Agent Plugins MCP Installer: Bundle Skills into Claude & Cursor

What Agent Plugins 1.0.0 changes

On August 6, 2026, a cross-vendor coalition — Amazon, Cursor, Microsoft, OpenAI, and Vercel as core maintainers, with Google as a core maintainer — shipped Agent Plugins 1.0.0, the first stable vendor-neutral packaging spec for agent capabilities. The spec lives under the Linux Foundation's Agentic AI Foundation (AAIF) and is licensed CC-BY-4.0. The pitch is simple: one bundle, every agent. The same plugin directory installs into VS Code, Cursor, GitHub Copilot, ChatGPT, Codex, or Kiro without format conversion, and both the AWS Agent Toolkit and the Google Data Agent Kit already ship plugin bundles.

A plugin is just a directory with three contract pieces:

my-plugin/
├── plugin.json      # manifest: name, version, schema, entry points
├── skills/          # Agent Skills, one subdirectory per skill
│   ├── summarize/
│   └── extract-actions/
└── mcp.json         # MCP server declarations, explicit transports

• plugin.json — the manifest. It declares name, version, a schema written in JSON Schema 2020-12, and the plugin's entry points.
• skills/ — the skills folder, using the Agent Skills format with one subdirectory per skill.
• mcp.json — MCP server declarations, each with an explicit transport type: stdio, Streamable HTTP, or HTTP+SSE.

Clients discover what a plugin contains simply by scanning the directory — no installer binary, no registry side effects. But "supported at launch" in a GUI product is different from scriptable. When you manage a fleet of developer machines, CI pipelines, or ephemeral cloud agents, you want a plugin manager for your agents: fetch, validate, map, install, update, uninstall — all over MCP tool calls. That is exactly what the installer server in this guide does.

Why an installer MCP server

• One source of truth. A registry or catalog URL replaces a pile of hand-edited configs.
• Validation before installation. plugin.json is checked against its JSON Schema 2020-12 schema before anything is written to disk.
• Target-aware mapping. The same plugin maps cleanly into Claude Desktop's claude_desktop_config.json and Cursor's .cursor/mcp.json, each of which has its own shape.
• Stateless by design. Per the MCP 2026-07-28 spec the server keeps no sessions: fetch, validate, write, report. Caching is bounded by ttlMs.

Registry and catalog considerations

Plugins arrive from two kinds of sources. A registry is a structured store of plugin bundles, versioned and signed. An AI Catalog entry can also point at a plugin.json directly using the application/agent-plugins+json MIME type proposed in the Agentic Resource Discovery (ARD) design — the same way an entry points at an agent card or an mcp.json. The installer treats both the same: fetch the bundle, read the manifest, validate, map, install.

Tool reference

plugin_install inputSchema

{
  "name": "plugin_install",
  "inputSchema": {
    "type": "object",
    "properties": {
      "source": { "type": "string", "description": "Registry URL or local directory path of the plugin bundle" },
      "target": { "type": "string", "enum": ["claude_desktop", "cursor"] },
      "version": { "type": "string", "description": "Optional semver range" }
    },
    "required": ["source", "target"]
  }
}

plugin_validate inputSchema

{
  "name": "plugin_validate",
  "inputSchema": {
    "type": "object",
    "properties": {
      "source": { "type": "string", "description": "Registry URL or local directory of the plugin bundle" },
      "version": { "type": "string", "description": "Optional semver range" }
    },
    "required": ["source"]
  }
}

plugin_inspect inputSchema

{
  "name": "plugin_inspect",
  "inputSchema": {
    "type": "object",
    "properties": {
      "source": { "type": "string", "description": "Registry URL or local directory of the plugin bundle" },
      "target": { "type": "string", "enum": ["claude_desktop", "cursor"] },
      "version": { "type": "string", "description": "Optional semver range" }
    },
    "required": ["source", "target"]
  }
}

The FastMCP TypeScript server

import { FastMCP } from "fastmcp";
import { validatePlugin } from "./schema.js";
import { mapToClaudeDesktop, mapToCursor } from "./mappers.js";

const server = new FastMCP({
  name: "agent-plugins-installer",
  version: "1.0.0",
  headers: {
    "Mcp-Method": "tools/call",
    "Mcp-Name": "agent-plugins-installer"
  }
});

server.addTool({
  name: "plugin_install",
  description: "Fetch, validate, and install a plugin into a target client.",
  inputSchema: {
    type: "object",
    properties: {
      source: { type: "string", description: "Registry URL or local directory of the plugin bundle" },
      target: { type: "string", enum: ["claude_desktop", "cursor"] },
      version: { type: "string", description: "Optional semver range" }
    },
    required: ["source", "target"]
  },
  async execute({ source, target, version }) {
    const plugin = await fetchPlugin(source, version);
    const report = await validatePlugin(plugin);        // JSON Schema 2020-12
    if (!report.ok) return { ok: false, errors: report.errors };

    const config = target === "claude_desktop"
      ? mapToClaudeDesktop(plugin)                      // claude_desktop_config.json
      : mapToCursor(plugin);                            // .cursor/mcp.json

    const result = await writeConfig(target, config);
    return {
      ok: true,
      status: "installed",
      target,
      configPath: result.path,
      manifest: plugin.manifest,
      cacheScope: "request",
      ttlMs: 30000
    };
  }
});

// plugin_validate, plugin_update, plugin_uninstall, plugin_list_installed
// and plugin_inspect follow the same addTool pattern.

server.start();

What the mapping looks like

A plugin whose mcp.json declares one Streamable HTTP server maps into Claude Desktop's claude_desktop_config.json as:

{
  "mcpServers": {
    "acme-tools": {
      "url": "https://mcp.acme.io/sse",
      "transport": "streamable-http"
    }
  }
}

Cursor's .cursor/mcp.json gets the same entry using Cursor's native fields. Skills map into the install folder referenced by plugin.json entry points. plugin_inspect prints the exact diff before plugin_install writes anything, so you can audit changes in CI before they land on a developer's machine.

Handling updates and rollbacks

plugin_update fetches the requested semver range, re-validates against the new schema, and writes only the entries that changed. Before any write, the installer snapshots the existing config; plugin_uninstall restores that snapshot, so a rollback is a one-call operation. Because the server is stateless, every operation is idempotent and safe to retry.

mcpServers config for the installer itself

Add this to Claude Desktop's claude_desktop_config.json:

{
  "mcpServers": {
    "agent-plugins-installer": {
      "command": "npx",
      "args": ["-y", "@dailyaiworld/agent-plugins-installer"],
      "env": {
        "PLUGIN_REGISTRY_URL": "https://registry.dailyaiworld.com/catalog.json"
      }
    }
  }
}

Cursor uses the identical block in .cursor/mcp.json. From then on, installing a plugin is a single sentence: "install the acme-tools plugin into Cursor" — the installer fetches, validates, maps, and writes it, and reports the config path back.

OAuth 2.0 and the security model

• RFC 8707 resource indicators. When fetching from a remote registry, request an access token with the registry URL as the resource parameter, so the token is audience-bound to exactly that registry.
• Scopes. plugins:read for fetch and validate; plugins:manage for install, update, and uninstall.
• Stateless with explicit headers. The server is request/response only (no sessions) and uses the Mcp-Method and Mcp-Name headers from the MCP 2026-07-28 spec so transports and gateways can route and log each call without session state.
• Validate, never execute. plugin.json is validated against JSON Schema 2020-12; skills are treated as data — the installer never runs them. An install is a write of mapped config, nothing more.
• Provenance and licensing. Verify checksums, pin versions, and honor the CC-BY-4.0 terms of the Agent Plugins spec when redistributing bundles.

Where Agent Plugins fits your workflow

Combine the installer with the discovery-style tools in the MCP directory, wire install steps into the workflows you already run, and follow the latest AI news for companion specs such as Agentic Resource Discovery, which treats plugins as first-class resources. The plugin directory format is young, but tooling like this installer is exactly what makes it reproducible across machines and CI pipelines.

FAQ

What is in an Agent Plugins 1.0.0 bundle?

A directory with three pieces: plugin.json (name, version, JSON Schema 2020-12 schema, entry points), skills/ (Agent Skills format, one subdirectory per skill), and mcp.json (MCP server declarations with explicit transports).

How does the installer validate before installing?

The installer fetches the bundle, validates plugin.json against its declared JSON Schema 2020-12 schema, and only maps the config into the target client after validation passes. It never executes plugin code.

Does it work with both Claude Desktop and Cursor?

Yes. The server maps the same plugin into Claude Desktop's claude_desktop_config.json and Cursor's .cursor/mcp.json, both of which use the same mcpServers config block shape.

By Deepak Bagada, CEO at SaaSNext & Principal AI Architect.