Agent Plugins: a shared format for skills and MCP

The five-plugin problem

Every serious AI coding agent ended up with its own plugin system. Claude Code plugins carry a manifest at .claude-plugin/plugin.json, put skills in skills/<name>/SKILL.md, and list MCP servers in a .mcp.json file at the plugin root, per Anthropic's own plugin docs. ChatGPT and Codex have their own app format. Cursor, GitHub Copilot, and AWS's Kiro each built something adjacent but not compatible. The pieces inside a plugin were often conceptually identical — a written-out skill, a connection to an MCP server — but the container around them wasn't, so authors rebuilt the same plugin for every client that mattered to them.

On August 6, 2026, Amazon, Cursor's parent Anysphere, Microsoft, OpenAI, and Vercel shipped Agent Plugins 1.0.0, a shared package format that ChatGPT, Codex, Cursor, GitHub Copilot, Kiro, and VS Code can all read without translation (GitHub Copilot and VS Code both fall under Microsoft's seat). Google joined the same day as a sixth core maintainer, represented on the steering committee by Kevin Hou of Google DeepMind. Vercel proposed the spec and its engineer Jonathan Hefner leads the maintainer group; Amazon, Cursor, Microsoft, and OpenAI each have a named core maintainer alongside him.

What's actually in the box

The spec stays narrow on purpose. Per the published Agent Plugins 1.0.0 spec, a plugin is a plain filesystem directory, not an archive, containing:

• plugin.json — a manifest with a required name field (1–64 characters, lowercase alphanumeric plus hyphens and periods) and optional metadata: version, description, author, homepage, repository, license
• skills/ — one subdirectory per skill, each holding a SKILL.md. The spec is explicit that clients "MUST NOT recursively search deeper descendants for additional skills," so nesting doesn't work
• mcp.json — MCP server definitions, supporting stdio (a local process) and streamable-http (a remote HTTPS endpoint) as required transports, with legacy sse as optional
• reverse-domain extension directories — an optional namespace like com.example.client for data a specific client cares about; every other client is required to ignore what it doesn't recognize

Two placeholders, ${PLUGIN_ROOT} and ${PLUGIN_DATA}, expand inside the MCP config so a plugin doesn't have to hardcode filesystem paths. That's close to the entire technical surface — small enough that a client can implement it in an afternoon, which is presumably the point.

What it deliberately punts on

The spec's own design-decisions section draws the boundary explicitly: "Other proposed component types — such as commands, hooks, agents, rules, and LSP servers — remain too client-specific for a stable portable contract and are outside the v1 format." Security is scoped out the same way. For client extension data, the spec "assigns no portable discovery, validation, loading, or failure semantics" — meaning trust, sandboxing, and permissions are left entirely to whichever client is loading the plugin. Installation and distribution aren't addressed either; the spec defines what a plugin contains, not how it gets onto a machine or who signed it.

That's a real limitation for anyone thinking about the approval-gate side of agent tooling: a portable package format says nothing about whether a user should trust what's inside it before running it. A plugin that loads cleanly in six clients can still ship an MCP server that reads your filesystem or a skill that quietly instructs the model to do something the user never asked for — Agent Plugins standardizes the container, not the contents.

Governance is also lighter than some of the protocols this site already tracks. There's no foundation backing Agent Plugins the way the Linux Foundation's Agentic AI Foundation backs MCP and A2A. Decision-making runs through a Technical Charter and a Technical Steering Committee made up of the named core maintainers from each company, which is closer to how AG-UI operates under CopilotKit than to a neutral standards body. For a spec whose whole pitch is vendor-neutrality, that's worth sitting with — the five, now six, companies writing the rules are also the ones shipping the clients that read the format.

Who's not on the list

The most notable name absent from the steering committee is Anthropic — the company that wrote both specifications Agent Plugins packages. MCP originated at Anthropic in November 2024 before its December 2025 donation to the Linux Foundation's Agentic AI Foundation. Agent Skills, the SKILL.md convention, also came out of Anthropic and moved to an open standard around the same time. Claude Code isn't among the six launch clients, and Claude Code's own manifest path — .claude-plugin/plugin.json, a hidden directory rather than a root-level file — doesn't match the Agent Plugins layout, even though the underlying skills/<name>/SKILL.md convention lines up.

It's an odd absence given how much of the plugin-authoring activity in this space currently happens inside Claude Code specifically, and it leaves an open question the announcements don't answer: whether Anthropic sits this out because it disagrees with the format, because it wasn't invited into the initial five, or because Claude Code's plugin system already does more (hooks, subagents, LSP servers, background monitors) than a v1 format scoped to skills and MCP was ever going to cover. Any of those would be a reasonable read; nothing public says which one it is.

Where this leaves things

Agent Plugins is a package format, not a marketplace, an install mechanism, or a trust layer — and it says so about itself. What it does solve is real: an author who wants a skill-plus-MCP-server bundle to load in Cursor, VS Code, GitHub Copilot, ChatGPT, Codex, and Kiro without six separate directory layouts now has one to write against. Whether that convenience is enough to pull in the client that currently isn't playing, or whether Claude Code plugins and Agent Plugins settle into two adjacent-but-different formats the way MCP and A2A settled into two different layers, is the thing worth watching next.

We're tracking it at /tracker#agent-plugins.