Agent Plugins 1.0 Standardizes the Package and Leaves Policy to Each Client
1Agent Plugins 1.0 Constrains the Package and Defines No Permission System
An Agent Plugin packs an agent's skills and its Model Context Protocol (MCP) servers into one installable folder. Vercel proposed the format, because the same skill or MCP server had to be repackaged for every client that ran it. AWS, Anysphere, GitHub, Microsoft and OpenAI refined it into version 1.0.0, published on August 6, 2026. The standard settles how the folder is built and shipped, while what an installed plugin may access is left to whichever client loads it. Section 4.1 sets containment rules for the files a plugin ships, then states their limit.
These containment rules govern access to files supplied by the plugin package. They do not sandbox a plugin subprocess or restrict paths supplied at runtime.
Agent Plugins Specification 1.0.0, section 4.1
A command field must carry a single executable token instead of a shell command string. Because configured environment values count as visible package data, the specification forbids credentials in them. The client rejects a plugin for most schema violations, with two documented exceptions, an unknown top-level field and a non-object extensions field.
The specification's own future-considerations document, guidance rather than requirement, states which controls it leaves out. Trust model and sandboxing requirements are missing alongside the permission system, while signature verification, secrets handling and organization allowlists appear elsewhere in the same document. The document commits none of them to a later release. It also notes that MCP servers often need credentials at runtime, without saying who supplies them or how narrowly they are scoped.
The MCP maintainers went the other way in July, when their revision made the transport stateless. That revision still leaves an ordinary tool call with no field for the person who authorized it.
2Each Client Applies Its Own Rules to the Same Plugin
Vercel's announcement names the initial technical steering committee as Core Maintainers from AWS, Cursor, Microsoft, OpenAI and Vercel. Every governance role sits with a named individual under the project's charter, which reserves no seats for companies. The changelog names ChatGPT and Codex, Cursor, GitHub Copilot, Kiro and VS Code as clients supporting the format at launch.
Each client keeps control of installation, distribution, policy, user experience, and client-specific capabilities.
Vercel, Agent Plugins 1.0.0 changelog, August 6, 2026
For a company running Cursor and GitHub Copilot alongside others, an admin sets the same rules once per client, on each vendor's schedule. Vercel had already patched the same gap in its own harness, the program that runs a model and hands it tools. CVE-2026-64650, published on July 20, describes a tool relay authorization bypass in Vercel's AI SDK Codex harness. Untrusted code in the sandbox could invoke host-exposed tools, including secret lookups, with no model-authorized tool-call event. Exploiting it needed a Linux host, an active harness session with host-provided tools and untrusted code already running in the sandbox. Vercel published workarounds alongside the fix, which now accepts a relay request only after one-time authorization matching an observed model event. The relay had trusted its caller. A check that runs on the call itself cannot be bypassed by whoever is calling.
Source: Agent Plugins, Agent Plugins Specification 1.0.0, released August 6, 2026.