On July 24, agentplugins/agent-plugins-spec marked Agent Plugins 1.0.0 published: one root manifest, one place for reusable instructions, and one place for tool servers. That directory can now meet the same front door in VS Code, Cursor, GitHub Copilot, ChatGPT/Codex, and Kiro.
Those vendors did not agree on one runtime. They agreed on the boundary before it. The package is recognizable and partly loadable across clients; installation, permissions, secrets, UI, distribution, updates, and much of execution policy remain with each host. The useful standard exposes the next incompatibilities instead of disguising them.
A status warning remains: the rendered specification calls v1.0.0 a “Working Draft,” while the canonical repository text says “Published.” This edition uses the canonical text for normative claims and reports the website label as unresolved documentation drift.
The box is a contract
Every package starts with plugin.json: schema version, name, and optional metadata. Its schema is closed. Unknown top-level fields are reported and ignored; invalid required fields reject the package. A client can decide which rules it knows before touching the contents.
V1 has exactly two portable component types. skills/ contains immediate child directories whose SKILL.md files follow the Agent Skills specification. Optional mcp.json describes MCP servers using stdio, current streamable-http, or deprecated sse. Adoption is incremental: Skills alone can conform; an MCP client needs at least stdio or Streamable HTTP and should support both. Legacy SSE is optional.
The contract fixes discovery paths, provides stdio servers with PLUGIN_ROOT for bundled files and persistent PLUGIN_DATA for writable state, and isolates failures so one invalid skill or server does not erase the rest of the plugin.
Path containment is easy to overread. A client rejects packaged paths that escape the plugin root, including through symlinks. But the spec says explicitly that this does not sandbox a subprocess or restrict runtime paths. A safe box is not automatically a safe program.
Host-specific behavior gets a reverse-domain namespace in the manifest and a matching top-level directory—Kiro uses dev.kiro/ for steering. Other clients ignore namespaces they do not implement. Experiments can coexist with the portable rails, but remain non-portable.
One package, five compatibility profiles
The project’s current compatible-client roster lists the same core package across five client families, but not the same transport set or host behavior. This comparison was checked against current official client documentation and, for Codex, the open implementation:
| Client | Skills | stdio | Streamable HTTP | Legacy SSE | Host-owned difference |
|---|---|---|---|---|---|
| VS Code | Yes | Yes | Yes | Yes | Plugin marketplace and update policy; optional sandboxing for locally configured stdio servers; Agent Plugins extension namespaces currently ignored. |
| Cursor | Yes | Yes | Yes | Yes | Cursor’s parallel format adds rules, agents, commands, hooks, variables, canvases, and marketplace controls. |
| GitHub Copilot | Yes | Yes | Yes | Yes | Copilot-native packages can add agents, hooks, and LSP servers; marketplaces and enterprise standards govern installation. |
| ChatGPT & Codex | Yes | Yes | Yes | No | OpenAI provides its own universal directory and review path; current Codex source rejects the Agent Plugins sse transport. |
| Kiro | Yes | Yes | Yes | Yes | “Powers” add dev.kiro/ steering, dynamic context activation, and one-click catalog installation. |
The portable mcp.json requires the declared transport first and promises no fallback. A host’s native settings may differ: VS Code HTTP config can fall back to SSE; Copilot CLI accepts all three; Codex rejects Agent Plugins sse. “Compatible” means supported parts can load, not identical startup or approvals.
The April proposal got smaller before it got a new name
The April 2 “Open Plugin Specification” draft ran 1,200 lines. It allowed competing manifest locations, configurable component paths, inline MCP, and optional commands, agents, rules, hooks, LSP, output styles, user configuration, and marketplaces—both a common package and several hosts’ growing feature surfaces.
On July 10, one commit removed 140 lines and limited v1 to Skills and MCP; another fixed discovery paths. Marketplaces left the normative draft, client behavior gained namespaces, and MCP got a closed file. The spec began defining only what clients could plausibly load alike.
The project became Agent Plugins on July 16, recorded its TSC on July 20, relaxed transport adoption July 21, and published v1 July 24. VS Code and Kiro documented integrations by August 5–6; the repo then called itself an open standard. The history is a smaller promise five products could repeat.
The missing layers are where power moves
V1 does not say where a plugin is found, how it is installed, which publisher is trusted, when it updates, how an organization pins or blocks it, what permissions it declares, how secrets are injected, what UI explains risk, or how conformance is independently proved. A version string is metadata, not a content digest. A repository URL is not signed provenance. A client can claim compatibility while supporting only one core component type.
The project’s non-normative future list names permissions, signatures, attestations, secrets, enterprise controls, audit events, dependencies, and conformance tooling. Its charter includes tests in scope, but scope is not a shipped harness.
Clients compete on the consequential parts. VS Code makes marketplace trust and policy host concerns. Cursor reviews its official marketplace. Copilot has enterprise-managed plugin standards. OpenAI has its own review and publication path. Kiro dynamically activates Powers. The shared chassis makes those choices easier to compare.
Three useful precedents—and three breaking points
LSP is the reuse analogy. The Language Server Protocol made one language server reusable across editors by standardizing JSON-RPC messages. But LSP specifies a behavioral conversation. Agent Plugins locates two existing component standards and configures one: a common loading dock, not a universal runtime.
OCI is the boundary analogy. The Open Container Initiative separated image, runtime, and distribution specs, then built conformance. Agent Plugins also separates package from execution. But it is a plain directory with no standardized isolation, digest, registry, or signing chain.
WebExtensions is the ecosystem analogy. Browser extensions share a manifest, yet APIs and keys differ. That resembles a portable core plus host additions. But WebExtensions specifies privileged APIs and permissions; Agent Plugins v1 specifies neither.
The absent originator is a question, not a feud
Both rails arrive with history. Agent Skills says the format was originally developed by Anthropic. The MCP project says Anthropic donated MCP to the Agentic AI Foundation after creating it. Yet Anthropic does not appear in Agent Plugins’ published TSC roster of Amazon, Cursor, Microsoft, OpenAI, and Vercel, and Claude is not on the current compatible-client page.
That is a reporting question, not evidence of motive or conflict. Watch whether Anthropic or another independent implementer joins governance, whether Claude accepts an unchanged package, and whether portability reaches clients beyond the founding roster.
The next version can be predicted—and tested
The first pressure will be provenance. If catalogs grow before signatures, digests, and source-to-build attestations, hosts duplicate trust policy. A testable signal is a proposal binding version, content, and publisher, followed by two clients enforcing it.
The second will be permissions and organization policy. Expect manifest-declared capabilities, host-mapped consent, scoped secrets, allowlists, and version pinning. The test is one declaration producing consistent deny and approval outcomes across clients.
The third will be conformance and distribution. A public fixture should install unchanged in three independent clients and test discovery, failure isolation, placeholders, transports, and unknown namespaces. Catalogs then need update rules and immutable identifiers.
Hooks are the clearest graduation test. They existed in the April draft, disappeared from v1, and now live in multiple host-specific formats. If two or more clients converge on the same lifecycle events and safety semantics, a public proposal should be able to move that useful extension into core. If the shapes keep diverging, the namespace escape hatch is doing its job by keeping a false common denominator out.
Success is measurable: one unchanged plugin working across at least three independent clients; authors beyond the founding vendors shipping useful packages; public conformance tests; signed provenance; a permission model; and evidence that a valuable vendor extension can graduate into the shared core. Until those signals appear, Agent Plugins has standardized a credible box. What the ecosystem trusts that box to do remains the real standardization fight.