What actually happened with Agent Plugins on August 6, 2026
On August 6, 2026, OpenAI, Vercel, Microsoft, Amazon, and Cursor's maker Anysphere jointly published Agent Plugins 1.0.0: a vendor-neutral package format that lets a single AI agent extension — bundling Agent Skills and MCP servers — run across ChatGPT, Cursor, GitHub Copilot, VS Code, and Kiro without a rewrite. Google joined the steering committee the same day. The launch lands one day before GPT-5's first anniversary, and it settles almost nothing about security or trust — those questions were deliberately left out of scope.
Every agent client currently expects a different folder layout for extensions. Agent Plugins doesn't invent a new capability — it standardizes the container. Agent Plugins is the third layer in an 18-month stack, not a standalone invention:
March 2023 · ChatGPT Plugins: OpenAI launches an early open third-party extension model for ChatGPT.
January 2024 · Closed store: OpenAI shuts down Plugins in favor of the closed GPTs Store.
November 2024 · MCP: Anthropic releases Model Context Protocol to standardize how agents connect to external tools and data; later donated to the Linux Foundation.
2025 · Skills go open: OpenAI and Google adopt MCP (March). Anthropic launches Agent Skills in Claude Code on Oct 16; on Dec 18 Skills spin out at agentskills.io, with Microsoft and OpenAI shipping support within 48 hours.
2026 · Packaging layer: Agent Skills adoption crosses 32 tools by March. Agent Plugins 1.0.0 appears as a working draft on July 24; public launch with a five-company TSC on August 6, Google joining as a core maintainer the same day.
Note: MCP solved connecting agents to tools. Agent Skills solved teaching agents reusable procedures. Neither solved how those two component types get packaged and discovered consistently across clients — that gap is what Agent Plugins targets.
Agent Plugins 1.0 key facts: TSC, components, and out-of-scope items
Put what the spec defines next to what it refuses to define. Source: Vercel blog, agent-plugins.org specification, Google Developers Blog — all published August 6, 2026.
| Item | Detail |
|---|---|
| Spec version | Agent Plugins 1.0.0 (status: Working Draft) |
| Proposal initiator | Vercel |
| Steering committee | Amazon (AWS), Anysphere/Cursor, Microsoft, OpenAI, Vercel; Google added Aug 6, 2026 |
| Component types covered | Exactly two: Agent Skills, MCP servers |
| Core files | Root plugin.json manifest; skills/ directory; mcp.json for MCP server config |
| Clients supporting it at launch | ChatGPT and Codex, Cursor, GitHub Copilot, Kiro, VS Code |
| Governance | Open license, public GitHub repo (agentplugins/agent-plugins-spec); no single company controls the roadmap |
| Explicitly out of scope | Installation, distribution/marketplaces, permission models, sandboxing, trust/provenance verification, UX |
Agent Plugins standardizes the container, not whether a given package is safe to run.
Why the Agent Plugins design is deliberately narrow
A plugin is a directory with a plugin.json manifest at its root. If it ships skills, they live in a skills/ folder and must conform to the existing Agent Skills specification. If it ships MCP servers, they're declared in mcp.json, supporting stdio, Streamable HTTP, or legacy HTTP+SSE transports. Any compliant client can discover and load both from the same folder, with a reverse-domain namespace reserved for client-specific extras.
It standardizes the container, not the contents: The manifest declares which spec version a package targets; components live in fixed, predictable locations. A client that doesn't recognize a component type simply skips it rather than rejecting the whole plugin — keeping the format forward-compatible.
It explicitly punts on the hard parts: The spec text is blunt: v1 "defines no install mechanism, no distribution protocol, no permission model, no sandboxing requirements, no trust or provenance verification, and no user experience." Google's own announcement calls these deliberate omissions. A narrow scope is what let five competing companies agree in months. The tradeoff: safety is pushed entirely onto each client.
The timing tracks adoption pressure, not marketing: Agent Skills alone had already spread to 32+ tools within five months of going open. At that scale, every client re-solving the same packaging problem independently becomes real duplicated engineering cost.
my-plugin/
├── plugin.json
├── skills/
│ └── summarize/
│ └── SKILL.md
├── mcp.json
└── com.example.client/
└── hooks/
Caution: Install, distribute, permission, sandbox, and trust checks are all out of v1. Evaluate third-party plugins with your client's marketplace vetting and provenance checks — star counts alone are not enough.
How Agent Plugins compares — and a six-step developer runbook
Agent Plugins isn't competing with MCP or Agent Skills — it sits on top of both, solving distribution friction rather than redefining how agents call tools or learn procedures.
| Standard | Backed by | Problem it solves | Status today |
|---|---|---|---|
| ChatGPT Plugins (2023) | OpenAI only | Let third parties add ChatGPT functionality | Discontinued 2024, replaced by the closed GPTs Store |
| MCP (2024) | Anthropic, later Linux Foundation | Protocol for agents to call external tools/data | De facto industry standard; adopted by OpenAI, Google |
| Agent Skills (2025) | Anthropic, spun out as open standard | Packaging reusable instructions/workflows for agents | 32+ tools support it, still expanding |
| Agent Plugins (2026) | Vercel + 5-company steering committee | Unified packaging/discovery for Skills + MCP servers | Just launched as 1.0 working draft; Google already onboard |
Six-step evaluation and shipping runbook:
Inventory what you already have: List existing SKILL.md packages and MCP server configs; confirm they already meet agentskills.io and MCP specs — Agent Plugins only packages conforming components.
Build the minimal directory: Create a plugin root with plugin.json ($schema + name), place skills under skills/, and put MCP config in root-level mcp.json.
Pick 2–3 launch clients for acceptance: From ChatGPT/Codex, Cursor, GitHub Copilot, Kiro, and VS Code, verify the same folder is discovered and loaded without a rewrite.
Isolate proprietary extras: Put client-only hooks in a reverse-domain namespace (for example com.cursor.xxx/) so they do not leak into the portable core.
Run a separate security review: The spec provides no scanning or provenance. Prefer official marketplaces, check repo history and dependency chains, and treat TOCTOU risks from the AIR fake-skill demo and Snyk ToxicSkills study as checklist items.
Stabilize the host machine: Multi-client validation, local MCP processes, and always-on Skills need Apple Silicon that does not sleep. Laptop lid-close and cheap Linux VPS boxes without Xcode/Metal burn acceptance cycles. For production baselines, evaluate MESHLAUNCH cloud Mac rental and the help center.
The unresolved fight: security, skepticism, and who actually benefits
Security was left on the table on purpose — and the timing is uncomfortable: One month before launch, security firm AIR demonstrated a fake Agent Skill called brand-landingpage that borrowed credibility from a repository with 36,000 GitHub stars, then passed scanning at Cisco, Nvidia, and skills.sh. It reached an estimated 26,000 deployed agents via a classic TOCTOU gap. Separately, Snyk's audit of nearly 4,000 published skills found flaws in 36.8%, with 13.4% containing critical-severity issues. Agent Plugins contains zero provisions for provenance verification.
Not every developer is convinced: Dax Raad (SST) said he was "very much against" it, calling it "a thin standard" whose useful parts will reappear as client-specific extensions. Developer advocate Angie Jones took the opposite view — one way to carry skills between the tools she already uses.
A shared format doesn't obviously favor small players: Build-once-reach-everywhere is the open-ecosystem pitch. But users still open a specific agent product first — a standard package format may simply make it easier for incumbents with existing user bases to absorb third-party extensions.
No Chinese company is at the table: All five founding TSC members plus Google are U.S. companies. MCP is already widely deployed inside China's major AI platforms — Alibaba Cloud's Model Studio (Bailian) and Baidu's Qianfan both ship dedicated MCP marketplaces, and domestic coverage shows Alibaba, Baidu, ByteDance, and Tencent treating MCP as core agent infrastructure. None appear on the Agent Plugins governance list. Whether that is timing or an early signal of parallel protocol layers is still unanswered.
Three cite-ready numbers: (1) Agent Skills adoption crossed 32+ tools by March 2026; (2) AIR's fake skill reached ~26,000 agents; (3) Snyk found defects in 36.8% of nearly 4,000 skills, with 13.4% critical. GPT-5 turns one on August 7, 2026; OpenAI used the preceding week to ship GPT-5.6 Luna (unlimited free-tier text chats) and GPT-5.6 Sol (a new "thinking effort" slider) alongside Agent Plugins. Google's framing: "Packaging is unglamorous infrastructure, and unglamorous infrastructure is exactly the kind of thing that should be shared rather than reinvented five times."
Context: Read together with MCP (connection) and Agent Skills (teaching), Agent Plugins (distribution) completes a three-layer stack the industry needed before "build a reusable agent capability once" could become practical — a sign competitive energy is shifting from model benchmarks toward plumbing.
A shared package format does not fix a flaky host. Local MCP processes, always-on Skills, and multi-client acceptance still collide with sleeping laptops, Linux VPS boxes without Metal/Xcode, and port contention on shared machines. For steadier production environments aimed at iOS CI/CD and AI agent automation, MESHLAUNCH Mac Mini cloud rental is usually the stronger default: dedicated Apple Silicon, 7×24 uptime, day/week/month flexibility. See the pricing page and help center.
No. MCP is a protocol that defines how an agent talks to an external tool or data source at runtime. Agent Plugins is a packaging format that defines how you bundle an MCP server's configuration (along with Agent Skills) into one portable folder that different agent clients can discover. MCP and Agent Skills still define the actual behavior; Agent Plugins just standardizes how they're shipped.
No — it depends on it. Any skill inside an Agent Plugins package must conform to the existing Agent Skills specification (SKILL.md format, frontmatter, directory layout). Agent Plugins adds a manifest and folder convention on top so that a skill (or an MCP server) can travel between clients without separate packaging for each one.
Not automatically. The specification explicitly does not define trust, provenance, or sandboxing — that's left entirely to whichever client you're using. Given that a fake Agent Skill bypassed Cisco, Nvidia, and skills.sh scanners and reached roughly 26,000 agents in a documented 2026 test, treat any third-party plugin the way you'd treat an unfamiliar npm package: check the source, don't trust star counts alone, and prefer official marketplaces with your client's own vetting layer on top.
At launch (August 6, 2026): ChatGPT, Codex, Cursor, GitHub Copilot, Kiro, and VS Code. Google has committed to adding support across Antigravity, Gemini CLI, and its Data Agent Kit, but hadn't shipped it at announcement time.
The public announcements from Vercel, Google, and the specification site don't list Anthropic among the founding maintainers, despite Agent Skills — one of the two component types Agent Plugins packages — originating at Anthropic. None of the launch materials explain the omission, and Anthropic hasn't issued a public statement on Agent Plugins as of this writing. If you need a stable host for multi-client agent validation, start with the pricing page and help center.