Agent Plugins 1.0 Is Live. Distribution Is the New Consensus.

August 6, 2026. The agent ecosystem got its npm moment. No proposal. No white paper. No polite request for comment. A single release containing a working standard. Agent Plugins 1.0.0, adopted simultaneously by Amazon, Microsoft, OpenAI, Vercel, and Cursor. It packages Agent Skills and Model Context Protocol servers into portable plugins. It is already running inside VS Code, GitHub Copilot, Cursor, ChatGPT, and Kiro. Google joined as a core maintainer that same day. The code is live. I have spent my career auditing systems that claim to be open. The pattern is always the same. Open at the protocol layer. Closed at the distribution layer. This release is that pattern, repeated with alarming precision. Governance is a myth; the bypass reveals the truth. In the agent economy, the bypass is the distribution channel. Let me be direct. Everyone will congratulate the coalition for shipping. They will call it a forward step for interoperability. They will say that the industry chose shipping over consensus at IETF, and that this is healthy. They will be partially right. And partially right is the most dangerous position to be in when you are moving an enterprise workload. Context: The invisible package manager For the uninitiated: Model Context Protocol is the plumbing that connects AI agents to external tools and data. An agent skill is the executable knowledge a model can use. A workflow. A tool-calling pattern. A memory of how to complete a task. Agent Plugins 1.0 exists to wrap these into a single artifact that can move from one agent host to another. Think of it as the .tar.gz for the agent world. The coalition includes the largest platform operators in the Western AI market. Their names are enough to move the enterprise market on their own. The Technical Steering Committee includes Clare Liguori of AWS, Roshan Sadanani of Cursor, Harald Kirschner of Microsoft, Gav Verma of OpenAI, and Jonathan Hefner of Vercel as lead maintainer. The project name, logo, domains, and GitHub organization are held in trust by a neutral entity. If you have been in crypto long enough, you know exactly what that sentence means. A neutral entity is a safe. The point of a safe is not the lock. It is the keyholder. There is no keyholder listed. Trust is a legal term, not a cryptographic one. The timing matters. The IETF DAWN working group spent July in Vienna debating the discovery layer beneath agent ecosystems. The charter was deferred at IETF 126 despite twelve pre-charter Internet-Drafts. The standards process crawled. The industry shipped. Agent Plugins 1.0 does not solve discovery. It packages capabilities. It does not define where to find a plugin. It defines how a plugin is shaped after it arrives. The two protocols are complementary. But the coincidence of timing is not a coincidence. The industry chose shipping over consensus. That is not a neutral choice. It is a power move. The subtler point is that discovery is much harder than packaging. Discovery involves reputation, trust, global namespace, and network effects. Packaging only requires a spec and a parser. Any vendor can agree to that without giving up anything important. The important asset was always the channel through which plugins are installed. The channel is still owned by each platform. Core: The economics of the gatekeeper What is deliberately excluded is more revealing than what is included. The spec is open and vendor-neutral. The business model is anything but. Agent Plugins 1.0 deliberately excludes installation mechanisms, distribution protocols, provenance verification, permission models, sandboxing requirements, and marketplaces. Read that list again. The standard has no idea where a plugin comes from. It has no idea who signed it. It has no idea what permissions it requests. It has no idea whether it runs in a sandbox. It has no marketplace. By leaving distribution out of the standard, each platform operator retains its own channel for how agent skills reach users. This is not negligence. This is architecture. The platform operator who ships the client becomes the gatekeeper. VS Code controls its plugin marketplace. Cursor controls its extension ecosystem. ChatGPT controls its storefront. Copilot controls its enterprise catalog. Kiro controls its own flow. The spec defines no registry, no marketplace, no installation mechanism. So each platform's marketplace is the only door. Developers who build high-value agent skills are not just building against a standard. They are choosing which gatekeeper controls their access to enterprise buyers, and therefore their path to revenue. It is not a technical decision. It is a commercial decision dressed in an open-source outfit. This is the same lesson I learned auditing the 2x02 protocol's ERC-20 implementation in 2017. Tracing the binary decay in 2x02 taught me that "open" means nothing when the function itself contains the flaw. The flaw here is insertion. The interface is open. The surface area is controlled by five vendors. The fragmentation is structural, not accidental. Each client defines its own discovery and installation experience. If a user installs a plugin from Cursor's marketplace, that plugin may not be usable in VS Code without a different installer. The artifact is portable. The distribution path is not. For enterprise technology leaders evaluating agent deployments, this means the cost of switching platforms is not technical. It is commercial. You are not migrating a plugin. You are migrating a supply chain. You are changing the company that owns your update channel. The "MCP gateway" conversation has been prominent in enterprise architecture. Gateways are already settling into place as infrastructure. The plugin format is the cargo. The gateway, the marketplace, the install button. That is the tariff. The neutrality theater Let us talk about governance. I have seen this movie in DAOs, token standards, and open-source consortia. The governance charter is designed to prevent any single vendor from holding a majority. Each seat belongs to an individual, not a company. That sentence is beautiful in its precision and dishonest in its implication. Individuals who work for AWS, Microsoft, OpenAI, Vercel, and Cursor are not independent actors. They have employment agreements. They have compensation structures. They have performance reviews. An individual seat is a company seat wearing a human face. The TSC is not neutral. It is a balanced board of captive executives. The project name, logos, domains, and GitHub organization are held in trust by a neutral entity. But "held in trust" does not mean "operated by the community." It means a lawyer has a deed. The legal owner can be pressured. The domains can be repatriated. The GitHub org can change hands if the entity folds. I have written enough smart-contract audits to know that "trustless" is a function of code, not of legal agreements. This standard has no code enforcement on governance. It has vibes. The real enforcement will not be the charter. It will be whether competing clients implement the spec in compatible ways. There is no conformance test in the announcement. There is no certification suite. There is only the word of the TSC. In protocol terms, this is an IOU. In 2020, I tested a timestamp manipulation flaw in Compound v1's governance voting. I replicated it locally with Hardhat scripts. The mechanism allowed a miner to manipulate block inclusion and alter a vote. The fix came two weeks later. No panic. No theatrics. Just a patch. That is how governance is supposed to work. Here, the patch mechanism is less clear. Who fixes a plugin format when the five biggest vendors have competing marketplaces? The answer is no one. Because the ambiguity is the product. The Anthropic fork Now the elephant in the room. Notable is who is not in the room. Anthropic is absent. This is remarkable because Anthropic authored the underlying Agent Skills specification and the .claude-plugin format that informed the standard. Claude Code is not among the launch clients. No Anthropic representative sits on the TSC. If you have ever debugged a dependency conflict, you know exactly what this means. The author of the upstream specification has declined to adopt the downstream implementation. That is not a scheduling conflict. That is a fork. Claude Code's plugin format supports a broader feature set. Custom subagents. Hooks. LSP servers. Background monitors. It is tied to Anthropic's own client structure using claude.md rather than the agents.md convention the coalition adopted. Anthropic is trading portability for capability. It is betting that its users prefer depth of integration to the promise of moving a plugin into ChatGPT. The coalition's format is minimal. It is portable. It is also shallow. It packages the skill, not the full behavior model. Anthropic's format is richer. It is more expressive. It is also locked to Claude Code. The two formats will coexist. Then they will diverge. Forks are not disasters; they are diagnoses. This fork diagnoses the contradiction at the heart of the standard: a portable format cannot be maximally expressive, and an expressive format cannot be perfectly portable. I have seen this exact trade-off in the blockchain world. The ERC-20 standard is minimal, portable, universally implemented. It is also the cause of a thousand hacks, because every extension became an ad hoc per-project invention. Permissions. Recovery. Pause. The rich projects built their own token standards and lost composability. The minimal standard won the mindshare. The same dynamic is about to play out in agent plugins. The question is which side of the fork gets the install button. Immutable metadata doesn't lie. It also doesn't protect you. The metadata of the TSC is public: five members, one lead. But metadata is a record, not a governance mechanism. It tells you who was in the room. It does not tell you what each person was instructed to vote for. The trust gap Here is the part that keeps me up at night. Version 1.0 contains no provenance or trust model. Per VS Code documentation, plugins are implicitly trusted at the moment of installation. There are no cryptographic signatures in the spec. There is no standardized permission model. There is no sandboxing requirement. Read that again. The supply chain's newest package format has no signature requirement. This is not a theoretical concern. Every developer in the world has seen what happens when an unauthenticated package gets published under the name of a popular project. Typosquatting. Dependency confusion. Malicious updates. The npm ecosystem has been through this. PyPI has been through this. Go module proxy has been through this. Every actor in this coalition is old enough to remember those incidents. And they still shipped a format with no signatures. That is not an oversight. It is product strategy. If the standard had built in trust, it would have centralized trust. A registry would become the high-value target. A signature authority would become the single point of failure. By omitting trust, the standard pushes the problem to the layer above: the governance platform. The enterprises that need compliance will purchase a control plane. They will plug it in on top of the plugin format. That is where the subscription revenue lives. OpenAI Presence, which launched in July as a governance-focused control plane for enterprise agent behavior, is positioned to fill exactly this role. That sentence is the key to the whole announcement. A coalition of platform vendors ships an open, untrusted plugin format. Months before, one of those vendors ships a governance layer. The open standard creates the problem. The governance layer sells the solution. This is not a conspiracy. It is a product roadmap. As MCP gateways crystallize into enterprise infrastructure, companies will need to layer proprietary control planes on top of the open plugin format to manage risk. The risk is real. But the vendor who controls the control plane will control the agents. The plugin format is just the delivery mechanism. Root access is just a permission slip. The control plane is the actual root. I have spent years in post-mortems for DeFi protocols where the admin key was "only for emergency use." The plugin marketplaces of this coalition are admin keys. The spec has no revocation mechanism. It has no signing ceremony. It has no policy engine. It says: if the plugin is in the marketplace, trust it. In 2026, this is the equivalent of downloading a .exe from a URL and double-clicking it. We spent twenty years moving away from that. The agent stack just brought it back. Consider the enterprise angle. An MCP server has access to databases, cloud APIs, internal knowledge bases, and sometimes payment systems. When you install a plugin, you are installing that server with no cryptographic guarantee of its origin. The platform marketplace is not a security layer. It is a convenience layer. The difference matters when the plugin is malicious. The platform will say buyer beware. The enterprise will say the platform let it in. The contract will decide. And the contract is probably procurement, not code. Contrarian: The blind spot is the business model Here is the contrarian angle. The pundits will look at this announcement and see interoperability. They will praise the coalition for uniting the industry. They will miss the forest for a single JavaScript file. The counter-intuitive truth is this: this open standard is the most efficient gatekeeper enabled by open source in years. It provides the appearance of open access while ensuring each platform owner retains control over the commercial layer. The spec is open. The distribution is not. It is the best of both worlds for the platform: community-driven innovation, corporate-controlled monetization. Google's participation is more nuanced than the headline. Google joined as a core maintainer and ships two plugin producers. Agents CLI. Data Agent Kit. But Google is not yet listed as a client entry. That means Google can shape the standard to ensure its producers work, while not being responsible for a client installation channel. A producer without a client is a miner without a mempool. Google is supplying goods to the marketplaces but not competing in them. That is a hedge, not a commitment. Anthropic's absence is the most honest move in the announcement. Anthropic knows that the value of a plugin standard is not the format. The value is the distribution channel. Since Anthropic does not control any of the major distribution channels, why would it cede its own richer format to a coalition that will become the vehicle for its competitor's storefronts? The correct move for Anthropic is to double down on Claude Code's native format and let its users demand plugins on Anthropic's terms. That is what a rational protocol actor does. The trust gap is equally counter-intuitive. It is not a flaw. It is inventory. There is no way to monetize an open standard with built-in trust. But a standard that confuses trust with installation is the perfect substrate for premium security layers. The coalition's omission of provenance is the same trick as the IETF deferring DAWN: the appearance of technical purity masks the economic capture. Compile the silence, let the logs speak. The silence here is the absence of signatures. The logs will show which enterprises had incidents first. The vendors will note the first breach, then sell the fix. It has always worked that way. This is the same shape as the EigenLayer review I did in 2024. I found a race condition in the slasher contract's reward distribution logic. The protocol claimed slashing enforcement. The code did not enforce it in all orderings. The fix required reordering state transitions. Here, the protocol claims portability. Distribution says otherwise. The stack is honest; the operator is not. Takeaway: Watch the install button The immediate test is not whether the TSC maintains neutrality. It is whether competing clients implement the spec in compatible ways. If VS Code's plugin installer requires one set of fields and Cursor requires another, then the "vendor-neutral" standard is just a suggestion. We will know within six months. The spec is licensed under CC-BY-4.0. The code is Apache-2.0. That is about as open as it gets. But openness at the packaging layer does not mean openness at the distribution layer. The coalition has lowered the barrier for building agent skills. Whether the market those skills serve remains open, or becomes a series of walled gardens with a shared file format, is the question that will define the agent economy's next phase. The blockchain community understands this pattern. We had open standards for NFTs. OpenSea still controlled the market. We have open standards for tokens. Uniswap captured the exchange flow. We have open standards for governance. The whales still control the votes. Openness is a feature of the protocol, not the economy. Agent Plugins 1.0 is no different. Heads buried in the hex, eyes on the horizon. The horizon here is clear. The format will succeed. The infrastructure will fragment. The gatekeepers will consolidate. The plugins will be portable. The revenue will not be. If you are an enterprise architect building on Agent Plugins, do not ask whether the standard is open. It is. Ask who can update the plugin. Ask who signs the release. Ask who controls the marketplace. Ask whether your permission policy lives in the plugin or in the vendor's cloud. If the answer is the vendor's cloud, you are not holding infrastructure. You are holding a license. Tracing the binary decay in 2x02 taught me that the flaw is not always in the code. Sometimes it is in the spec's decision to leave certain bytes unspoken. In this case, the unspoken bytes are the installation channel, the trust model, and the marketplace. Those missing bytes are the product. The standard is the envelope. The gatekeeper is the stamp. The agent is not yours. It never was.