Agent Plugins 1.0: The Open Standard That Codifies Walled Gardens
On August 6, 2026, the agent ecosystem got its own npm moment. A coalition of major platform operators—Amazon, Microsoft, OpenAI, Vercel, and Cursor—simultaneously adopted Agent Plugins 1.0.0, an open, vendor-neutral standard for packaging Agent Skills and Model Context Protocol servers into portable plugins. This is not a proposal or a white paper. It is a shipped, working standard already integrated into VS Code, GitHub Copilot, Cursor, ChatGPT, and Kiro. Google joined as a core maintainer the same day, with Kevin Hou leading the effort from the Google Developers side. The project name, logos, domains, and GitHub organization are held in trust by a neutral entity.
The speed is the shock. I have spent years watching protocols die in working groups, where consensus is a polite term for a slow funeral. Agent Plugins 1.0 went from design to production without a prolonged interoperability bake-off. The Technical Steering Committee includes Clare Liguori (AWS), Roshan Sadanani (Cursor), Harald Kirschner (Microsoft), Gav Verma (OpenAI), and Jonathan Hefner of Vercel, who serves as lead core maintainer. This is not a vendor group hug. It is a competitive cartel choosing a common file format because the alternative—a standards debate that could stretch into the next decade—was too expensive.
The IETF DAWN working group's charter was deferred at IETF 126 despite 12 pre-charter Internet-Drafts. DAWN spent July debating the discovery layer beneath agent ecosystems in Vienna. Agent Plugins 1.0 does not solve the same problem—it packages capabilities, not discovery—but the timing is not a coincidence. The industry chose shipping over consensus.
I have seen this pattern before. In 2017, I audited the Golem whitepaper for weeks, modeling its reward distribution against transaction-fee volatility. My critique was that the tokenomics ignored the cost of coordination, and the warning was ignored; the ICO market collapsed anyway. The lesson I carried forward was simple: math does not care about your conviction. A protocol that ships a working mechanism, however imperfect, beats a proposal with immaculate specifications. The same logic applies here. The IETF was still asking who should discover agent capabilities; the vendors shipped a way to package them. That is the difference between a standard and a settlement.
The technical spec is open and vendor-neutral. The business model is anything but. This is the first invariant to grasp: a packaging standard is not a distribution standard.
Agent Plugins 1.0 is notable for what it deliberately excludes: installation mechanisms, distribution protocols, provenance verification, permission models, sandboxing requirements, and marketplaces. By leaving distribution out of the standard, the coalition has ensured that each platform operator builds its own channel for how agent skills reach users. The file format is portable. The economic relationship is not.
Let me be precise about what the standard actually contains. The spec defines how a plugin declares its metadata, how it wraps Agent Skills, and how it points to an MCP server. It honors the agents.md convention. It is licensed under CC-BY-4.0 for the spec and Apache-2.0 for the code. In terms of raw interoperability, this is as open as a protocol gets. But the moment a developer wants to publish a skill, they need a way to get that skill in front of users. The spec has no registry, no marketplace, no canonical packaging host. The developer must choose a distribution channel. Every distribution channel is owned by one of the clients.
This is where the money lands. The platform operator who ships the client becomes the gatekeeper. Because each platform controls its own distribution—and the spec defines no registry or marketplace—developers who build high-value agent skills are not just building for a standard. They are choosing which gatekeeper controls their access to enterprise buyers and their path to revenue.
I have watched this exact architecture emerge in Layer2. For two years, decentralized sequencing has been a PowerPoint; most rollups still run a single sequencer under a multisig. An open requirement does not decentralize operation. The same is true here: an open plugin format does not make the distribution layer open. The specification is the packaging; the client runtime is the sequencer.
The structural fragmentation is deliberate, not accidental. Each client—VS Code, Cursor, ChatGPT, Copilot, Kiro—will define its own discovery and installation experience. The spec is silent on how a plugin is discovered. The client gets to decide. So Cursor can make a plugin one click away, while a rival requires a manual configuration step. Copilot can feature certain skills and bury others. ChatGPT can route its own built-in plugins ahead of third-party ones. For enterprise technology leaders evaluating agent deployments, the cost of switching platforms is not just technical. It is commercial: changing clients means abandoning the distribution channel you have spent months cultivating.
There is an old trading adage: in the chaos, look for the invariant. The invariant here is not the protocol. It is the gatekeeper. The standard has standardized the file format, but it has standardized the economic locus of control even more. A decade ago, the web standardized HTML, and the browser became the gatekeeper. Today, agent plugins standardize packaging, and the client application becomes the gatekeeper. The medium changes; the rent extraction pattern remains.
Let us drill into the economics. The npm moment of the title implies a public registry where packages can be accessed freely and discovered by a community. npm's model, for all its imperfections, created a shared public good: the registry was neutral, or at least neutral enough. Agent Plugins 1.0 does not create a registry. It does not even specify how a plugin should be signed. It is a container format, not a market. If npm is a marketplace with a shared warehouse, Agent Plugins 1.0 is a standardized shipping box that each store uses to sell only its own inventory.
What does a developer of agent skills actually control? The plugin content. The metadata. The MCP server endpoint. The value created by a skill—say, a specialized compliance workflow for a bank—is real, but the discoverability is wholly dependent on the client operator. The developer may write once, but they do not run anywhere. They run where the client operator lets them.
This is why the coalition is so broad. Amazon and Microsoft are not doing this out of altruism. By agreeing on a common packaging format, they are raising barriers around their own ecosystems. A developer who builds for Agent Plugins 1.0 gains portability in principle, but in practice, the enterprises that deploy agents will standardize on one or two clients. And those clients are the very operators who wrote the standard. The standard is the opening move in a land grab.
I recall a conversation I had during the 2024 ETF approval cycle with a traditional finance analyst who described the shift as the boring boom. The same pattern is visible here. The coalition is not trying to create a vibrant, chaotic plugin ecosystem like the early npm. They are trying to create a predictable, governable, enterprise-ready environment. The open standard is the regulatory-friendly facade; the proprietary distribution channel is the moat. This is PayPal's PYUSD playbook: better to be the partner of a future regulator than the subject of one. Adoption of a neutral standard is the first step toward controlling the rules.
Now the contrarian angle. The most conspicuous absence from the coalition is Anthropic. Anthropic authored the underlying Agent Skills specification and the .claude-plugin format that informed the standard. Claude Code is not among the launch clients, and no Anthropic representative sits on the TSC. The absence is not an oversight; it is a strategy.
Claude Code's plugin format supports a broader feature set—custom subagents, hooks, LSP servers, background monitors—but it is tied to Anthropic's own client structure using claude.md rather than the agents.md convention the coalition adopted. In other words, Anthropic is betting on richer, platform-specific capabilities over the coalition's portable-but-minimal approach. The coalition's plugin is a shared box; Anthropic's plugin is a custom-built living space. The tradeoff is between interoperability and capability. The market often chooses both, but if forced to choose, developers building complex agent workflows may prefer the one that lets them define subagents and hooks, not just package an MCP server.
There is also a philosophical difference. Anthropic has positioned itself as a safety-first AI company. Its plugin model is an extension of its agent orchestration strategy: the plugin is not a file, it is a configuration of Claude's behavioral environment. The coalition's approach treats capabilities as modular units that can be installed into any runtime. Anthropic treats capabilities as emergent behaviors of a specific model with specific conventions. Neither is wrong; they are incompatible worldviews.
The conventional reading is that Anthropic is isolating itself. The contrarian reading is that Anthropic is preserving optionality. If the coalition's clients become walled gardens with a shared file format, then the portable standard may become a lowest common denominator. Anthropic can wait, let the coalition determine which classes of plugins are too complex for the standard, and then offer a richer platform that subsumes them. The absence from the TSC also means Anthropic is not bound by the governance compromise. It can adopt the standard later, on its own terms. Solitude is the price of clear vision, but it can be a strategic position.
The rush to ship left a significant gap. Version 1.0 contains no provenance or trust model. Per VS Code documentation, plugins are implicitly trusted at the moment of installation. There are no cryptographic signatures, no standardized permission model, and no sandboxing requirements in the spec itself.
Let me state that plainly: an enterprise that installs an agent plugin is trusting the plugin author completely. The plugin can access whatever the MCP server permits. It can read files, send network requests, execute commands. The spec does not define a permission model. This is a gap that would have been unthinkable in a traditional enterprise software release. But agent plugins are new, and the speed of shipping outpaced the discipline of security.
This trust gap is not a bug; it is an opportunity. It creates demand for governance layers on top of the open standard. OpenAI Presence, which launched in July as a governance-focused control plane for enterprise agent behavior, is positioned to fill exactly this role. As MCP gateways crystallize as enterprise infrastructure, companies will need to layer proprietary control planes on top of the open plugin format to manage risk. The open standard is the substrate; the governance layer is the product.
I saw the same dynamic in the DeFi summer of 2020. Protocols like Compound and Aave offered astronomical APYs, and the yield was real until it was not. My essay The Yield Trap argued that the narrative of passive yield was masking liquidity risk. The market hated that essay; institutional investors quietly nodded. The lesson was that every open system eventually needs a risk layer that is closed and careful. DeFi needed insurance protocols; agent plugins need governance planes. If the standard has no trust model, then the trust model becomes a separate layer—and the companies providing that layer will own the enterprise relationship.
The spec's licensing is deliberately permissive. That is welcome. But openness at the packaging layer does not mean openness at the distribution layer. The coalition has lowered the barrier for building agent skills. Whether the market those skills serve remains open—or becomes a series of walled gardens with a shared file format—is the question that will define the agent economy's next phase.
In my own work as an investment manager, I have learned to look at what a standard excludes as much as what it includes. A 2017 audit of Golem's tokenomics taught me to model incentives, not narratives. The crowd sees a moon; I see a model. Agent Plugins 1.0 is a model with a specific incentive topology: the file format is open, the distribution is closed. That asymmetry is the single most important fact to understand.
The immediate test is whether the TSC maintains genuine neutrality or allows platform-specific friction to persist. The governance charter is designed to prevent any single vendor from holding a majority—each seat belongs to an individual, not a company—but the real enforcement will be whether competing clients implement the spec in compatible ways. If Cursor and Copilot disagree on how a plugin declares permissions, the standard is simply a piece of paper.
I am watching for a few signals. Whether independent, non-vendor tooling emerges to manage the plugin lifecycle is a sign that the ecosystem is becoming a market rather than a set of fiefdoms. Whether enterprises start requiring cryptographic signatures before they install anything is the moment the governance layer becomes more valuable than the plugin format. Whether Anthropic eventually ships a bridge that reads agents.md but retains Claude-specific hooks is a sign that proprietary and open approaches are converging.
None of this will be decided in a headline. It will be decided in the pull requests, the plugin managers, the enterprise security reviews, and the quiet procurement decisions. I have seen the same machinery in token launches, in rollup sequencers, in ETF flows. The narrative is loud; the model is quiet. And the model is always more honest.
Agent Plugins 1.0 is a brilliant packaging standard. It is also a gatekeeper truce. The next question is whether the market accepts that truce, or builds something that makes the gatekeepers unnecessary. The web survived browser vendors by having a neutral standards body and an open source reference implementation. The agent economy does not yet have that. It has a neutral packaging format and a set of commercial clients. That may be enough to build a new economy. Or it may be enough to build a new set of chains.
I am positioning myself for the latter while hoping for the former. The next phase of the agent economy will be defined by who controls the discovery, the trust layer, and the distribution channel. The plugin format is merely the beginning. This is how revolutions become markets: they adopt a standard, then fight over the tollbooths. In the chaos, look for the invariant. The invariant is still the gatekeeper.