with plugin.json at the root. Skills live under skills/ and must conform to Agent Skills (SKILL.md). MCP servers are declared in mcp.json (stdio, Streamable HTTP, etc.). Unknown component types are skipped rather than rejecting the whole package. Reverse-domain namespaces (e.g. com.cursor.xxx/) keep client-private extras out of the portable core.

4.2 Hard parts were punted on purpose

v1 defines no install mechanism, no distribution protocol, no permission model, no sandboxing, no trust/provenance verification, and no UX. Google's announcement calls these deliberate omissions. Narrow scope is what let competitors agree in months. The tradeoff: "is this plugin safe?" is entirely each client's problem.

4.3 Timing tracks adoption pressure

Agent Skills alone hit 32+ tools within months of going open. At that scale, every client re-solving packaging is real duplicated cost—the actual argument for standardizing now.

5. How Agent Plugins compares to what came before

Standard	Backed by	Problem it solves	Status today
ChatGPT Plugins (2023)	OpenAI only	Third-party ChatGPT features	Discontinued 2024
MCP (2024)	Anthropic → Linux Foundation	Runtime tool/data protocol	De facto industry standard
Agent Skills (2025)	Anthropic → open standard	Reusable instruction packages	32+ tools, still expanding
Agent Plugins (2026)	Vercel + five-company TSC	Unified packaging/discovery	1.0 working draft; Google onboard

Agent Plugins sits on top of MCP and Agent Skills. It does not redefine how agents call tools or learn procedures.

6. Unresolved fights: security, skepticism, who benefits

1. Security was left on the table. AIR demonstrated fake skill brand-landingpage borrowing a ~36,000-star repo's credibility, bypassing Cisco, Nvidia, and skills.sh scanners, reaching an estimated ~26,000 agents via TOCTOU. Snyk's audit of nearly 4,000 skills found flaws in 36.8%, critical issues in 13.4%. The Agent Plugins spec adds zero provenance or attestation.
2. "Thin standard" skepticism. SST's Dax Raad said he was "very much against" it; Angie Jones welcomed portable skill packs across daily tools.
3. A shared format may reinforce incumbents. Build-once-reach-all helps small developers—but users still live inside ChatGPT, Cursor, or Copilot first.
4. No Chinese company at the table. All founding TSC members plus Google are U.S. firms, even though Alibaba, Baidu, ByteDance, and Tencent already treat MCP as core agent infrastructure with dedicated marketplaces. Timing gap—or a parallel protocol layer—remains unanswered in launch materials.

7. Five-step checklist: should you adopt now?

1. Decide if you ship across clients. Single-client extensions can stay on native Skills/MCP layouts.
2. Build the fixed layout. Root plugin.json → skills/*/SKILL.md → optional mcp.json.
3. Smoke-test day-one clients. At least Cursor and VS Code/Copilot; unknown components should skip, not fail the package.
4. Keep private extras in reverse-domain folders. Do not pollute the portable core.
5. Default to distrust. Prefer official marketplaces, verify provenance, ignore star counts—the format does not secure you.

8. FAQ

Is Agent Plugins the same thing as MCP?
No. MCP defines runtime talk to tools/data. Agent Plugins defines how you bundle MCP config (plus Skills) into one portable folder.

Does Agent Plugins replace Agent Skills?
No—it depends on it. Skills inside a plugin must still conform to Agent Skills.

Is it safe to install a random Agent Plugin?
Not automatically. Trust, provenance, and sandboxing are client-owned. Treat third-party plugins like unfamiliar npm packages.

Which tools support it now?
At launch: ChatGPT, Codex, Cursor, GitHub Copilot, Kiro, VS Code. Google committed Antigravity, Gemini CLI, and Data Agent Kit support but had not shipped at announcement time.

Why isn't Anthropic on the steering committee?
Launch materials do not list Anthropic among founding maintainers despite Agent Skills originating there. No public Anthropic statement as of the source cutoff.

9. Why it matters beyond the spec

GPT-5's first anniversary lands August 7, 2026. OpenAI spent the preceding week shipping GPT-5.6 Luna (unlimited free-tier text chats), GPT-5.6 Sol (thinking-effort slider), and Agent Plugins. Google's framing: packaging is unglamorous infrastructure that should be shared rather than reinvented five times.

Read with MCP (connection) and Agent Skills (teaching), Agent Plugins (distribution) completes a three-layer stack—and signals competition shifting from model benchmarks toward plumbing.

10. Close: packaging is standardized; compute still has to land

Agent Plugins reduces rewrite tax. It does not run your agents, host your MCP servers, or scan for malware. Cross-client validation still needs real runtimes, memory headroom, and stable background processes.

A local Windows laptop is fine for authoring. For 24/7 multi-client soak tests of Skills+MCP packages—or MLX-side toolchain checks—Apple Silicon unified memory and Metal stacks are often calmer. Practical move: park integration and soak tests on a MACGPU remote Mac mini / Mac Studio node—SSH in, meter usage, keep the laptop for writing plugins.