# Agent Plugins 1.0 Standardizes the Package and Leaves Policy to Each Client _The Agent Plugins project released version 1.0.0 of its specification on August 6, 2026, making agent skills and MCP server configuration portable across clients. Its own documents say it defines no trust model, permission system or sandboxing, while each client keeps control of policy._ By Johannes Keienburg, CEO & Founder Published: 2026-08-10 Source: https://www.cakewalk.security/blog/agent-plugins-per-client-policy --- ## Agent Plugins 1.0 Constrains the Package and Defines No Permission System An Agent Plugin packs an agent's skills and its [Model Context Protocol (MCP)](/glossary/model-context-protocol) servers into one installable folder. Vercel proposed the format, because the same skill or MCP server had to be repackaged for every client that ran it. AWS, Anysphere, GitHub, Microsoft and OpenAI refined it into version 1.0.0, published on August 6, 2026. The standard settles how the folder is built and shipped, while what an installed plugin may access is left to whichever client loads it. Section 4.1 sets containment rules for the files a plugin ships, then states their limit. > These containment rules govern access to files supplied by the plugin package. They do not sandbox a plugin subprocess or restrict paths supplied at runtime. _Agent Plugins Specification 1.0.0, section 4.1_ A command field must carry a single executable token instead of a shell command string. Because configured environment values count as visible package data, the specification forbids credentials in them. The client rejects a plugin for most schema violations, with two documented exceptions, an unknown top-level field and a non-object extensions field. The specification's own future-considerations document, guidance rather than requirement, states which controls it leaves out. Trust model and sandboxing requirements are missing alongside the permission system, while signature verification, secrets handling and organization allowlists appear elsewhere in the same document. The document commits none of them to a later release. It also notes that MCP servers often need credentials at runtime, without saying who supplies them or how narrowly they are scoped. The MCP maintainers went the other way in July, when their revision made the transport stateless. That revision still [leaves an ordinary tool call with no field for the person who authorized it](/blog/mcp-spec-agent-access-control-accountability). ## Each Client Applies Its Own Rules to the Same Plugin Vercel's announcement names the initial technical steering committee as Core Maintainers from AWS, Cursor, Microsoft, OpenAI and Vercel. Every governance role sits with a named individual under the project's charter, which reserves no seats for companies. The changelog names ChatGPT and Codex, Cursor, GitHub Copilot, Kiro and VS Code as clients supporting the format at launch. > Each client keeps control of installation, distribution, policy, user experience, and client-specific capabilities. _Vercel, Agent Plugins 1.0.0 changelog, August 6, 2026_ For a company running Cursor and GitHub Copilot alongside others, an admin sets the same rules once per client, on each vendor's schedule. Vercel had already patched the same gap in its own harness, the program that runs a model and hands it tools. [CVE-2026-64650](https://github.com/vercel/ai/security/advisories/GHSA-qw9h-448j-6rph), published on July 20, describes a tool relay authorization bypass in Vercel's AI SDK Codex harness. Untrusted code in the sandbox could invoke host-exposed tools, including secret lookups, with no model-authorized tool-call event. Exploiting it needed a Linux host, an active harness session with host-provided tools and untrusted code already running in the sandbox. Vercel published workarounds alongside the fix, which now accepts a relay request only after one-time authorization matching an observed model event. The relay had trusted its caller. A [check that runs on the call itself](/glossary/access-control) cannot be bypassed by whoever is calling. > Cakewalk governs the action rather than the plugin, because the plugin is not the thing that acts. The MCP Gateway runs every governed call for a named person, holding the agent to least privilege rather than to whatever that person can do. It checks the call against policy at the moment it runs. One record holds what was allowed, denied or escalated across every app the agent accessed. That does not stop an install, which is not what it is for. _Comment from Gil Röder, CPO & Co-Founder_ Source: Agent Plugins, [Agent Plugins Specification 1.0.0](https://github.com/agentplugins/agent-plugins-spec), released August 6, 2026.