Agent Plugins 1.0.0 standardizes package layout, not the trust boundary

On 6 August 2026, Vercel announced Agent Plugins 1.0.0, while the associated specification repository labels the release v1.0.0. The proposal defines a common package and discovery layout for Agent Skills and MCP: plugin.json is required, with fixed skills/ and mcp.json locations. The launch materials name initial support across ChatGPT and Codex, Cursor, GitHub Copilot, Kiro and VS Code.

A shared package layout

This is a change to how an agent package is described and found. A team can prepare one recognizable structure for Skills and MCP before checking how each target client installs and runs it. Vercel says the proposal was refined with AWS, Anysphere, GitHub, Microsoft, OpenAI and Vercel, but participation is not the same as a cross-client compatibility test.

The trust boundary stays local

Version 1 covers Skills and MCP. Client extensions are namespaced rather than silently mixed into the common structure, and commands, hooks and agents remain client-specific. The supplied specification does not independently establish identical installation, discovery timing, approval prompts, environment variables, permissions, sandboxing, secrets handling or MCP semantics across clients.

A common mcp.json location also does not show that two clients expose the same server, pass the same data or apply the same policy. Portability at the file-layout level is not portability at the trust-boundary level.

A two-client pilot

1. Build a benign package containing plugin.json and skills/greet/SKILL.md.
2. Install it in two named clients with network access, file writes and secrets disabled.
3. Record whether each client discovers it, what approval it requests and which environment it exposes.
4. Check whether any MCP configuration is interpreted and whether the data flow matches the intended policy.
5. Stop if the clients disagree about permissions or unexpected access appears.

A passing result should mean only that the tested package works under the tested policies. It should not be generalized to every client.

What v1 leaves open

Watch for independent compatibility reports, clearer installation and permission guidance, and evidence about sandboxing, secrets and MCP behavior. Later versions may address commands, hooks or agents, which remain outside the v1 contract. For now, the practical upside is less duplicate packaging; security and data-flow review remain client-specific.

Sources: Vercel — Introducing Agent Plugins, Agent Plugins specification and specification repository.