Five AI rivals just backed a shared plugin standard. Here's why it matters for developers.

📝 摘要

Vercel 发起并发布了 Agent Plugins 1.0.0——一个开放、厂商中立的插件打包标准，将 AI Agent Skills（可复用的指令与资源目录）和 MCP 服务器封装为可分发的插件，使其能在不同 AI 客户端和运行时之间移植。OpenAI、AWS、Cursor、GitHub 和 Microsoft 五大厂商已公开支持该标准。Agent Plugins 采用 plugin.json 清单 + 固定目录结构的最小化设计，有意将安装、分发、策略和权限管理留给各客户端自行实现。

核心概念： Agent Plugins 是插件作者与客户端之间的一份开放契约，目标是让同一套 Agent Skill / MCP Server 组件无需为每个客户端单独打包即可跨平台运行。

关键技术栈 / 关键要点：

Agent Plugins 1.0.0 — 开放标准，定义了 plugin.json 清单和固定目录结构，格式极简、易于实现
Agent Skills + MCP Servers — 当前仅支持这两种组件类型；命令、钩子和智能体本身暂留客户端实现
五大厂商背书 — OpenAI、AWS、Cursor、GitHub、Microsoft 共同支持，覆盖 ChatGPT、Copilot、VS Code、Codex 等主流客户端
安全隐忧 — "write once, run anywhere" 意味着 "compromise once, run everywhere"；规范将治理、安装策略和权限管理推迟给客户端，缺乏统一安全架构
供应商命名空间风险 — 若有价值的行为全部落入 vendor namespace，标准在纸面上开放但实际锁定与碎片化可能转移
版本与回滚 — 开源 agent 更新曾导致生产工作流中断，版本化、测试和回滚能力不可忽视

关键结论 / 实践建议： Agent Plugins 是 Agent 生态走向互操作性的重要一步，但安全治理和权限管理不能依赖"以后再说"——开发者在采用该标准时应同时建立跨客户端的权限审计和版本控制机制。

OpenAI, AWS, Cursor, GitHub and Microsoft back Vercel's new Agent Plugins standard for packaging AI skills and MCP servers. Here's what it means for developers.

OpenAI, AWS, Cursor, GitHub and Microsoft have backed Agent Plugins 1.0.0, a portable package format for reusable components that extends AI agents.

Agentic infrastructure company Vercel initiated the Agent Plugins proposal along with the project’s core specifications, and detailed its release on Thursday.

Agent Plugins is an open, vendor-neutral standard for plugins that packages AI Agent Skills (the open standard directory format built to make agent capabilities portable, modular and ‘ progressively loaded ’ across different agent clients and execution environments) and MCP servers into distributable plugins in order to extend them to other AI agent clients and runtimes, or other custom AI frameworks.

Although both Agent Skills and MCP servers can be reused across different clients (clients in this sense being any application, code editor, software tool or code runtime that a software platform hosts, executes, or connects to an AI agent), the clients themselves often package and discover agent skills and MCP servers in different ways and formats.

Jonathan Hefner, member of technical staff at Vercel has blogged to explain why this matters.

“Agent Plugins gives compatible clients a common format: a directory with a plugin.json manifest and fixed locations for its components. The format is intentionally small and easy to implement, and it leaves installation, distribution, policy, user experience, and client-specific capabilities to each client,” wrote Hefner.

He noted that Agent Plugins is a contract between the developers who act as authors building extensions for agents and the clients that load them, so that now the contract is “defined and open” for both sides to shape.

Hefner, along with colleagues Eric Dodds, Andrew Qu, state that Agent Skills provides reusable instructions and resources for AI agents and MCP servers, to connect agents to tools and services. So why do developers need plugins anyway?

Why do developers need agents to plug into plugins?

In practical real world use cases, software developers will need agents and skills to connect to live databases and a variety of data feeds to run queries, cross-reference schema metadata, and feed on real-time analytics. Plugin actions might be implemented to allow agents to forge essential connections to GitHub, Jira, Slack, Figma, or cloud hyperscalers at large.

Agents also make use of plugins to connect to USB or hardware interfaces (perhaps across distributed edge environments, but also desktops), to interact with local developer environments and microservices, or to (for example) draw down juice from a map or weather API, or a payment gateway or payment processing service such as Stripe, Adyen, or PayPal’s enterprise service Braintree.

Hefner underlined the project’s status, confirming that it is openly licensed, and its maintainers, contribution process, and technical decisions are all public, so that no single company’s product roadmap sets the format’s direction.

He said that for plugin authors, Agent Plugins 1.0.0 means fewer client-specific conventions for the same component. Equally, for client implementers, the specification defines a small, deterministic contract for discovery, validation, and loading.

Have we just won the battle, but lost the war?

Senior cloud platform engineer at industrial supplies company Grainger, Pavan Madduri, tells The New Stack that Agent Plugins “solves the easy problem, not the difficult problem” as he sees it.

“Standardizing the packaging and discovery of Agent Skills and MCP servers in ChatGPT, Cursor, Copilot, and VS Code would actually be helpful plumbing – but at the same time, a plugin that is now running in six different client applications represents an additional point of failure for permissions management,” Madduri says.

“The minute something becomes ‘write once, run anywhere’ for agents, it automatically becomes ‘compromise once, run everywhere’, and this specification specifically defers governance, installation policy, and permissions management to the client application.”

In his view, the minute something becomes ‘write once, run anywhere’ for agents, it automatically becomes ‘compromise once, run everywhere’, and this specification specifically defers governance, installation policy, and permissions management to the client application.

“Interoperability without trust and permissions management is not a security architecture; it’s just another distribution method for bugs and excessive permissions,” cautions Madduri.

An important step toward making AI agents more interoperable

President and CTO of context-aware code creation and understanding toolset specialist Adronite, Edward Rothschild, tells The New Stack that he acknowledges the governance and security responsibility, but overall sees value here, saying that Agent Plugins 1.0.0 is an “important step toward making AI agents more interoperable” in modern stacks.

“The real value is in the ability to reduce the friction that has slowed enterprise AI adoption,” Rothschild says. “Rather than requiring plugin developers to package and maintain their integrations differently for every AI client or agent framework, a common standard makes those capabilities more portable across environments while still allowing organizations to maintain governance and security.”

As open standards mature, Rothschild calls for a groundswell of effort that sees standards bodies and commercial organizations alike both continuing to combine interoperability with strong identity, access controls, and operational visibility, giving developers the flexibility to code without introducing new management blind spots.

Founder of AI model hosting company EmpirioLabs, Adam Dalloul, tells The New Stack that his experience of working practice leads him to think that “agent infrastructure is nowhere near cloud and MLOps yet” today.

“We have personally had open source agent updates break production workflows after running smoothly for weeks, so versioning, testing and rollback cannot be an afterthought,” Dalloul says. “Being able to package a Skill and MCP server once and have it carry across Codex, ChatGPT, Cursor, GitHub Copilot, Kiro and VS Code is a real win, and honestly this common format should have existed already.”

“Being able to package a Skill and MCP server once and have it carry across Codex, ChatGPT, Cursor, GitHub Copilot, Kiro and VS Code is a real win, and honestly this common format should have existed already.”

He harbors one misgiving here: the client-specific extensions.

“I voice that concern because if all of the useful behavior ends up inside vendor namespaces, the standard will look open on paper while the lock-in and fragmentation just move somewhere else,” adds Dalloul.

Looking beyond, towards commands, hooks, and agents themselves

As stated, Agent Plugins 1.0.0 focuses on two component types: Agent Skills and MCP servers.

Herner confirms that other components, such as commands, hooks, and agents, remain with clients. The Technical Steering Committee may consider additional component types in future versions, as and when semantics converge and a demonstrated portability need emerges.