Timeline: from ChatGPT Plugins to Agent Plugins
Agent Plugins is the third layer in an 18-month stack, not a standalone invention. MCP solved connecting agents to tools; Agent Skills solved teaching agents reusable procedures; neither solved how those two component types get packaged and discovered consistently across clients.
| Date | Milestone |
|---|---|
| March 2023 | OpenAI launches ChatGPT Plugins, an early open third-party extension model |
| January 2024 | OpenAI shuts down Plugins in favor of the closed GPTs Store |
| November 2024 | Anthropic releases MCP (Model Context Protocol); later donated to the Linux Foundation |
| March 2025 | OpenAI and Google adopt MCP, cementing it as the de facto tool-connection layer |
| October 16, 2025 | Anthropic launches Agent Skills in Claude Code as SKILL.md folders |
| December 18, 2025 | Agent Skills becomes an open standard at agentskills.io; Microsoft and OpenAI ship support within 48 hours |
| March 2026 | Agent Skills adoption crosses 32 tools, including Gemini CLI, JetBrains Junie, and AWS Kiro |
| July 24, 2026 | Agent Plugins 1.0.0 published as a Working Draft |
| August 6, 2026 | Public launch with a five-company TSC; Google joins as a core maintainer the same day |
Key facts at a glance
| Item | Detail |
|---|---|
| Spec version | Agent Plugins 1.0.0 (status: Working Draft) |
| Proposal initiator | Vercel |
| Steering committee | Amazon (AWS), Anysphere/Cursor, Microsoft, OpenAI, Vercel; Google added Aug 6, 2026 |
| Component types covered | Exactly two: Agent Skills, MCP servers |
| Core files | Root plugin.json manifest; skills/ directory; mcp.json for MCP server config |
| Clients at launch | ChatGPT and Codex, Cursor, GitHub Copilot, Kiro, VS Code |
| Governance | Open license, public GitHub repo (agentplugins/agent-plugins-spec); no single company controls the roadmap |
| Explicitly out of scope | Installation, distribution/marketplaces, permission models, sandboxing, trust/provenance verification, UX |
Source: Vercel blog, agent-plugins.org specification, Google Developers Blog — all published August 6, 2026.
Deep dive: what it standardizes — and why it stops there
One manifest, two component types. A plugin is a directory with a plugin.json manifest at its root. Skills live in skills/ and must conform to the Agent Skills SKILL.md format. MCP servers are declared in mcp.json, supporting stdio, Streamable HTTP, or legacy HTTP+SSE. A client that does not recognize a component type skips it rather than rejecting the whole plugin. A reverse-domain namespace (for example com.cursor.xxx/) lets clients add private extras without polluting the portable core.
The hard parts are deliberately omitted. Version 1 defines no install mechanism, no distribution protocol, no permission model, no sandboxing requirements, no trust or provenance verification, and no UX. A narrow scope is what let five competing companies agree in months. The tradeoff: whether a specific plugin is safe to run is pushed entirely onto each client.
Timing tracks adoption pressure. Agent Skills had already spread to 32+ tools within months of going open. At that scale, every client re-solving packaging independently becomes real duplicated engineering cost — the practical argument for standardizing now.
How Agent Plugins compares to what came before
| Standard | Backed by | Problem it solves | Status today |
|---|---|---|---|
| ChatGPT Plugins (2023) | OpenAI only | Third-party ChatGPT functionality | Discontinued 2024; replaced by closed GPTs Store |
| MCP (2024) | Anthropic → Linux Foundation | Protocol for agents to call external tools/data | De facto industry standard; OpenAI and Google adopted |
| Agent Skills (2025) | Anthropic → open standard | Reusable instructions/workflows for agents | 32+ tools support it; still expanding |
| Agent Plugins (2026) | Vercel + five-company TSC | Unified packaging/discovery for Skills + MCP servers | 1.0 Working Draft; Google already onboard |
Agent Plugins is not competing with MCP or Agent Skills — it sits on top of both, solving distribution friction rather than redefining how agents call tools or learn procedures.
Controversies, six steps, hard data, and what builders should do next
Security was left on the table on purpose. One month before launch, security firm AIR demonstrated a fake Agent Skill named brand-landingpage that borrowed credibility from a repository with 36,000 GitHub stars, then passed scanning at Cisco, Nvidia, and skills.sh. It reached an estimated 26,000 deployed agents via a classic TOCTOU gap. Separately, Snyk's audit of nearly 4,000 published skills found flaws in 36.8%, with 13.4% critical (credential exposure or malicious code). Agent Plugins contains zero provenance provisions.
Thin-standard skepticism vs welcome. SST author Dax Raad said he was "very much against" it, calling it "a thin standard" whose useful parts will become client-specific extensions. Developer advocate Angie Jones welcomed a way to carry skills between tools without rewriting.
Who benefits, and who is absent. A shared format can help small developers build once and reach many clients — or reinforce incumbents (ChatGPT, Cursor, Copilot) that already hold users. All five founding TSC members plus Google are U.S. companies. Alibaba, Baidu, ByteDance, and Tencent — which already treat MCP as core infrastructure — do not appear on the governance list.
Context: August 7, 2026 is GPT-5's first anniversary. The same week OpenAI shipped GPT-5.6 Luna (unlimited free-tier text chats) and GPT-5.6 Sol (a "thinking effort" slider for paid tiers). Google's framing: packaging is unglamorous infrastructure that should be shared rather than reinvented five times.
Map your stack to the three layers: MCP for connection, Agent Skills for teaching, Agent Plugins for packaging — do not treat them as substitutes.
Adopt the folder contract first: plugin.json, skills/, mcp.json — then validate against Working Draft 1.0.0 before multi-client shipping.
Assume security is your client's job: Prefer official marketplaces, verify provenance, and never trust star counts alone after the AIR / Snyk findings.
Expect private namespaces: Reverse-domain extensions will carry real power; plan for portable core plus client-specific extras.
Watch governance gaps: No Chinese vendors on the TSC yet; Anthropic is also absent from founding maintainers — follow who implements, not only who announces.
Plan 24/7 runtime separately: Packaging does not host agents. For always-on Skills/MCP workloads and iOS CI, dedicated hardware beats a sleeping laptop — see the help center.
36k stars / ~26k agents: AIR's brand-landingpage fake skill borrowed a high-star repo's reputation, bypassed Cisco/Nvidia/skills.sh, and reached roughly 26,000 agents.
36.8% / 13.4%: Snyk found security flaws in 36.8% of nearly 4,000 published skills; 13.4% were critical-severity.
32+ tools / five TSC + Google: Agent Skills adoption crossed 32 tools before packaging was unified; Agent Plugins launched with five core maintainers and Google joining day one.
Stacking alternatives: waiting for every client to invent its own folder layout keeps duplicating packaging work; treating the Working Draft as a security guarantee ignores explicit out-of-scope language; running agents on a personal Mac hits sleep, network, and queue limits. For 24/7 AI Agent workloads and iOS CI/CD, KVMNODE dedicated Mac Mini M4 cloud rental is usually the better fit: exclusive Apple Silicon, sudo access, multi-region nodes, daily/weekly/monthly billing. See the pricing page and order page.
Data as of August 7, 2026 · Sources: Vercel Blog "Introducing Agent Plugins" and Changelog; agent-plugins.org Spec 1.0.0 (Working Draft); Google Developers Blog; The Next Web; Virtualization Review; Anthropic Agent Skills posts; AIR; Snyk ToxicSkills; Help Net Security; 36Kr / Alibaba Cloud Developer Community on MCP adoption; OpenAI GPT-5.6 Sol blog; TechCrunch