Agent Plugins 1.0.0 is a small spec with a large implication: agent capabilities are becoming distributable software. Google says the open specification packages Agent Skills and MCP servers into a portable directory format, with a minimal plugin.json manifest, fixed locations for skills and mcp.json, and optional reverse-domain client extension directories. The Technical Steering Committee includes maintainers from Amazon, Cursor, Microsoft, OpenAI, and Vercel, with Google joining as a Core Maintainer.
The useful part is the restraint. The spec deliberately does not define installation, distribution, permissions, sandboxing, trust, provenance, or user experience. That sounds incomplete, but it is also honest. A portable box is not the same thing as a safe supply chain.
Grey Haven’s read: agent packaging is moving from hacky local folders toward an ecosystem layer. That is good for reuse and dangerous for governance. Once skills and MCP servers travel across clients, enterprises will need the same questions they learned from browser extensions and CI actions: who authored it, what can it call, what secrets can it see, what version is pinned, and who approved installation.
Operators should treat plugins as deployable automation, not prompt snippets. The first policy should be boring: allowlisted sources, signed or pinned versions where possible, explicit tool scopes, sandbox defaults, and a registry of installed capabilities by team.
The watch item is whether the next layer adds provenance and permission UX before adoption outruns controls. If packaging standardizes faster than trust, agent plugins become another supply-chain surface wearing a friendlier name.
Source: Google Developers Blog, “Agent Plugins package your skills, tools, and more,” published August 6, 2026.
