Published August 6, 2026 · Spec 1.0.0 Working Draft · Google joined as core maintainer · Eve of GPT-5's first anniversary
Bottom line: On August 6, 2026, OpenAI, Vercel, Microsoft, Amazon, and Cursor's maker Anysphere jointly published Agent Plugins 1.0.0: a vendor-neutral package format that lets a single AI agent extension — bundling Agent Skills and MCP servers — run across ChatGPT, Cursor, GitHub Copilot, VS Code, and Kiro without a rewrite. Google joined the steering committee the same day. The launch lands one day before GPT-5's first anniversary, and it settles almost nothing about security or trust — those questions were deliberately left out of scope.
Skills and MCP matured separately from packaging: teaching agents and connecting tools have standards; every client still expected a different folder layout
"Build once, run everywhere" was still a slogan: the same extension often needed a separate package for ChatGPT, Cursor, and Copilot
Security is explicitly out of scope: install, distribution, permissions, sandboxing, and provenance stay client-owned — malicious Skills already landed in the wild
Governance is all U.S. companies: Chinese platforms that already ship MCP marketplaces are absent from the founding TSC list
Every agent client currently expects a different folder layout for extensions. A developer building a coding-assistant tool, a data connector, or a reusable workflow has had to package it once for Claude Code, again for Cursor, again for VS Code Copilot. Agent Plugins doesn't invent a new capability — it standardizes the container. A plugin is a directory with a plugin.json manifest at its root. If it ships skills, they live in a skills/ folder and must conform to the existing Agent Skills specification. If it ships MCP servers, they're declared in mcp.json, supporting stdio, Streamable HTTP, or legacy HTTP+SSE transports. Any compliant client can discover and load both from the same folder, with a reverse-domain namespace mechanism reserved for client-specific extras that don't leak into the portable core.
Vercel initiated the proposal; representatives from AWS, Anysphere (Cursor), GitHub, Microsoft, and OpenAI shaped the 1.0 spec together. The initial Technical Steering Committee lists Amazon, Cursor, Microsoft, OpenAI, and Vercel as core maintainers. Google added itself to that group on launch day, represented by DeepMind engineer Kevin Hou, and confirmed it's building support into Antigravity, Gemini CLI, and its Data Agent Kit.
| Date | Milestone |
|---|---|
| March 2023 | OpenAI launches ChatGPT Plugins, an early open third-party extension model |
| January 2024 | OpenAI shuts down Plugins in favor of the closed GPTs Store |
| November 2024 | Anthropic releases MCP; later donated to the Linux Foundation |
| March 2025 | OpenAI and Google both adopt MCP |
| October 16, 2025 | Anthropic launches Agent Skills inside Claude Code (SKILL.md) |
| December 18, 2025 | Agent Skills spins out at agentskills.io; Microsoft and OpenAI ship support within 48 hours |
| March 2026 | Agent Skills adoption crosses 32 tools, including Gemini CLI, JetBrains Junie, and AWS Kiro |
| July 24, 2026 | Agent Plugins 1.0.0 published as a working draft |
| August 6, 2026 | Public launch with a five-company steering committee; Google joins as a core maintainer the same day |
The pattern: MCP solved connecting agents to tools. Agent Skills solved teaching agents reusable procedures. Neither solved how those two component types get packaged and discovered consistently across clients — that gap is what Agent Plugins targets.
| Item | Detail |
|---|---|
| Spec version | Agent Plugins 1.0.0 (status: Working Draft) |
| Proposal initiator | Vercel |
| Steering committee | Amazon (AWS), Anysphere/Cursor, Microsoft, OpenAI, Vercel; Google added Aug 6, 2026 |
| Component types covered | Exactly two: Agent Skills, MCP servers |
| Core files | Root plugin.json manifest; skills/ directory; mcp.json for MCP server config |
| Clients supporting it at launch | ChatGPT and Codex, Cursor, GitHub Copilot, Kiro, VS Code |
| Governance | Open license, public GitHub repo (agentplugins/agent-plugins-spec); no single company controls the roadmap |
| Explicitly out of scope | Installation, distribution/marketplaces, permission models, sandboxing, trust/provenance verification, UX |
Source: Vercel blog, agent-plugins.org specification, Google Developers Blog — all published August 6, 2026.
The manifest declares which spec version a package targets; components live in fixed, predictable locations. A client that doesn't recognize a component type simply skips it rather than rejecting the whole plugin — a design choice that keeps the format forward-compatible as new component types get added later.
The spec text is blunt about this: v1 "defines no install mechanism, no distribution protocol, no permission model, no sandboxing requirements, no trust or provenance verification, and no user experience." Those aren't oversights — Google's own announcement calls them out as deliberate omissions. A narrow scope is what let five competing companies agree on something in months rather than years. The tradeoff: the question that actually matters for safety — is this specific plugin safe to run — is pushed entirely onto each client.
Agent Skills alone had already spread to 32+ tools within five months of going open. At that scale, every client re-solving the same packaging problem independently stops being a minor inefficiency and starts being real duplicated engineering cost — which is the actual argument for standardizing now rather than earlier.
| Standard | Backed by | Problem it solves | Status today |
|---|---|---|---|
| ChatGPT Plugins (2023) | OpenAI only | Let third parties add ChatGPT functionality | Discontinued 2024, replaced by the closed GPTs Store |
| MCP (2024) | Anthropic, later Linux Foundation | Protocol for agents to call external tools/data | De facto industry standard; adopted by OpenAI, Google |
| Agent Skills (2025) | Anthropic, spun out as open standard | Packaging reusable instructions/workflows for agents | 32+ tools support it, still expanding |
| Agent Plugins (2026) | Vercel + 5-company steering committee | Unified packaging/discovery for Skills + MCP servers | Just launched as 1.0 working draft; Google already onboard |
Agent Plugins isn't competing with MCP or Agent Skills — it sits on top of both, solving distribution friction rather than redefining how agents call tools or learn procedures.
Security was left on the table on purpose: One month before launch, security firm AIR demonstrated a fake Agent Skill (brand-landingpage) that borrowed credibility from a 36,000-star repository, passed scanning at Cisco, Nvidia, and skills.sh, and reached an estimated 26,000 deployed agents via a TOCTOU gap. Separately, Snyk's audit of nearly 4,000 published skills found flaws in 36.8%, with 13.4% containing critical-severity issues. Agent Plugins' specification contains zero provisions for provenance verification.
Not every developer is convinced: Dax Raad (SST) said he was "very much against" it, calling it "a thin standard." Developer advocate Angie Jones took the opposite view — one way to carry skills between tools she already uses.
A shared format doesn't obviously favor small players: Building once for every major client sounds open; it may also make it easier for incumbents with existing user bases to absorb third-party extensions at zero switching cost.
No Chinese company is at the table: All five founding TSC members plus Google are U.S. companies. Alibaba Cloud's Model Studio and Baidu's Qianfan already ship MCP marketplaces; Alibaba, Baidu, ByteDance, and Tencent treat MCP as core agent infrastructure. None appear on the Agent Plugins governance list — timing gap or early signal of parallel protocol layers remains open.
Confirm whether your extension already ships Skills, MCP servers, or both; reorganize into plugin.json + skills/ + mcp.json
Smoke-test discovery/load in Cursor, VS Code Copilot, and ChatGPT/Codex; note which components get skipped
Park proprietary extras in reverse-domain namespaces so they don't pollute the portable core
Before installing third-party packages, use official marketplaces and provenance checks — Spec v1 will not save you
When you need a graphical macOS session to compare clients and permission prompts, rent a remote Mac instead of buying hardware
No. MCP is a protocol that defines how an agent talks to an external tool or data source at runtime. Agent Plugins is a packaging format that defines how you bundle an MCP server's configuration (along with Agent Skills) into one portable folder that different agent clients can discover. MCP and Agent Skills still define the actual behavior; Agent Plugins just standardizes how they're shipped.
No — it depends on it. Any skill inside an Agent Plugins package must conform to the existing Agent Skills specification (SKILL.md format, frontmatter, directory layout). Agent Plugins adds a manifest and folder convention on top so that a skill (or an MCP server) can travel between clients without separate packaging for each one.
Not automatically. The specification explicitly does not define trust, provenance, or sandboxing — that's left entirely to whichever client you're using. Given that a fake Agent Skill bypassed Cisco, Nvidia, and skills.sh scanners and reached roughly 26,000 agents in a documented 2026 test, treat any third-party plugin the way you'd treat an unfamiliar npm package: check the source, don't trust star counts alone, and prefer official marketplaces with your client's own vetting layer on top.
At launch (August 6, 2026): ChatGPT, Codex, Cursor, GitHub Copilot, Kiro, and VS Code. Google has committed to adding support across Antigravity, Gemini CLI, and its Data Agent Kit, but hadn't shipped it at announcement time.
The public announcements from Vercel, Google, and the specification site don't list Anthropic among the founding maintainers, despite Agent Skills — one of the two component types Agent Plugins packages — originating at Anthropic. None of the launch materials explain the omission, and Anthropic hasn't issued a public statement on Agent Plugins as of this writing. It's worth watching whether Anthropic adopts the format for its own products going forward.
A shared package format reduces rewrite tax across clients, but Spec v1 explicitly leaves install, permissions, and trust to each product — so you still need real discovery, load, permission-prompt, and supply-chain checks. Buying multiple machines just to compare ChatGPT, Cursor, and VS Code is usually the wrong trade. A clearer path: use a macOS environment you can shut off, run graphical smoke tests, and stop when the project ends. Rent a VNCMac remote Mac, wire Cursor / OpenClaw into a VNC session, and validate Skills + MCP packaging across clients by the hour. Start with Mac plans; also see our guides on Agent Skills and building an MCP server.
Sources: Vercel Blog "Introducing Agent Plugins" and Changelog; agent-plugins.org Spec 1.0.0; Google Developers Blog; The Next Web / Virtualization Review; Anthropic Agent Skills posts; AIR / Snyk / Help Net Security; 36Kr and Alibaba Cloud developer coverage of MCP in China; OpenAI GPT-5.6 Sol updates. Compiled as of August 7, 2026 — verify before republishing.