Six rivals just signed off on a folder layout

On August 6, 2026, Vercel, OpenAI, AWS, Cursor (Anysphere), GitHub and Microsoft all pointed at the same document on the same day. It's called Agent Plugins 1.0.0, and here's the deal: it standardizes how you package an extension for an AI agent. Put a plugin.json at the root of a directory, drop a skills/ folder and an mcp.json next to it, and you're done. That same folder loads in ChatGPT, Codex, Cursor, GitHub Copilot, VS Code and AWS's Kiro without modification. That's the whole standard.

"A folder convention made the news?" — fair reaction. But anyone who actually shipped agent tooling in the last eighteen months hit this wall hard. Agent Skills (the SKILL.md bundles that teach an agent a procedure) came out of Anthropic and everyone adopted the format. MCP — the Model Context Protocol that wires agents to external tools and data — also came out of Anthropic, published in November 2024, and the industry swallowed it whole. What nobody standardized was how to ship those two things together as one installable unit. Cursor wanted .cursor-plugin/plugin.json. Claude Code wanted .claude-plugin/plugin.json. Gemini CLI wanted its own extension file. Identical skill content, six different wrappers.

Agent Plugins touches only the wrapper. It does not replace MCP and does not invent a new skill format. Section 7.1 of the spec states that Agent Skills MUST conform to the Agent Skills specification, and section 7.2 states that the MCP specification remains the source of truth for wire behavior and lifecycle semantics. What Agent Plugins defines is where those components live so a client can find them, and how a client must load them. In npm terms, nobody redesigned JavaScript — they agreed on package.json. In Docker terms, nobody rewrote Linux — they agreed on the image layout.

Which brings us to the strange part. Anthropic, which created both the skill format and MCP, is not on the list. Neither is Google. Open MAINTAINERS.md in the spec repo and you get exactly five Core Maintainers: Clare Liguori (Amazon), Roshan Sadanani (Cursor), Harald Kirschner (Microsoft), Gav Verma (OpenAI), and Jonathan Hefner (Vercel), with Hefner serving as Lead Core Maintainer. Five companies laid track on rails Anthropic built, and Anthropic isn't holding a ticket. That's the part worth sitting with.

The smallest company in the room wrote the proposal

Start with Vercel. It makes Next.js and sells frontend deployment. By revenue and headcount it's the smallest name on the list, which makes it odd that Vercel drove the proposal rather than AWS, Microsoft or OpenAI. Except this is exactly Vercel's long-running pattern: find the glue layer between other people's products — framework and deploy, SDK and runtime — turn it into a standard, and build a business on top of it. The AI SDK followed that playbook. Agent Plugins sits in precisely the same slot.

The second unusual thing is that the giants took someone else's proposal instead of pushing their own. Normally the largest vendor throws a format over the wall and everyone else adapts. Here it went the other way. The AWS Open Source Blog post — co-written by Libby Clark, Principal Open Source Strategist, and James Ward, Principal Developer Advocate, published August 6 — describes AWS only as a founding TSC member and stresses that governance is designed so that no single company's product roadmap dictates the format's direction. The Technical Charter backs that up in writing: all governance roles are held by individuals rather than organizations, no seats are reserved for specific companies, and no single vendor may control a majority of Core Maintainer seats.

Cursor's position is the most interesting. Anysphere already shipped its own plugin system in Cursor 2.5 on February 17, 2026 — one install that bundled skills, subagents, MCP servers, hooks and rules, with launch partners including Amplitude, AWS, Figma, Linear and Stripe. Less than six months later it joined a shared spec. Cursor's docs now describe two coexisting formats: a root plugin.json makes a portable Agent Plugin, a .cursor-plugin/plugin.json makes a Cursor Plugin. The Cursor-native format supports rules, agents, commands and hooks; the portable format covers skills and MCP servers only.

The fourth oddity is that GitHub and Microsoft are counted separately even though they're the same company. The reason is mundane: GitHub Copilot (including Copilot CLI and the Copilot app) and VS Code implement the spec as distinct clients. VS Code gates the feature behind a chat.plugins.enabled setting that organizations can manage centrally, surfaces plugins in the Extensions view under an @agentPlugins filter, and offers a "Chat: Install Plugin From Source" command that pulls straight from a Git repository.

Then there's AWS, which made Kiro Powers support the spec natively and shipped the Agent Toolkit for AWS as a compatible package at launch — 30-plus curated skills spanning Lambda, S3, DynamoDB, CDK and more. This isn't charity. AWS wants "how to use AWS correctly" living inside whichever agent a developer happens to open. One format means one-sixth the distribution cost, and every dollar saved converts directly into reach.

What's actually inside plugin.json

Read the schema and the first surprise is how little is required. Two fields. $schema, which must be the literal string https://agent-plugins.org/schemas/1.0.0/plugin.schema.json and declares which spec version the package targets, and name. The name rules are tight: 1 to 64 characters, lowercase letters, digits, hyphens and periods only, first and last characters alphanumeric, no consecutive hyphens or periods. my-plugin and acme.tools pass; My-Plugin, -start and has--double fail.

Everything else is optional, but the schema is closed — additionalProperties: false. You cannot invent top-level fields. Client-specific experiments must live inside extensions, keyed by a reverse-domain namespace like com.example.client. The Design Decisions section explains why: a closed manifest enables strict validation, typo detection and schema-driven key completion, and it stops any client from squatting on top-level names. Unknown top-level keys are still schema violations, but clients report and ignore them rather than rejecting an otherwise valid plugin.

Item Value Note
Required fields $schema, name Either missing → client MUST reject the whole plugin
Optional metadata version, description, author, homepage, repository, license, keywords author accepts only name/email/url
Client extensions extensions Reverse-domain keys; spec assigns no semantics to contents
Skills location One level under skills/ Only directories containing SKILL.md; recursion forbidden
MCP location mcp.json Both $schema and mcpServers required
MCP transports stdio, streamable-http, sse (legacy) A client may conform supporting just one
Reserved env vars PLUGIN_ROOT, PLUGIN_DATA A plugin setting these in env invalidates that server
Licensing CC BY 4.0 for spec text, Apache 2.0 for schemas and code Per repo LICENSE.md

Discovery is deliberately rigid. plugin.json cannot move, and the manifest cannot override component locations or inline component configuration. Skills are found only in immediate child directories of skills/ that contain a SKILL.md regular file — clients MUST NOT recurse deeper. Absence is never an error: no skills/ directory just means no skills, and if mcp.json resolves to something other than a regular file, that component type is marked invalid while everything else keeps loading. Section 11.3 makes component failures explicitly non-fatal, so a plugin offering skills plus an MCP server stays usable when the server won't start.

Security in 1.0.0 amounts to path containment. Any file a plugin supplies must resolve inside the plugin root after symlinks are followed; anything escaping must be rejected. ./bin/server is valid, ../bin/server is not. At runtime the client must inject PLUGIN_ROOT (absolute path to the plugin root) and PLUGIN_DATA (a client-managed persistent directory that survives plugin updates), and expand ${PLUGIN_ROOT} and ${PLUGIN_DATA} exactly once, non-recursively, in args, env values and cwd. The spec is blunt about the limit: configured env values are visible package data, not a portable secret mechanism, and plugins MUST NOT embed credentials there.

That's where 1.0.0's real gaps show, and to its credit the project lists them itself in FUTURE_CONSIDERATIONS.md. Version 1.0.0 defines no trust model, no permission system and no sandboxing requirements. There is no signature or provenance verification, no secret-injection mechanism, no organizational allowlist or blocklist policy, no standard audit-event schema for install and enable actions, no inter-plugin dependency declarations, and no conformance test harness or linter. That's why the VS Code docs warn plainly that plugins can include hooks and MCP servers that run code on your machine and should be reviewed before installation. The packaging is settled; who to trust is still every user's problem.

Follow the incentives and everyone's take makes sense

OpenAI bought distribution. Its developer docs describe plugins as packages people discover, install, share and publish in ChatGPT and Codex, with both products sharing one plugin directory. So OpenAI gets to fuse its consumer surface and its developer surface into a single extension ecosystem — and, because the format is shared, it absorbs plugins built for Cursor, VS Code and Kiro for free. Remember that OpenAI's own 2023 ChatGPT plugin platform was retired within about a year. This time it didn't push a proprietary format; it rode a common one. That's the strategy shift.

Microsoft and GitHub bought enterprise control. VS Code lets organizations manage chat.plugins.enabled centrally and auto-discovers plugins installed via Copilot CLI. If corporate IT is going to govern which agent extensions employees run, a single format is the precondition. The spec itself contains no policy layer — which means the policy layer becomes each vendor's product, and selling governance on top of a commodity format is a game Microsoft has been winning for two decades.

AWS bought default placement. Those 30-plus skills in the Agent Toolkit encode AWS best practice across service selection, infrastructure as code with CDK and CloudFormation, serverless, containers, databases, storage, observability, billing, SDK usage and deployment. If the same plugin drops into Cursor, Codex and VS Code alike, AWS never has to bet on which agent wins. For a cloud provider that's the cheapest possible victory condition.

Cursor and Vercel bought position. Cursor opened the portable slice — skills and MCP — while keeping rules, agents, commands and hooks in its native format, and it gates distribution: the Cursor Marketplace requires open-source code and manual security review, and Team and Enterprise plans get private team marketplaces. Open the format, close the shelf. Vercel, meanwhile, holds the Lead Core Maintainer seat. Smallest company on the list, final technical decision-maker when consensus fails, held personally rather than corporately — that's a form of equity that outlasts market cap.

And plugin authors? Nominally the biggest winners: write once, ship to six clients. But be precise about what they won. They won authoring cost, not distribution. The spec defines no registry. Where users actually find plugins is still decided by the Cursor Marketplace, the ChatGPT plugin directory and the VS Code Extensions view. Once packaging is commoditized, the fight always moves to shelf space, and it will again here.

Standards that won, and standards that died

The strongest precedent is the Language Server Protocol. Microsoft published it in 2016 and turned an N-editors-by-M-languages integration problem into N plus M. Today LSP is table stakes in VS Code, Neovim, Emacs and the JetBrains world. It won for three reasons: the scope was narrow (just editor-to-language-tool communication), there were reference implementations, and the proposing vendor shipped it in its own flagship first. Agent Plugins rhymes with all three — narrow scope (skills and MCP only), six clients live at launch, published JSON Schemas.

OpenTelemetry is the second precedent. In 2019 Google-backed OpenCensus merged with CNCF's OpenTracing, consolidating observability instrumentation into one standard. Merging two ecosystems that already had users made the early spec sprawling and left language SDK maturity uneven for a while. It won anyway, because vendors accepted a simple bargain: standardize the instrumentation, compete on the backend. Agent Plugins runs the same trade — standardize the packaging, compete on agent quality and marketplace.

Browser extensions are the cautionary half-success. Once Chrome's extension format became the de facto standard, Firefox converged on WebExtensions starting in 2015 and Edge and Opera followed, and extension authors got to reuse most of their code. The catch was structural: when a standard tracks one company's implementation, that company's format changes drag everyone along — a bill that came due during the Manifest V3 migration. Reading the Agent Plugins charter, the individual-not-organizational roles and the ban on single-vendor majorities look like a direct response to that lesson.

The failures teach more. ChatGPT plugins launched in March 2023 and were effectively wound down about a year later in favor of GPTs and Actions. The format wasn't the problem — single-vendor distribution, clumsy enable/disable UX, and no economics for developers were. Go back further and you get WAP, the carrier-designed mobile web standard from 1999 that evaporated the moment the real web reached phones: standardize what's convenient for operators rather than what users want and that's the outcome. Various attempts to distribute PWAs through app-store-like channels, and Google's OpenSocial in 2007, went the same way.

So the success conditions for Agent Plugins are concrete. One, fill the trust gap fast in 1.x — without signatures, provenance and permission declarations, enterprises will block internal distribution and the real volume never arrives. Two, don't let registries fragment — one format across six shelves cuts the developer's perceived benefit in half. Three, publish a roadmap for the components v1 deliberately excluded: commands, hooks, agents, rules and LSP servers all sit in client-specific extensions today, which creates the perverse result that the more useful a plugin is, the less portable it becomes. Four, get Anthropic and Google in the room.

The two absentees hold the outcome

Anthropic's absence is conspicuous because both things this standard wraps came from Anthropic. MCP was published in November 2024 and became the industry default. The SKILL.md format originated there too and is now maintained separately at agentskills.io, though the reference example repository still lives at github.com/anthropics/skills. Agent Plugins is a packaging layer bolted onto two Anthropic-built rails, and the rail owner has no TSC seat. Claude Code isn't among the six launch clients either, and it continues to use its own .claude-plugin/plugin.json.

Two readings are available. The generous one: Anthropic already owns the upper layers — protocol and skill format — so it let others sort out the wrapper, and notably it has never said it rejects the standard. The cold one: whoever controls packaging controls distribution and defaults. Which directory layout wins determines which marketplace becomes the default, and from Anthropic's chair that can look like five companies splitting the commercial fruit of rails it laid. The tell will be simple — watch whether Claude Code starts reading a root plugin.json as-is.

Google's absence has a different shape. Gemini CLI already ships an extension format that bundles prompts, MCP servers, custom commands, themes, hooks, subagents and agent skills — a wider feature set than Agent Plugins 1.0.0 — plus a gallery and a working gemini extensions install path. Joining today would mean squeezing a broad capability set into a narrower common denominator, and it's hard to argue that trade is favorable right now. The calculus flips overnight, though, the moment enterprise buyers start saying they won't purchase tools that don't implement the standard.

Meta and DeepSeek form a third axis. Meta launched Muse Code, its first coding agent, on August 5–6 — a terminal-based tool that runs multiple subagents in isolated environments to work across large repositories. DeepSeek began a closed beta of its Harness agent framework the same week, promoting the internal thesis that model plus harness equals agent. For new entrants, Agent Plugins is a gift: implement the spec and inherit everyone else's plugins instead of bootstrapping an ecosystem from zero. The biggest beneficiary of a standard is frequently not the company that wrote it, but the one that arrives late.

Expect counter-plays in three flavors. Embrace and extend: support the spec, then push the genuinely valuable functionality into your com.vendor.client namespace so portability stays nominal — Cursor is already standing on that line. Move up the stack: ignore packaging and instead own the registry, trust and payments layers, which makes format standardization strategically irrelevant. Meet it head-on: Anthropic opens its own plugin format under separate governance and leans on MCP's authority. Whichever arrives, the axis of this market shifted on August 6 from raw model performance toward extension ecosystems.

What actually changes for you

If you build plugins, it changes today. Shipping one skill used to mean writing four or five client-specific install guides. Now it's a root plugin.json, a skills/ directory and an mcp.json in fixed positions. Three gotchas: the manifest schema is closed, so don't invent top-level fields; skills must sit exactly one level under skills/ because clients are forbidden from recursing deeper; and never put an API key in an MCP server's env, which the spec explicitly prohibits.

If you make buying decisions, it's half good news and half homework. The good news: write your internal standards once — review rules, deploy runbooks, security checklists — and distribute them to teams using different agents. The homework: 1.0.0 has no permissions, no sandboxing, no signatures and no audit logging. Plugins execute code on company laptops. Before rollout, decide which sources you allow, who approves an installation, and what MCP servers are permitted to send outbound. For now, VS Code's organization-managed chat.plugins.enabled and Cursor's private team marketplaces are the practical control points.

If you invest, one moat just got shallower. Proprietary extension formats used to be defensible; now value redistributes to three places: registries and curation (who owns the shelf), trust and compliance (who sells signing, audit and policy), and execution quality (who runs the same plugin better). That maps neatly onto the recent flow of capital into agent security and governance. The losers are middleware vendors whose pitch was "we support every client's integration format" — that sentence just got a lot less impressive.

If you're a regular user, you'll feel almost nothing this month. Turning on a plugin in ChatGPT doesn't change. The effect shows up over six to twelve months, as the same integrations start appearing across multiple apps at once and "that feature is Cursor-only" gets said less often. The side effect arrives with it: easier installation means more unvetted extensions, and the missing signature verification stops being a footnote and starts being the story. Until then, only installing plugins whose author you can identify is the entire defense.

Technically, August 6 was small. Strategically it was not. Six companies agreed on a directory convention, and that agreement is the first move in deciding who controls the agent extension ecosystem — with the company that built MCP and Agent Skills standing outside the room. That gap is the most interesting variable in this story for the next several months.

🥄 Three Things You're Probably Wondering

— So what does this mean for me? If you don't use agent tooling, nothing immediate. But if your company runs Copilot or Cursor, you'll start fielding "can I install this plugin?" questions — and the trust framework you'd need to answer isn't in the spec yet.

— Does this make MCP obsolete? The opposite. Agent Plugins wraps MCP, it doesn't replace it. The spec text names the MCP specification as the source of truth for protocol behavior, and mcp.json only says how to locate and connect to servers. Kill MCP and this standard has nothing to package.

— Will Anthropic eventually join? Too early to call. It has never said no, and the charter reserves no company seats, so joining would mean an individual becoming a maintainer. One clean signal to watch: whether Claude Code starts loading a plain root plugin.json.

Further Reading

Numbers are as of announcement and may change.