Google Joins Agent Plugins 1.0.0 as Core Maintainer

Key takeaways

1. Read the announcement through governance before technology. The format matters less than who holds it: a TSC of Core Maintainers from Amazon, Cursor, Microsoft, OpenAI, Vercel, joined by Google. Six competing players on a packaging layer. Anthropic is not on the list of maintainers — even though Agent Skills and MCP, the two packaged formats, come from it. Do not overinterpret (absence from this list is not exclusion, and the post says nothing about the rest of the governance), but the fact stands: the layer that makes Anthropic's formats distributable is being standardized elsewhere. Compare with [[openai-agentic-ai-foundation-linux-2025-12-09]] on the open standardization of the agent layer, and [[janakiram-agent-platform-portability-contract-2026-07-20]] on the portability contract between platforms.
2. The diagnosis, reusable as-is. "The core problem isn't the components. It's the manifest." A skill is portable, an MCP server is portable; the box is not, and every client had to invent it. Symptoms to recognize in your own distribution: one fork per client, two copies of identical components, and the drift that follows.
3. The format in five lines, worth remembering. ` reports-plugin/ ├── plugin.json # $schema + name: two useful lines ├── skills/summarize/ # SKILL.md, scripts/, references/ (Agent Skills spec) ├── mcp.json # an explicit type on each entry └── com.example.client/ # proprietary extension space, ignored by others ` → The explicit type kills a real ambiguity: no more transport guessed from the shape of the config object (stdio / Streamable HTTP / legacy HTTP+SSE).
4. The best design idea: what the manifest cannot do. plugin.json can neither relocate a component nor declare it inline. Consequences: no discovery path to configure, no precedence order to learn. This is an engineering choice transferable well beyond agent plugins — any expressiveness left to a configuration file becomes a surface of divergence between implementations. Here, the format is made portable by removing power from it.
5. The resulting operational rule. "Independent components fail independently." An mcp.json server that fails to start does not take the plugin's skills down with it — the client skips the entry, keeps loading, and reports the failure. Worth verifying explicitly in any client that claims to implement the spec: it's the kind of guarantee that turns out to be missing in production.
6. The reverse-domain escape hatch — and its downside. com.example.client/ is an extension space owned by a single client (hooks, agents, commands), ignored by others. Stated argument: the portable core stays small because the non-portable parts have a legitimate place to go. The same mechanism is the vector through which portability can hollow out: if usage value gradually migrates into the proprietary directories, the plugin remains formally portable while becoming practically single-client. Metric to watch on your own plugins: what share of functionality lives outside the portable core.
7. The section rarely seen in a platform post. — "Not every skill should be a Plugin": a single MCP server to a single client → mcp.json alone remains the simplest answer; a single skill → no plugin needed. The format is only justified for components that belong together and must travel together. A criterion to apply before converting an existing repository.
8. What v1 excludes, to be read as a list of risks you must cover yourself. no installation mechanism, no distribution protocol, no permissions model, no sandboxing requirement, no trust or provenance verification, no UX. The post justifies this (the obligations of an IDE, a CLI, and an enterprise platform genuinely differ) and owns it under future considerations. Translation for whoever deploys: a standard format that makes it easier to circulate executable code (skills with scripts/, MCP servers) without a provenance layer shifts the supply-chain burden entirely onto the client and onto you. Worth examining alongside [[valente-zalewski-beyond-zero-enterprise-security-ai-era-2026-07-20]] and [[sfeir-anthropic-sdlc-ai-native-securise-2026-07-26]]: execution perimeter, network egress restriction, third-party skill review.
9. The four-layer stack — table worth reusing. | Job | Layer | What it does | |---|---|---| | Find | Agentic Resource Discovery | open protocol: "what exists for this task?" — already treats the plugin as a first-class resource, before invocation | | Describe | AI Catalog | catalog format indexed by ARD; proposed registration of the application/agent-plugins+json type | | Package | Agent Plugins | a directory, fixed locations | | Run | MCP + Agent Skills | the execution contracts, already portable | → Each layer is independently adoptable: publishing a plugin without a catalog entry, cataloging a resource that isn't a plugin, running skills without a plugin. "Adopting one never obligates you to the next." A promise worth checking against the facts. Graph convention (cf. girard-acp-deux-protocoles-un-sigle-2026-08-02): never create an ARD entity — the canonical entity is Agentic Resource Discovery, "ARD" is only an alias.
10. What is shipping today. Agents CLI (Google skills for agent building, evaluation, deployment, observability, publishing — usable from Antigravity, Gemini CLI, Claude Code, or Cursor) and Data Agent Kit (BigQuery, Spanner, Cloud SQL). Note the phrasing: "Those skills were already distributable. Now they're distributable in a format that isn't ours alone." — the novelty is not the capability, it's the neutrality of the container.
11. Meta / to link. on the packaged building block, agent-skills-anthropic-2025-10-16 and claude-skills-document-manipulation-willison-2025-10-10; on the client↔agent layer stacking above it, agentclientprotocol-introduction-2026-08-02; on skill discovery and directories in practice, graphify-net-annuaire-ia-coding-2026-08-06 and skill-shamsi-graphify-2026-08-06; on competing instruction formats, gao-vercel-agents-md-outperforms-skills-evals-2026-01-27 (Vercel, also a Core Maintainer here).