Is Agent Plugins the End of AI Agent Fragmentation? What OpenAI, Google, and Microsoft's New Standard Actually Does

Agent Plugins is the third layer in an 18-month stack, not a standalone invention:

• March 2023: OpenAI launches ChatGPT Plugins, an early open third-party extension model.
• January 2024: OpenAI shuts down Plugins in favor of the closed GPTs Store.
• November 2024: Anthropic releases MCP (Model Context Protocol) to standardize how agents connect to external tools and data; later donated to the Linux Foundation. See also our MCP protocol guide.
• March 2025: OpenAI and Google both adopt MCP, cementing it as the de facto tool-connection layer.
• October 16, 2025: Anthropic launches Agent Skills inside Claude Code, packaging reusable instructions as SKILL.md folders. See Agent Skills open-standard guide.
• December 18, 2025: Agent Skills spins out as an open standard at agentskills.io; Microsoft and OpenAI ship support within 48 hours.
• March 2026: Agent Skills adoption crosses 32 tools, including Gemini CLI, JetBrains Junie, and AWS Kiro.
• July 24, 2026: Agent Plugins 1.0.0 published as a working draft.
• August 6, 2026: Public launch with a five-company steering committee; Google joins as a core maintainer the same day.

Pain points developers still face:

• Packaging fragmentation: Skills teach reusable procedures; MCP connects tools; every client still expects a different folder layout.
• Discovery cost: Without a shared manifest, clients cannot auto-discover Skills and MCP components from one package.
• Security left hanging: After packaging is standardized, install, sandbox, and provenance stay out of scope — malicious skills remain a client problem.
• Governance gap: Founding maintainers are all U.S. companies; Chinese platforms that already ship MCP marketplaces are absent from the table.

MCP solved connecting agents to tools. Agent Skills solved teaching agents reusable procedures. Agent Plugins targets the packaging and discovery gap between those two layers.

Source: Vercel blog, agent-plugins.org specification, Google Developers Blog — all published August 6, 2026.

1. One manifest, two component types

A plugin is a directory with a plugin.json manifest at its root. If it ships skills, they live in a skills/ folder and must conform to the existing Agent Skills specification. If it ships MCP servers, they are declared in mcp.json, supporting stdio, Streamable HTTP, or legacy HTTP+SSE transports. Any compliant client can discover and load both from the same folder. Unknown component types are skipped rather than rejecting the whole plugin. A reverse-domain namespace (for example com.cursor.xxx/) is reserved for client-specific extras that do not leak into the portable core.

{
  "name": "example-agent-plugin",
  "version": "1.0.0",
  "agentPlugins": "1.0.0"
}
# skills/… → SKILL.md
# mcp.json → MCP server config

2. The hard parts are explicitly punted

The spec text is blunt: v1 "defines no install mechanism, no distribution protocol, no permission model, no sandboxing requirements, no trust or provenance verification, and no user experience." Those are not oversights — Google's own announcement calls them deliberate omissions. A narrow scope is what let five competing companies agree in months rather than years. The tradeoff: whether a specific plugin is safe to run is pushed entirely onto each client.

3. Why now

Agent Skills alone had already spread to 32+ tools within five months of going open. At that scale, every client re-solving the same packaging problem independently becomes real duplicated engineering cost — the actual argument for standardizing now rather than earlier.

Narrow scope bought fast consensus. Security, distribution, and trust stay on the client side — that is the bargain that got five majors to ship together.

Agent Plugins is not competing with MCP or Agent Skills — it sits on top of both, solving distribution friction rather than redefining how agents call tools or learn procedures.

Unresolved fights:

• Security was left on the table on purpose: One month before launch, security firm AIR demonstrated a fake Agent Skill called brand-landingpage that borrowed credibility from a repository with 36,000 GitHub stars, then passed scanning at Cisco, Nvidia, and skills.sh. It reached an estimated 26,000 deployed agents by exploiting a TOCTOU gap. Separately, Snyk's audit of nearly 4,000 published skills found flaws in 36.8%, with 13.4% containing critical-severity issues. Agent Plugins' specification contains zero provisions for provenance verification.
• "A thin standard": Dax Raad (SST) said he was "very much against" it, calling it a thin standard whose useful parts will end up as client-specific extensions. Developer advocate Angie Jones took the opposite view — one way to carry skills between the tools she already uses.
• Who actually benefits: The open-ecosystem pitch is build-once, reach-every-client. A shared format may also make it easier for incumbents with existing user bases to absorb third-party extensions at zero switching cost.
• No Chinese company at the table: All five founding TSC members plus Google are U.S. companies. Alibaba Cloud's Model Studio and Baidu's Qianfan already ship MCP marketplaces; Alibaba, Baidu, ByteDance, and Tencent treat MCP as core agent infrastructure — none appear on the Agent Plugins governance list.

Why it matters beyond the spec

GPT-5 turned one year old on August 7, 2026. OpenAI used the preceding week to ship GPT-5.6 Luna (unlimited free-tier text chats) and GPT-5.6 Sol (a new "thinking effort" slider) alongside Agent Plugins. Google's framing: "Packaging is unglamorous infrastructure, and unglamorous infrastructure is exactly the kind of thing that should be shared rather than reinvented five times." Read with MCP (connection) and Agent Skills (teaching), Agent Plugins (distribution) completes a three-layer stack the industry needed before "build a reusable agent capability once" could become practical.

Six-step checklist for developers:

1. Confirm client support: Check day-one clients (ChatGPT/Codex, Cursor, GitHub Copilot, Kiro, VS Code) and any Google commitments (Antigravity, Gemini CLI, Data Agent Kit).
2. Split components: Separate existing extensions into Agent Skills (SKILL.md) and MCP server config — avoid non-standard layouts.
3. Write the root manifest: Place plugin.json at the package root; put skills under skills/; declare MCP in mcp.json (stdio / Streamable HTTP, etc.).
4. Use reverse-domain namespaces for private extras: Keep client-only capabilities under directories like com.cursor.xxx/ so they do not pollute the portable core.
5. Apply a security baseline: Do not assume the format protects you; prefer official marketplaces, verify provenance, and watch for TOCTOU / high-star impersonation.
6. Pick a stable host: When wiring Skills and MCP in Cursor or a local agent, prefer a rootable, always-on Apple Silicon host so long sessions are not killed by shared-cloud jitter.

# Agent Plugins 1.0 watchlist
spec: 1.0.0 working_draft
components: skills + mcp_servers
day1_clients: chatgpt,codex,cursor,copilot,kiro,vscode
out_of_scope: install,marketplace,permissions,sandbox,trust
security: client_responsibility_only
next: verify source before install

Citeable hard numbers (Aug 6–7, 2026):

• Spec: Agent Plugins 1.0.0 working draft; draft July 24, public launch August 6
• Scope: Only Agent Skills + MCP servers; core files plugin.json, skills/, mcp.json
• Skills adoption: 32+ tools within about five months of the open standard
• Security audits: AIR fake skill reached ~26,000 agents; Snyk found flaws in 36.8% of ~4,000 skills, 13.4% critical
• Governance: Public repo agentplugins/agent-plugins-spec; U.S. five-company TSC + Google on day one

Is Agent Plugins the same thing as MCP?
No. MCP is a protocol that defines how an agent talks to an external tool or data source at runtime. Agent Plugins is a packaging format that defines how you bundle an MCP server's configuration (along with Agent Skills) into one portable folder that different agent clients can discover. MCP and Agent Skills still define the actual behavior; Agent Plugins just standardizes how they are shipped.

Does Agent Plugins replace Agent Skills?
No — it depends on it. Any skill inside an Agent Plugins package must conform to the existing Agent Skills specification (SKILL.md format, frontmatter, directory layout). Agent Plugins adds a manifest and folder convention on top so that a skill (or an MCP server) can travel between clients without separate packaging for each one.

Is it safe to install a random Agent Plugin from a marketplace?
Not automatically. The specification explicitly does not define trust, provenance, or sandboxing — that is left entirely to whichever client you are using. Given that a fake Agent Skill bypassed Cisco, Nvidia, and skills.sh scanners and reached roughly 26,000 agents in a documented 2026 test, treat any third-party plugin the way you would treat an unfamiliar npm package.

Which AI tools support Agent Plugins right now?
At launch (August 6, 2026): ChatGPT, Codex, Cursor, GitHub Copilot, Kiro, and VS Code. Google has committed to adding support across Antigravity, Gemini CLI, and its Data Agent Kit, but had not shipped it at announcement time.

Why isn't Anthropic, which created Agent Skills, on the steering committee?
The public announcements from Vercel, Google, and the specification site do not list Anthropic among the founding maintainers, despite Agent Skills — one of the two component types Agent Plugins packages — originating at Anthropic. None of the launch materials explain the omission, and Anthropic has not issued a public statement on Agent Plugins as of this writing.

Sources (selected): Vercel Blog, "Introducing Agent Plugins," and Vercel Changelog (August 6, 2026); agent-plugins.org Spec 1.0.0 (Working Draft); Google Developers Blog, "Agent Plugins package your skills, tools, and more" (August 6, 2026); The Next Web, Virtualization Review; Anthropic Agent Skills posts; AIR / Snyk ToxicSkills / Help Net Security; 36Kr and Alibaba Cloud Developer Community on MCP adoption in China; OpenAI "Improving GPT‑5.6 Sol in ChatGPT"; TechCrunch. Compiled as of August 7, 2026 — verify before publishing.

Shared cloud VMs often hit bandwidth jitter and oversubscription; ad-hoc inference nodes drop long-lived connections; consumer laptops struggle with 24/7 isolation for team agents. For a more stable production host suited to Skills / MCP / Agent Plugins workflows, JEXCLOUD multi-region bare-metal Mac rental is usually the better fit: dedicated Apple Silicon, always-on, monthly flexibility, about 120-second delivery. See the JEXCLOUD pricing page.