The first rule of any packaging format: what you exclude defines what you ship. Agent Plugins 1.0.0 — the interoperability specification announced by Vercel alongside OpenAI, Microsoft, Cursor, GitHub, and AWS — ships with three deliberate absences. Installation. Permission models. Distribution channels. The specification standardizes Skills and MCP server references into a common wrapper, purportedly solving the directory-drift problem that plagues multi-client plugin ecosystems. Then it detaches itself from every mechanism that governs what an installed plugin is permitted to do. Deconstructing the myth of decentralized trust works best when you begin at the exclusions.
This is not a runtime. It is not a model architecture. It is a manifest convention — an attempt to abstract the lowest common denominator from several private plugin formats into a wrapper that every major client can ingest. That is useful. It is also, in its present form, a security decision disguised as a purely technical one. A packaging format without a trust boundary is a delivery vehicle. And vehicles, as any infrastructure engineer will tell you, move all cargo with equal indifference.
The pain point the coalition addresses is authentic. I encountered the same class of friction firsthand while designing a zero-knowledge proof-of-intent specification for certified AI-agent transactions. The target economic actors included non-custodial agents, DeFi protocols, and MCP-exposed data services. What I found was that portability breaks at the client boundary, not at the network boundary. A tool exposed as an MCP server is transportable — the endpoint is a URL, the invocation schema is standardized. But the plugin that wraps that endpoint is not. Each front end — ChatGPT, Cursor, GitHub Copilot, VS Code — maintains its own directory layout, its own manifest expectations, its own loading ritual. The integration developer who wants distribution across three clients maintains three packaging pipelines for the same business logic. Setup cost is duplicated. Maintenance cost is multiplied. Vendor lock-in appears in the architecture as friction rather than policy.
The AI-crypto convergence angle is not speculative. MCP servers already wrap on-chain data services, liquidity aggregators, and transaction relayers. In the near term, the canonical way a DeFi protocol will expose itself to AI agents is through an MCP server. The canonical way that MCP server gets distributed to agent clients is through a plugin format. Whatever packaging standard wins governs the supply chain of the agent economy. The first wave of protocol integration — how protocols publish tools, how agents discover them, how users authorize them — will be decided by what this format allows and what it defers.
Agent Plugins 1.0.0 targets the friction at the packaging layer. The stated mechanism: a standardized packaging format that compatible clients can recognize and load directly. This is the path from ad-hoc scripts to npm: a unified metadata file, a defined target structure, client-side import logic. The announcement's scope statement is unusually precise — 1.0.0 only standardizes Skills and MCP references. Commands and hooks, the client-specific behavior extensions, remain proprietary. Installation, permissioning, and distribution remain outside the specification's authority.
That scope sentence is the most consequential line in the announcement. Re-read it and you will notice what is absent: any reference to code signing, any requirement for a permission manifest, any statement about sandboxing, any mention of a neutral governance body, any link to a public repository, any named license. A coalition of this size can ship a specification with that many absences only by design. Tracing the entropy from whitepaper to collapse always starts with the scope statement.
Specification-to-implementation rigor requires separating what a specification claims to define from what it silently delegates. I applied this exact discipline in 2017, when my formal verification work on Ethereum's state transition function exposed three critical discrepancies between the yellow paper's gas scheduling and Geth's C++ implementation. The lesson generalizes: documents describe intent, code describes behavior, and the gap between them is where vulnerabilities iterate.
Agent Plugins 1.0.0, read as a specification, delegates the behavior-defining elements. The only path from the announcement to an implementation is an inferred manifest. Based on the participants involved — Vercel's AI SDK, OpenAI's plugin infrastructure, Microsoft's Copilot extensions, Cursor's IDE plugin system — the 1.0.0 format must be a rationalized union of existing private formats. There is no other way six organizations with shipped ecosystems converge on a shared wrapper. The common-subset hypothesis fits: a plugin identifier, declared entry points, references to MCP server endpoints, and enough metadata for a client to render the plugin in a directory listing. This is the same evolution npm's package.json underwent in the Node ecosystem — a metadata container that accretes consensus until the community mistakes it for ground truth.
None of that is trivial engineering. But the excluded dimensions are the exact dimensions where security lives. The format needs a publisher identity to anchor trust; the announcement makes no claim about a signature scheme. The format needs a way to declare what the plugin will access upon execution — network endpoints, environment variables, filesystem scope — and nothing in the described scope suggests a permission manifest exists. The format needs to express what the plugin can and cannot do after loading; the specification is silent. This is not an oversight. Permissioning is the hardest governance problem in any plugin ecosystem. Every major analogous system — Android's manifest permissions, browser extension permission prompts, Kubernetes authorization policies — treats permission declaration as a first-class concern of the artifact format, precisely because a plugin without declared permissions is a black box of unknown intent.
Lines of code do not lie, but they obscure. A manifest that describes only entry points and references obscures the fact that the executable payload arrives separately. The semantic question no authority answers: what is the trust relationship between a packaged plugin and the model that executes its instructions?
That question matters more now than it did a year ago, because autonomous agents increasingly act as principals. I built my proof-of-intent prototype around the requirement that a transaction carry cryptographic proof that it originated from a certified AI model within a specified confidence interval. The motivation was simple: when an agent can hold assets and execute commerce, the human counterparty needs verifiable evidence of what, or who, is on the other side. Agent Plugins 1.0.0 sits one layer below agents — it is the packaging layer for the tools agents invoke — but the same principle applies. You cannot have trustworthy autonomous economic activity without verifying the integrity of the tools with which agents are loaded. A plugin format that ignores identity and permissions is not neutral on this question. It is hostile to it.
One infrastructure consequence is frequently overlooked. A plugin package can carry model invocation configuration — endpoint references, API key pointers, inference parameters. If the 1.0.0 format normalizes those references, it also normalizes where agent inference is routed. Vercel's edge functions become the lightweight compute layer for plugin-triggered agent activity; remote MCP servers become the heavy inference layer. Standardization without a permission model therefore does not merely shift security risk. It may also shift the economic distribution of compute. Every plugin invocation that runs through a normalized stack is an invocation that can be metered, routed, and monetized. The format is a tariff schedule disguised as a schema.
The MCP wraparound is the structural pivot. MCP, the Model Context Protocol, standardized how an agent calls external tools at runtime. It is a protocol layer. Agent Plugins standardize how a plugin is packaged and recognized before any runtime call occurs. It is a distribution layer. The layers are orthogonal. Joined together, they form what the industry will call a standard stack: MCP for invocation, Agent Plugins for delivery, client-specific logic for experience differentiation.
That positional shift carries consequences. Anthropic's name appears nowhere in the partner list. By wrapping MCP as a packageable component, the coalition absorbs the protocol into its own distribution regime without provocation. Anthropic is left with two options: accept its protocol becoming a component of an infrastructure layer governed by others, or fork the packaging concept with a competing standard that recaptures the distribution layer. The former is a quiet demotion. The latter is a fragmentation war that contradicts the entire interoperability premise of the announcement. Architecture outlasts hype, but only if it holds. The first stress test of this architecture is whether six coalition members hold a shared governance line. The second is whether Anthropic's response — and those of smaller players whose interests the coalition did not invite — produces a second standard or an adopted one.
Now the part the announcement will not frame. A unified plugin packaging format does not only reduce the costs of legitimate developers. It reduces adversarial costs disproportionately.
The prior world had accidental security through fragmentation. An attacker who crafted a malicious Cursor plugin could not trivially repackage it for ChatGPT. Manifest schemas differed. Directory conventions differed. Execution environments differed. Each client's plugin ecosystem was a separate battlefield with a separate weaponization cost.
Agent Plugins 1.0.0 collapses that cost structure. Write one manifest, target the shared schema, and distribute across six announced compatible clients. The per-platform payload logic still differs — sandbox implementations, API surfaces, permission dialogs — but packaging, delivery format, and the user-facing installation experience are now shared. The research surface for an attacker grows to the union of client implementations. The exploit cost is bounded by the intersection of common semantics, which is to say it falls.
These are not abstractions. In 2020, when I audited Uniswap V2's factory contract, the discovered reentrancy vector mattered because the same pattern applied across a composable family of protocols. Composability created fragility through shared assumptions. The same logic governs manifest parsing across six clients. Every parser that must accept a new common format is a new implementation with new edge cases. JSON schema validation diverges between implementations. Optional fields interact unpredictably. A reference to an MCP server endpoint may be validated by one client and blindly trusted by another.
The likely attack pattern is not exotic. A well-crafted plugin behaves benignly during evaluation. It reads sensitive context during deployment. It exfiltrates through an MCP reference that the host treats as a trusted external service. The payload's destructive action is obfuscated inside a harmless-looking Skill definition whose manifest contains simply another server reference. Without a mandatory signature mechanism and a permission manifest, the detection burden falls entirely on the executing client's runtime security — precisely the element the standard declines to address.
Recall the 2020 DeFi composability pattern: protocols reached for composability first, ironed out security afterward, and the integration layer became the blast radius. Agent Plugins inherits that exact architecture — a composition format whose connectors are unauthenticated and whose execution semantics defer entirely to the host. The forecast follows directly: a wave of cross-platform plugin supply-chain attacks within the first year of meaningful adoption.
The public framing promises less fragmentation. The implementation details imply the opposite.
Commands and hooks are retained as proprietary. These are the features that make a plugin feel native to a given client — the invocation triggers, the context-menu integrations, the execution-time behavioral modifications. The standardized wrapper around Skills and MCP references standardizes the weakest form of plugin: the passive tool-calling module. Strongly differentiated capabilities remain locked to each vendor. Lock-in is not removed. It is relocated upward, from the baseline layer to the differentiation layer.
The governance vacuum is the deeper structural problem. Six companies can agree on a manifest format. History is not kind to what such coalitions produce afterward: no neutral governance body, no independent security audit requirement, no certification process, no arbitration for breaking changes, no migration policy. The pattern is familiar from crypto's standards theater — announcements that behave like specifications, roadmaps that behave like press releases. Without a public repository, a license, or a named steward, 1.0.0 is currently a co-marketing artifact with a version number.
Microsoft's participation deserves special scrutiny. The company simultaneously ships MCP support in its Copilot stack and participates in a coalition that wraps MCP under an external packaging standard. That is not schizophrenia. It is a hedge against format capture. Large platforms multi-bet by design; they would rather join a weaker standard than face exclusion from a stronger one. OpenAI's participation is similarly strategic — it contributes its plugin ecosystem to a shared format while retaining the distribution layer it cares about most. The standard does not eliminate competition. It pushes competition to a higher layer, where the real margins live.
Vercel's commercial incentive is the lens through which the entire initiative should be read. Standardizing the packaging layer anchors Vercel as the neutral default hosting surface at the exact moment AI workflows consolidate from experimental pipelines to production infrastructure. A packaging standard convened by Vercel is not neutral. It is infrastructure with a beneficial owner. Value accrues upward — from plugin format to hosting, from hosting to the AI SDK, from the AI SDK to the orchestration layer where the real margin lives. When the announcement states that installation and distribution are out of scope, it is not declining a market. It is deferring the market until the format has won.
Integrity is not a feature, it is the foundation. The current foundation is specified as "to be provided by the host."
Code signing is the first tell. If the next minor revision introduces mandatory signature verification and a registry of trusted publishers, the security posture shifts from theatrical to credible. If signing remains unspecified, treat every plugin distributed through the format as untrusted until proven otherwise. Anthropic's response is the second tell. A counter-format accelerates the fragmentation the coalition claims to resolve; adoption of Agent Plugins across Anthropic's client surface confirms MCP's transformation from protocol to component. And the first supply-chain incident is the third. The economics of attack guarantee its arrival. When it lands, the standard's exclusion of permission models will transition from a scope decision to a liability question.
The packaging format is a container for economic relationships. This coalition has decided what goes inside: Skills, MCP references, portability. It has decided what stays outside: trust, accountability, enforcement. In the infrastructure game, the party that defers security wins the announcement cycle. The party that implements it wins the stack.
