Agent Plugins 1.0 Lands: Write Once, Run in ChatGPT, Copilot, Cursor, VS Code

Daniel Reyes Principal Engineer (AI/ML), YuSMP Group · LLM integration, agentic systems, and AI-native product design for US and EU teams

The short answer

What Agent Plugins 1.0 actually is

The spec defines a minimal directory structure for distributable AI agent extensions. A conforming plugin contains:

• A plugin.json manifest with the plugin's identity, schema version, and entry points.
• An optional skills/ directory holding Agent Skills — reusable bundles of instructions and resources that agents can invoke.
• An optional mcp.json that declares MCP servers the plugin needs, letting the host client provision tool connections automatically.

The format uses reverse-domain namespacing for client-specific extension fields, so platforms can innovate beyond the base spec without breaking interoperability. The spec deliberately stops at packaging: it defines what a plugin looks like on disk, not how clients install, surface, or distribute it. That omission is intentional — it lets Cursor build a different discovery UI than VS Code while both reading the same plugin directory.

AWS is implementing support in two places: Kiro (Amazon's AI IDE, a launch client) gains native Agent Plugins support for bundled Skills and MCP servers, and the AWS Agent Toolkit ships 30-plus curated skills for Lambda, S3, DynamoDB, and CDK. Google is shipping support through its Agents CLI and the Data Agent Kit, which connects agents to BigQuery, Spanner, and Cloud SQL. Both companies published their implementations the same day the spec launched.

Six vendors, one spec — and one notable absence

The six founding members cover most of the enterprise AI tooling landscape. OpenAI's ChatGPT and Codex are the highest-reach consumer and developer endpoints. Microsoft's GitHub Copilot and VS Code combined reach tens of millions of developers. Amazon's Kiro and AWS Agent Toolkit reach enterprise cloud teams building on AWS infrastructure. Google's Agents CLI and Data Agent Kit reach data engineering teams. Cursor and Vercel reach the frontend-and-fullstack developer community directly.

The notable absence is Anthropic. Despite originating both MCP — the communication protocol that Agent Plugins builds on — and the Agent Skills format that the spec packages, Anthropic is not a TSC member and Claude Code is not listed as a compatible client at launch. That matters practically: teams that have standardized on Claude as their primary agent runtime cannot today install an Agent Plugins-formatted plugin and expect it to work. Whether Anthropic joins the TSC or ships compatible support independently is not announced as of August 8, 2026.

The governance structure is designed to prevent capture by any single company. No vendor holds a majority of the six TSC seats, and the spec is open for community contribution on GitHub. The charter describes the committee as a neutral steward — analogous to how the OpenJS Foundation governs Node.js rather than Microsoft or Google controlling it unilaterally.

What v1.0 includes — and what it deliberately skips

The spec ships a well-scoped v1.0 rather than trying to solve every problem in the first release. What it defines: the directory layout, the manifest schema, how Agent Skills are declared, how MCP server configurations are bundled, and how clients can extend the format under their own namespace without breaking portability.

What it explicitly does not define:

• Permission model. There is no standard for what capabilities a plugin can request or how a client should prompt the user to grant them.
• Sandboxing. Plugin code runs in the host client's environment. The spec says nothing about isolation, resource limits, or network egress restrictions.
• Signature verification. There is no mechanism in v1.0 for a client to verify that a plugin was published by who it claims, or that it has not been tampered with in transit.
• Secrets management. Plugins may invoke MCP servers that need credentials; how those credentials are stored, rotated, or revoked is entirely the client's concern.

The TSC has listed all four as future work. The immediate consequence is that two plugins installed into the same VS Code session share the same level of trust — there is no fine-grained containment. A plugin that connects to an internal data warehouse via MCP runs with the same implicit trust as a plugin that autocompletes commit messages.

What it means for US & EU software teams

The packaging efficiency gain is real and immediate. If your team maintains custom AI tooling — a skill set that wraps your internal APIs, connects to your data warehouse, or enforces your code style — you previously had to maintain separate integrations for each AI tool your engineers use. Agent Plugins collapses that into one artifact you version, review, and distribute like any other internal package.

The business-facing implication is that the "write once, run everywhere" promise for agent skills is now achievable without betting on a single vendor's proprietary extension format. If your team migrates from Cursor to VS Code or adds GitHub Copilot to a workflow that already uses ChatGPT Enterprise, the plugin goes with you. That portability reduces the switching cost that has historically locked organizations into a single AI tooling vendor.

For EU teams under GDPR and the EU AI Act, the absent security model is the first compliance concern to resolve before any plugin reaches production. An Agent Plugin that connects to an MCP server handling personal data is — from a data-protection standpoint — a data processor configuration. The same 72-hour breach notification obligations, data minimization requirements, and processor agreements that apply to any other tool in your stack apply here. The spec will not enforce these; your compliance team needs a plugin review gate that does.

For FinTech and HealthTech teams subject to SOC 2, HIPAA, or DORA, the lack of sandboxing means you cannot assume a plugin is contained. A plugin with MCP server access can, in principle, reach production infrastructure — the spec does not stop it, and v1.0 clients have varying levels of native containment. Treat plugin installation in regulated environments the same way you treat any third-party tool: security review, least-privilege credential scoping, and egress monitoring before approval.

The Anthropic gap is a practical decision point for teams that use Claude. If your agent workflows today rely on Claude Code or Claude's tool-use capabilities, Agent Plugins-formatted skills will not run natively on that platform at launch. You have three options: maintain separate packaging for Anthropic environments, wait to see if Anthropic ships compatibility, or migrate agents to a platform that is a TSC member. None of those options is expensive, but the decision should be made deliberately rather than discovered when a developer tries to install a plugin on Claude and gets an error.

What to do now

• Inventory your team's AI tooling. Which of the six launch clients — ChatGPT, Copilot, Cursor, Kiro, VS Code, Codex — do your engineers and data teams use? That determines how broadly Agent Plugins compatibility matters for you right now.
• Define a plugin governance policy before the first install. Who can approve plugins for production use? What security review is required? Where are MCP server credentials stored? Establishing this now, while the ecosystem is new, is far cheaper than investigating a data exposure after the fact.
• If you maintain custom AI tools, evaluate Agent Plugins packaging. The format is minimal enough that migrating an existing skill set is a low-effort project. The payoff is portability across all current and future compatible clients.
• Track Anthropic's response. If Claude is in your stack, subscribe to Anthropic's changelog and the Agent Plugins GitHub repository for announcements about compatibility.
• Do not assume the spec's security future work will arrive before your compliance deadline. Plan around what v1.0 actually defines, not what a future version might add.

Frequently asked questions