On August 6, 2026, the agent ecosystem got its own npm moment. A coalition of major platform operators—Amazon, Microsoft, OpenAI, Vercel, and Cursor—simultaneously adopted Agent Plugins 1.0.0, an open, vendor-neutral standard for packaging Agent Skills and Model Context Protocol (MCP) servers into portable plugins. This is not a proposal or a white paper. It is a shipped, working standard already integrated into VS Code, GitHub Copilot, Cursor, ChatGPT, and Kiro.
Google joined as a core maintainer the same day, with Kevin Hou leading the effort from the Google Developers side. The company ships two plugin producers—its Agents CLI and Data Agent Kit—though it is not yet listed as a client entry. The Technical Steering Committee includes Clare Liguori (AWS), Roshan Sadanani (Cursor), Harald Kirschner (Microsoft), Gav Verma (OpenAI), and Jonathan Hefner of Vercel, who serves as lead core maintainer. The project name, logos, domains, and GitHub organization are held in trust by a neutral entity.
While the IETF DAWN charter spent July debating the discovery layer beneath agent ecosystems in Vienna, the industry built its own answer. The DAWN working group’s charter was deferred at IETF 126 despite 12 pre-charter Internet-Drafts. Agent Plugins 1.0 does not solve the same problem—it packages capabilities, not discovery—but the timing is not a coincidence. The industry chose shipping over consensus.
The Economics of the Gatekeeper
The technical spec is open and vendor-neutral. The business model is anything but.
Agent Plugins 1.0 is notable for what it deliberately excludes: installation mechanisms, distribution protocols, provenance verification, permission models, sandboxing requirements, and marketplaces. By leaving distribution out of the standard, the coalition has ensured that each platform operator builds its own channel for how agent skills reach users.
This is where the money lands. The platform operator who ships the client becomes the gatekeeper. Because each platform controls its own distribution—and the spec defines no registry or marketplace—developers who build high-value agent skills are not just building for a standard. They are choosing which gatekeeper controls their access to enterprise buyers and their path to revenue.
The fragmentation is structural, not accidental. Each client—VS Code, Cursor, ChatGPT, Copilot, Kiro—will define its own discovery and installation experience. For enterprise technology leaders evaluating agent deployments, this means the cost of switching platforms is not just technical. It is commercial.
Anthropic’s Absence
Notably, Anthropic is absent from the coalition, despite having authored the underlying Agent Skills specification and the .claude-plugin format that informed the standard. Claude Code is not among the launch clients, and no Anthropic representative sits on the TSC.
Claude Code’s plugin format supports a broader feature set—custom subagents, hooks, LSP servers, background monitors—but it is tied to Anthropic’s own client structure using claude.md rather than the agents.md convention the coalition adopted. The absence suggests Anthropic is betting on richer, platform-specific capabilities over the coalition’s portable-but-minimal approach.
The Trust Gap
The rush to ship left a significant gap. Version 1.0 contains no provenance or trust model. Per VS Code documentation, plugins are implicitly trusted at the moment of installation. There are no cryptographic signatures, no standardized permission model, and no sandboxing requirements in the spec itself.
For enterprise environments where security and compliance are non-negotiable, this is a real hurdle. The trust gap creates demand for governance layers on top of the open standard. OpenAI Presence, which launched in July as a governance-focused control plane for enterprise agent behavior, is positioned to fill exactly this role. As MCP gateways crystallize as enterprise infrastructure, companies will need to layer proprietary control planes on top of the open plugin format to manage risk.
What Happens Next
The immediate test is whether the TSC maintains genuine neutrality or allows platform-specific friction to persist. The governance charter is designed to prevent any single vendor from holding a majority—each seat belongs to an individual, not a company—but the real enforcement will be whether competing clients implement the spec in compatible ways.
The standard is licensed under CC-BY-4.0 for the spec and Apache-2.0 for the code. That is about as open as it gets. But openness at the packaging layer does not mean openness at the distribution layer. The coalition has lowered the barrier for building agent skills. Whether the market those skills serve remains open—or becomes a series of walled gardens with a shared file format—is the question that will define the agent economy’s next phase.