Agent Plugins 1.0 — The Standard Anthropic Didn't Sign

On August 6, 2026, AWS, Anysphere (Cursor), GitHub, Microsoft, OpenAI, Vercel, and Google shipped Agent Plugins 1.0.0 — an open packaging standard that bundles Agent Skills and MCP servers into a single installable directory. Launch clients include ChatGPT, Codex, Cursor, GitHub Copilot, Kiro, and VS Code. The standard depends on two specifications Anthropic invented: the SKILL.md format for Agent Skills and the Model Context Protocol. Anthropic holds zero seats on the steering committee and is not a launch client.

That last sentence is the whole story.

TL;DR

• What: Agent Plugins 1.0.0 defines a portable directory — plugin.json manifest, optional skills/ folder, optional mcp.json — that six major AI clients support at launch
• Who’s missing: Anthropic created both underlying primitives (Agent Skills, MCP) but is absent from the coalition and steering committee
• Security: v1.0.0 ships with no permission model, no sandboxing, no signature checks, and no secrets mechanism
• Action: If you build plugins for Claude Code, track whether Anthropic formally adopts plugin.json or publishes a competing bridge — the answer determines your maintenance burden

Agent Plugins 1.0 — What Happened

The specification defines a plugin as a directory containing three things: a plugin.json manifest at the root, an optional skills/ folder holding Agent Skills, and an optional mcp.json file configuring MCP servers. Any compatible client reads the manifest and loads what it supports. No duplication across tools. Write once, install in ChatGPT, Cursor, Copilot, or VS Code without maintaining separate configs.

The structure is deliberately minimal:

my-plugin/
├── plugin.json      # manifest: name, version, capabilities
├── skills/          # Agent Skills (SKILL.md files)
│   └── deploy.md
└── mcp.json         # MCP server configuration

The agentplugins GitHub organization was created on March 16, 2026. The specification text was committed July 24. The Working Draft status means the format can still change. The Technical Steering Committee includes Core Maintainers from AWS, Cursor, Microsoft, OpenAI, and Vercel, with Google joining on launch day. The charter forbids any single vendor from holding a majority of seats.

What the spec explicitly does not define: installation, distribution, policy, user experience, and — critically — security. Version 1.0.0 ships with no permission model, no sandboxing, no signature checks, and no secrets mechanism. The spec lists all of these as future work.

Agent Plugins 1.0.0 defines zero security primitives. No code signing, no permission scoping, no provenance validation. Every client implements its own trust model — or doesn’t. Portability without security means a compromised plugin compromises every client that installs it.

Why This Matters

This isn’t primarily a technical story. The spec is simple — directory, manifest, optional subdirectories. Any competent team could have designed it. What makes it significant is who designed it together and who wasn’t invited.

Anthropic built the two layers this standard packages. The SKILL.md format defines how agents understand task-specific instructions. MCP defines how agents connect to external tools. Agent Plugins 1.0 is, structurally, a packaging envelope for Anthropic’s intellectual contributions. And Anthropic has no governance role in how that envelope evolves.

Standards governance compounds. The steering committee that ships v1.0 also decides the security model for future versions, marketplace policies, and the versioning cadence that determines when breaking changes land. Every one of those decisions reshapes the plugin ecosystem — which skills are portable, which MCP server configurations are valid, what metadata a marketplace requires. If you’re not at the table when those decisions get made, you adapt to them after the fact.

The practical consequence is already visible. Anthropic’s Claude Code uses .claude-plugin/plugin.json for its own plugin format — a naming collision with the Agent Plugins spec’s root-level plugin.json. Teams building for both ecosystems maintain two manifests today. Claude Code is not a native Agent Plugins client, and while community tooling and translation paths exist to bridge the formats, these are workarounds rather than first-class integration.

If you’re shipping plugins for multiple AI clients, check whether your target list includes Claude Code. If it does, budget for maintaining a separate .claude-plugin/ manifest until Anthropic either adopts plugin.json or publishes a documented bridge specification. Don’t assume third-party translation layers are a permanent solution.

The coalition’s composition tells you how the industry is aligning. Microsoft and GitHub bring Copilot’s enterprise installed base. OpenAI brings ChatGPT’s consumer reach. Google brings Kiro and the Android ecosystem. AWS brings infrastructure credibility. Cursor brings developer mindshare among the AI-native coding crowd. Vercel brings the frontend deployment pipeline. Together, they cover the six most-used AI coding surfaces.

Anthropic’s Claude Code is the notable gap. It’s the primary competitor to Cursor and Copilot in agentic coding, and its users are precisely the audience that installs skills and MCP configs most aggressively. Leaving that surface out of native compatibility doesn’t kill the standard — but it creates a two-tier ecosystem where Claude Code plugins require format translation rather than working as first-class artifacts.

The security vacuum makes the governance question more urgent, not less. When v1.0 defines no trust model, the steering committee’s future security decisions will be foundational — they’ll determine what plugins can access, how provenance is verified, and whether a marketplace can reject unsafe artifacts. Supply-chain attacks against agent extensions are a known risk category: a single poisoned skill document could conditionally compromise every agent that installs it, and portability multiplies that attack surface. Those decisions will be made by the seven companies with seats. Anthropic’s security model for Claude Code plugins will either converge with those decisions (giving Anthropic less differentiation) or diverge (giving plugin authors more maintenance work).

The Take

I want to be precise about what I think is happening. This isn’t a conspiracy. The spec is openly licensed. Anthropic can adopt it tomorrow, fork it, or publish a compatible superset. The technical barriers are trivial.

The governance barriers are not. Standards bodies develop institutional inertia. Once the steering committee establishes a decision-making rhythm — monthly calls, quarterly releases, annual breaking changes — joining late means accepting the accumulated decisions you had no voice in. Every month Anthropic stays absent, the cost of joining likely increases and the cost of staying independent becomes more visible to plugin authors.

The most likely outcome: Anthropic doesn’t formally adopt plugin.json. Instead, they improve the translation path between formats until it’s good enough that most plugin authors don’t notice the difference. This is the pragmatic play — it avoids governance entanglement while maintaining de facto compatibility. But “good enough” translation has a ceiling. When the steering committee ships permission scoping in a future version, the translation layer either implements Anthropic’s own permission model (creating a semantic mismatch) or mirrors the coalition’s model (ceding security design to a body Anthropic doesn’t influence). There’s an alternate path — Anthropic could join the committee or publish a compatible superset — but with each passing month that window narrows.

If you’re building agent plugins today, the action is straightforward: target plugin.json as your canonical format. It’s where six of the seven major clients are. If you also need Claude Code support, maintain a separate .claude-plugin/ directory and watch Anthropic’s response over the next two quarters. The format bridging works, but it’s a workaround, not a foundation.

The deeper signal here isn’t about Anthropic’s strategy. It’s about what happens when the creator of a protocol doesn’t control its packaging layer. MCP defined how agents talk to tools. Agent Plugins defines how those tools get distributed. Distribution shapes adoption. Adoption shapes governance. And governance, over time, shapes what the protocol itself becomes.