Agent Plugins 1.0: OpenAI, Google и пять гигантов упаковали Skills+MCP — что стандартизировали и что сознательно выкинули
6 августа 2026 OpenAI, Vercel, Microsoft, Amazon и Cursor (Anysphere) как пять членов Technical Steering Committee публично выпустили Agent Plugins 1.0 — directory contract, в который Skills и MCP servers кладутся в один discoverable bundle для ChatGPT/Codex, Cursor, GitHub Copilot, Kiro и VS Code. Google в тот же день вошёл как core maintainer. Релиз за день до годовщины GPT-5 (7 августа) читается как pivot OpenAI: меньше «ещё один leaderboard», больше «кто owns agent packaging layer».
1. Три pain points: фрагментация, security offload, absentee TSC
- Один extension — N packaging dialects: Agent Skills закрывают «как teach reusable playbook», MCP — «как wire external tools», но discovery/layout в ChatGPT, Cursor, Copilot historically diverged. Engineering friction сидит в последней миле — duplicate directory scaffolding per client.
- Unified packaging ≠ unified security: Spec явно не определяет install, distribution, permissions, sandbox, trust/provenance. За месяц до релиза AIR demo'ил malicious Skill
brand-landingpage— reportedly ~26 000 agents touched (часть enterprise). Snyk audit ~4 000 live skills: 36,8 % security defects, 13,4 % critical (malware, credential leak). Agent Plugins это не чинит. - TSC roster = signal про parallel stacks: founding TSC + Google — US vendors; Alibaba, Baidu, ByteDance, Tencent (уже с MCP marketplaces) в drafting list не фигурируют. Может быть lag, может быть ещё один protocol fork layer.
2. Таймлайн: от ChatGPT Plugins к Agent Plugins
Extensibility для agents не invented yesterday — Agent Plugins — latest link в chain, не reboot с нуля:
| Дата | Событие |
|---|---|
| Март 2023 | OpenAI launches ChatGPT Plugins — third-party extensions для ChatGPT |
| Январь 2024 | После GPTs store OpenAI phased out Plugins → более closed platform mode |
| November 2024 | Anthropic ships MCP (Model Context Protocol), later donated to Linux Foundation |
| Март 2025 | OpenAI и Google announce MCP support — de-facto industry wire protocol |
| 16 октября 2025 | Anthropic introduces Agent Skills в Claude Code — SKILL.md для reusable instructions |
| 18 декабря 2025 | Agent Skills → open standard (agentskills.io); Microsoft и OpenAI follow в 48 часов |
| Март 2026 | Agent Skills adoption >32 tools — Gemini CLI, JetBrains Junie, AWS Kiro и др. |
| 24 июля 2026 | Agent Plugins spec 1.0.0 first published как Working Draft |
| 6 августа 2026 | Vercel leads public launch с OpenAI, Microsoft, Amazon, Cursor; Google same-day core maintainer |
Job of Agent Plugins: положить Skills + MCP servers в один discoverable directory bundle, который разные clients могут load без per-vendor reshuffle.
3. Core data sheet
| Поле | Значение |
|---|---|
| Spec version | Agent Plugins 1.0.0 (status: Working Draft) |
| Proposal author | Vercel |
| TSC | Amazon (AWS), Anysphere (Cursor), Microsoft, OpenAI, Vercel; Google — core maintainer с 6 авг 2026 |
| Component types в v1 | Ровно 2: Agent Skills, MCP servers |
| Core files | Root plugin.json; skills/ + SKILL.md; mcp.json для server config |
| Day-one clients | ChatGPT & Codex, Cursor, GitHub Copilot, Kiro, VS Code |
| Governance | Open license, public repo GitHub agentplugins/agent-plugins-spec, no single-vendor roadmap lock |
| Explicitly out of scope v1 | Install mechanism, marketplace/distribution, permission model, sandbox, trust/provenance, UX |
Источники: Vercel blog, agent-plugins.org spec, Google Developers Blog — все 6 августа 2026.
4. Deep dive: что в scope, что out of scope
4.1 Один manifest, два component types
Design intentionally minimal: plugin = directory; root plugin.json declares spec version. Skills live under skills/ в формате Agent Skills SKILL.md. MCP wiring в mcp.json — stdio, Streamable HTTP и другие transports из MCP ecosystem. Client parses tree: unknown component type или malformed fragment → skip component, not reject entire bundle. Reverse-domain extension namespace (e.g. com.cursor.xxx/) lets vendors attach private capabilities без pollution общего contract.
4.2 Deliberate blanks = real negotiation surface
Spec text: v1 не defines install, distribution protocol, permissions, mandatory sandbox, trust/provenance checks, UX — всё client-side policy. Agent Plugins answers «как выглядит box», not «можно ли trust contents» или «откуда download». Narrow scope → faster consensus; price → каждый client сам security officer.
4.3 Почему сейчас, не год назад
MCP и Agent Skills прошли путь vendor proto → open donation → industry follow. Agent Plugins multi-vendor с day one. Agent Skills за полгода → >32 adopting tools; без shared packaging everyone duplicates last-mile scaffolding — critical mass reached.
5. Horizontal compare: предшественники
| Стандарт / продукт | Инициатор | Problem solved | Статус |
|---|---|---|---|
| ChatGPT Plugins (2023) | OpenAI solo | Third-party features для ChatGPT | Deprecated 2024 → closed GPTs store |
| MCP (2024) | Anthropic → Linux Foundation | Wire protocol: agent ↔ tools/data | De-facto standard; OpenAI, Google onboard |
| Agent Skills (2025) | Anthropic → open standard | Reusable instruction/workflow packs | >32 tools, rapid expansion |
| Agent Plugins (2026) | Vercel + five-vendor TSC | Unified pack + discovery для Skills + MCP | 1.0 Working Draft; Google joined launch day |
Agent Plugins не replaces MCP или Skills — adds packaging contract one layer up. Last-mile engineering, not redefinition of tool invocation.
6. Controversy: open spec ≠ zero risk, ≠ zero agenda
- Security explicitly client-side: AIR public demo — malicious Skill
brand-landingpage, borrowed reputation of ~36k-star repo, bypassed scanners at Cisco, Nvidia, skills.sh; reportedly ~26k agents reached (enterprise accounts included). Classic TOCTOU: clean URL at scan time, malicious redirect post-approval. Snyk ToxicSkills on ~4k live skills: 36,8 % flaws, 13,4 % critical. Spec touches none of this. - «Too thin a standard»: SST author Dax Raad publicly opposed — «very thin», useful bits become private client extensions anyway. Counter: dev advocates like Angie Jones welcome — finally portable skill bundles across tools.
- Who wins unified packaging: Pro: indie devs ship once, hit multiple clients. Con: distribution still gated by whichever agent app user opens — head clients may capture more value through shared plugin layer.
- China big tech absent from TSC: Alibaba, Baidu, ByteDance, Tencent — MCP yes, Agent Plugins drafting no. Timing lag or another parallel protocol stack at packaging layer.
7. Context: от model race к infra race
Launch timing: 7 августа — GPT-5 first anniversary; OpenAI announced Agent Plugins eve before. Same week: GPT-5.6 Luna для free tier (text limits lifted), GPT-5.6 Sol для paid (thinking intensity slider). Signal: OpenAI, Google, Microsoft pivot toward agent infrastructure. Google blog line: «packaging is unglamorous but necessary infra — should be shared, not reinvented five times». Stack read: MCP = connect, Agent Skills = teach, Agent Plugins = distribute — three layers для scalable agent reuse.
8. HowTo: пять шагов адаптации Agent Plugins
- Layer map — no replacement fallacy: MCP = connect; Skills = teach; Plugins = pack/discover. Existing
SKILL.mdor MCP server → add directory contract, not rewrite stack. - Day-one client + component boundary check: ChatGPT/Codex, Cursor, Copilot, Kiro, VS Code — launch set; v1 only Skills + MCP servers; extras via reverse-domain private namespace.
- Directory scaffold:
plugin.json→skills/(Agent Skills compliant) →mcp.json(stdio / Streamable HTTP). Expect skip-unknown, not fail-whole-bundle. - Security review orthogonal to spec: Official marketplaces, repo provenance, commit history; treat third-party skills like untrusted npm — TOCTOU link swaps. AIR + Snyk data = mandatory reading.
- 7×24 remote Mac multi-client smoke: Compatibility matrix needs Cursor + VS Code + OpenClaw parallel long runs; laptop sleep kills baseline. Plugin repo on always-on Apple Silicon via SFTP/rsync — production-adjacent rhythm.
9. Матрица host для agent smoke
| Схема | Use case | Limit | Multi-client smoke |
|---|---|---|---|
| Личный ноутбук + Cursor | Читать spec, draft single Skill | Sleep прерывает long soak; hard parallel clients | ⚠️ Draft OK, matrix weak |
| Generic cloud Linux VM | Pure MCP stdio / HTTP server tests | No native macOS / Cursor desktop stack; client paths constrained | ⚠️ Server-side only |
| SFTPMAC remote Apple Silicon Mac | Cursor + VS Code + OpenClaw + plugin SFTP sync | Plan tier + bandwidth planning | ✅ Stable base для spec landing window |
10. FAQ
Q1: Agent Plugins vs MCP vs Agent Skills — замена?
A: Нет. MCP — wire к tools/data; Skills — reusable instructions в SKILL.md; Plugins — unified pack/discovery поверх. Layered, not competitive.
Q2: Обычный dev должен care сейчас?
A: Если ship extensions в Claude Code, Cursor, ChatGPT и уже на Skills/MCP — yes: one bundle, multiple clients. Pure end-user — little visible change short term.
Q3: Spec безопасен? Malicious plugin risk?
A: Spec provides zero security guarantees — layout only, no scan/sandbox/provenance. Client owns trust decision. Prior malicious Skill campaigns bypassed major scanners; don't trust stars or «looks legit» repo.
Q4: Alibaba, Baidu, ByteDance follow?
A: Not on TSC list; MCP widely supported. Open spec → any client can implement; no public Agent Plugins adoption plans from Chinese giants yet — watch releases.
Q5: Second ChatGPT Plugins (2023) that gets killed?
A: Different governance: 2023 Plugins = single-vendor product, kill switch in one boardroom. Agent Plugins = multi-vendor open spec — one exit doesn't erase spec. Real risk is neglect if clients prefer private extensions over shared packaging. Too early; watch next months adoption.
Источники: Vercel «Introducing Agent Plugins» + Changelog (6 авг 2026); agent-plugins.org Spec 1.0.0 Working Draft; Google Developers Blog «Agent Plugins package your skills, tools, and more» (6 авг 2026); The Next Web, Virtualization Review (6 авг 2026); Anthropic «Introducing Agent Skills» (16 окт, 18 дек 2025); AIR, Snyk ToxicSkills, Help Net Security — malicious Skill reports; 36Kr, Alibaba Cloud dev community — MCP adoption в China vendors; OpenAI «Improving GPT‑5.6 Sol in ChatGPT», TechCrunch (6 авг 2026). Данные по состоянию на 7 августа 2026; verify before production decisions.
11. Итог: value, limits и engineering substrate
Core value Agent Plugins 1.0: Skills + MCP в одном directory contract — меньше duplicate last-mile packaging per client. Timeline, data sheet и horizontal compare дают enough signal для «migrate packaging now or wait» decision.
Limits explicit: install, marketplace, permissions, sandbox, provenance — deliberately out of scope; AIR/Snyk supply-chain findings pass through untouched; China giants not in TSC — packaging layer may fork again. None of this spec fixes.
Next step — multi-client compatibility matrix на Cursor, VS Code, OpenClaw с одним plugin bundle — laptop exposes hidden cost: spec example runs, matrix never finishes. Safer: dev + smoke env на always-on Apple Silicon remote Mac, plugin repo via SFTP/rsync. Аренда удалённого Mac SFTPMAC — native Cursor/VS Code, low-latency callbacks, 7×24 uptime: convert announcement into reproducible engineering output.