Agent Plugins 1.0: Write-Once, Run-Anywhere Skills & MCP

By Deepak Bagada, CEO at SaaSNext & Principal AI Architect.

The agent ecosystem has a packaging problem. Every coding tool — VS Code, Cursor, GitHub Copilot, ChatGPT, Codex, Kiro — grew its own idea of what a plugin is, with different manifests, different marketplaces, and different APIs. The result is that a genuinely useful agent skill must be reimplemented once per tool, and an MCP server's integration story changes depending on where you are. On August 6, 2026, a coalition answered with a spec: Agent Plugins 1.0, a single portable package that combines skills and MCP servers into one directory that runs anywhere. GitHub shipped support within a week, on August 12, and Google signed on as a core maintainer the same day the spec went public.

One directory to rule them all

The core idea is aggressively simple: a plugin is a folder. Inside that folder live three things:

• plugin.json — the manifest that declares name, version, description, and what the plugin exposes.
• skills/ — the directory of skills, typically markdown instructions the agent can load.
• mcp.json — the description of MCP servers the plugin brings along.

That is the entire packaging contract. No per-tool manifests, no tool-specific build steps, no marketplace-specific zip formats. A plugin is a folder, and any client that speaks the spec can consume it.

A sample manifest

A minimal manifest looks something like this (fields are illustrative, following the 1.0 shape):

{
  "manifestVersion": 1,
  "name": "acme-inc/slug-generator",
  "version": "0.1.0",
  "description": "Generates URL slugs from titles across tools.",
  "skills": ["./skills/slugify.md"],
  "mcp": {"./mcp.json"},
  "entrypoints": {
    "cursor": "./cursor/feature.json",
    "vscode": "./vscode/feature.json"
  }
}

Note the two-level design: the shared core (skills and MCP) is tool-agnostic, while client-specific adaptations live in namespaced directories like cursor/ and vscode/. One plugin, one source of truth, and per-client polish without forking the whole package.

Write once, run anywhere

The portability promise is the point of the whole exercise. The spec names the target clients explicitly, and the governance reflects how serious the vendors are:

A builder should be able to author one plugin, install it in VS Code and Cursor, hand it to Copilot, and reference it from ChatGPT — the same package, the same skills, the same MCP configuration.

Governance under the Linux Foundation AAIF

A standard only matters if nobody owns it, which is why stewardship under the Linux Foundation's Agentic AI Initiative (AAIF) is the load-bearing detail. The spec was drafted by Vercel with input from Amazon, Cursor, Microsoft, and OpenAI — then Google joined on August 6, 2026 as a core maintainer. That is a remarkable set of competitors cooperating on one packaging format, and it is exactly what a successful standard needs: no single vendor's roadmap can redirect it, and every participant has an incentive to keep the format boring and compatible.

GitHub ships first

The fastest validation came from GitHub: on August 12, 2026, it shipped Agent Plugins support in VS Code, the Copilot CLI, and the Copilot SDK. Notably, that release also shipped the security controls a plugin ecosystem needs:

• managed-settings.json with enabledPlugins — explicit control over which plugins are active, enforced by policy rather than by whatever a developer installs locally.
• strictKnownMarketplaces — restricting installation to trusted, known marketplace sources to blunt the obvious supply-chain attack: a malicious "plugin" that runs arbitrary skills.

Both controls matter because a plugin is code that an agent will run on your behalf. The security model is not an afterthought bolted on later; it shipped with the first implementation.

Namespaced directories keep clients honest

The namespaced-directory design quietly solves the tension between portability and tool-specific depth. Client-specific features — a custom button, a tooltip, a keyboard shortcut — go in their own directory, namespaced by client. The shared core stays untouched, so the plugin is simultaneously portable and deep. Compare that to today's status quo, where tool-specific features are a fork in a separate repository that drifts apart. Under 1.0, a Cursor-specific adaptation can exist without breaking the VS Code experience, because they are separate namespaces in one package.

What adoption looks like in practice

For a team that already runs agent tools, adopting Agent Plugins 1.0 is less a migration and more a repackaging exercise. Start with the skills you already ship per tool — the markdown instructions and MCP servers you maintain in three or four repositories — and fold them into one plugin directory. Write the manifest, move the skills into the skills/ folder, point mcp.json at your servers, and then run the same package in VS Code and the Copilot CLI, which is where GitHub's August 12 support already lands. The namespaced directories mean your Cursor-specific buttons and your Copilot-specific hooks do not have to be reconciled; they coexist in the same package, so the shared core drifts less and the client adaptations stay explicit. From there, the workflow becomes a supply-chain conversation: pin plugins you depend on, enforce strictKnownMarketplaces in managed-settings.json, and review a plugin's manifest and skills before enabling it for the team. The format is young, but it is young the way early HTTP was young — simple enough to adopt today and governed well enough that the vendors will keep it stable. The teams that package their agent capabilities once will not have to package them again per tool.

Frequently Asked Questions

What exactly is an agent plugin under 1.0?

A directory containing a plugin.json manifest, a skills/ folder, and an mcp.json. The manifest declares what the plugin exposes, and any compliant client can consume the package without per-tool conversion.

Which tools can run the same plugin?

The spec targets VS Code, Cursor, GitHub Copilot, ChatGPT, Codex, and Kiro. GitHub shipped support on August 12, 2026 in VS Code, Copilot CLI, and Copilot SDK; the other clients are at various stages, with several having contributed to the spec.

Who governs the Agent Plugins spec?

The Linux Foundation's Agentic AI Initiative (AAIF). Vercel drafted it, Amazon, Cursor, Microsoft, and OpenAI contributed input, and Google joined as a core maintainer on August 6, 2026 — a cross-vendor structure designed to keep the format neutral.

How does plugin security work?

GitHub's implementation ships managed-settings.json with enabledPlugins to control what is active, and strictKnownMarketplaces to restrict installation to trusted sources. Namespaced directories also isolate client-specific code from the shared core, limiting the blast radius of a malicious adaptation.

What problem does this solve versus per-tool plugins?

Today a skill must be rewritten per tool with different formats, marketplaces, and APIs. Agent Plugins 1.0 gives one package that installs everywhere, so the capability is written once and shipped to every compatible client.

Closing thoughts

Agent Plugins 1.0 is the kind of boring, high-leverage standard the agent ecosystem has been missing. It does not try to be clever; it says a plugin is a folder, here is the manifest, here is where skills and MCP servers live, here is how clients stay isolated. The combination of five-plus vendors contributing, Google joining as a core maintainer, Linux Foundation governance, and GitHub shipping support within a week is a strong signal that this format has staying power. For builders, the move is obvious: package your skills and MCP servers as a 1.0 plugin once, and your work travels with you across tools. See how MCP servers fit into production workflows in the MCP directory, and follow agent-platform developments in the latest AI news.