Agent Plugins 1.0: Open Standard for AI Agent Extensions

Agent Plugins refers to "Agent Plugins 1.0.0," a vendor-neutral open specification published on August 6–7, 2026 for distributing AI agent extensions. Its core idea is to package Agent Skills (task-specific instructions and knowledge) and MCP (Model Context Protocol) server configuration into a single folder that can be reused across multiple supporting agent clients in one common format. The spec is developed openly on GitHub at agentplugins/agent-plugins-spec.

Until now, AI agent extensions used a different format, directory structure, and setup process for every product — ChatGPT, Cursor, VS Code, GitHub Copilot, and so on. A developer wanting to ship one extension to several agent clients had to rewrite config files, restructure folders, and re-verify behavior for each product separately. Agent Plugins 1.0.0 aims to remove exactly this duplicated cost, targeting a distribution model where you "build once, use across multiple supporting agent clients."

The proposal comes from Vercel, with engineers from AWS, Anysphere (the maker of Cursor), GitHub, Microsoft, and OpenAI collaborating on the specification. The Technical Steering Committee's core maintainers include AWS, Cursor, Microsoft, OpenAI, and Vercel, joined by Google. Notably, Anthropic — the creator of both MCP and Agent Skills, the two building blocks this spec packages — has not joined this collaborative effort (Anthropic is instead adding its own plugin functionality to its Cowork product). This is not a judgment about which approach is better, just a fact worth noting: the agent-extension ecosystem is splitting into more than one track.

An Agent Plugins package is centered on a manifest file, plugin.json, placed at the root. Per the spec, only two fields are strictly required — $schema and name — everything else is optional. There are three optional elements typically added. First, a skills/ directory holding individual Agent Skills in subfolders (each skill has a SKILL.md with frontmatter fields like name and description). Second, an mcp.json file describing the MCP server(s) the plugin provides. Third, client-specific namespaced directories (e.g., com.example.client/) that let a particular agent client attach its own extra configuration without affecting how other clients behave.

A minimal plugin.json looks like this:

Crucially, installation and distribution are explicitly out of scope for the spec. Agent Plugins only defines the format a client needs to discover and load a plugin's contents — how the package actually gets to the user (registry, zip download, Git URL, etc.) is left entirely up to each client. Elements that already have client-specific shapes, such as commands, hooks, and agents, are likewise not standardized in this version.

At launch, six agent clients announced support for Agent Plugins 1.0.0: ChatGPT, Codex, Cursor, GitHub Copilot, Kiro, and VS Code. Google timed the launch with two of its own implementations, Agents CLI and Data Agent Kit.

A natural question is whether Agent Plugins is "just MCP again," or how it relates to Agent Skills alone, Claude Code's plugin system, or VS Code extensions. Each covers a different scope, so it helps to line them up.

In short, MCP and Agent Skills are each standards for a partial capability — tool connectivity and task knowledge, respectively — while Claude Code plugins and VS Code extensions are product-specific extension package formats. Agent Plugins 1.0.0 sits in between: it wraps the two existing building blocks, MCP and Agent Skills, into a single distributable unit that can be shipped in the same shape across multiple clients. It is best understood not as a replacement for those technologies but as a higher-level container format that bundles them together.

Agent Plugins 1.0.0 is still a Working Draft, and several elements that matter in practice are either unspecified as of this writing or explicitly left out of scope as future work.

- Permission model (controlling how much access a plugin can have)
- Sandboxing (isolating the execution environment)
- Signature verification (checking a plugin's integrity and origin)
- Secrets management (handling API keys and other sensitive data)
- Marketplace/registry (a common place to discover and obtain plugins)

Since v1.0.0 is still a Working Draft, this isn't the moment for a large-scale migration. That said, if your organization already maintains separate MCP servers or Agent Skills implementations for multiple products, three moves are worth making early. First, separate your existing MCP server configs and Agent Skills SKILL.md files from product-specific directory structures now, so wrapping them in a plugin.json later is cheaper. Second, once the agent clients you actually use (ChatGPT, Cursor, VS Code, GitHub Copilot, etc.) announce support, pilot with non-sensitive plugins first, and keep permission and secrets handling governed by your own internal policy — since the spec has no security mechanisms yet, controlling execution privileges remains the user's responsibility. Third, keep accumulating your organization's MCP and Agent Skills know-how as a durable asset. Related background is available here:

- MCP spec update, July 28, 2026 for the latest MCP specification developments
- Claude Code MCP integration guide for MCP implementation patterns on an existing client
- EmDash's AI integration features for a real example combining MCP and Agent Skills

As the spec matures from Working Draft toward a finalized version, proposals for a permission model and a registry are likely to follow — an area worth tracking going forward.