The Portable Standard That Built Permanent Gatekeepers: An Audit of Agent Plugins 1.0

The ledger shows a rare event. On August 6, 2026, five competitors signed the same file. Amazon. Microsoft. OpenAI. Vercel. Cursor. They shipped Agent Plugins 1.0.0 — an open, vendor-neutral specification for packaging Agent Skills and Model Context Protocol (MCP) servers into portable plugins. Not a proposal. Not a white paper. A shipped, working standard with live integrations in VS Code, GitHub Copilot, Cursor, ChatGPT, and Kiro. Google joined as a core maintainer the same day, with Kevin Hou leading the effort from Google Developers. Google ships two plugin producers — Agents CLI and Data Agent Kit — though it is not yet listed as a client entry. The Technical Steering Committee includes Clare Liguori of AWS, Roshan Sadanani of Cursor, Harald Kirschner of Microsoft, Gav Verma of OpenAI, and Jonathan Hefner of Vercel, who serves as lead core maintainer. The project name, logos, domains, and GitHub organization are held in trust by a neutral entity. In twenty-two years of watching infrastructure markets — first as a software engineer auditing smart contracts, then as a copy trading community founder tracking institutional flows — I have learned an immutable truth. Consensus is easy in a bull market. Commitment is hard when the code ships. Five competitors agreeing on a file format is not the same as five competitors agreeing on a market. The spec is open. The business model is not. And that gap is where the agent economy will generate its next generation of monopolies. Ledgers do not lie, but liquidity always flees. The ledger here is the plugin spec. The liquidity is developer attention. Watch where it goes. Context first. Agent Plugins 1.0 standardizes two things. The first is Agent Skills: self-contained descriptions of an agent's capabilities, with the instructions and assets required to execute them. The second is MCP servers: the Model Context Protocol servers that provide tools, resources, and prompts to models. A plugin wraps both into a portable, installable package. That is what the spec does. It defines the package. It does not define the road the package travels. The timing matters. The IETF DAWN working group spent July in Vienna debating the discovery layer beneath agent ecosystems. Twelve pre-charter Internet-Drafts were pending. The charter was deferred at IETF 126. Agent Plugins 1.0 does not solve the problem DAWN was chartered to address — it packages capabilities, not discovery — but the sequence is not coincidental. The market chose shipping over consensus. I understand this sequence personally. In 2020, I deployed $150,000 into Uniswap V2 ETH/USDC pools, running a standardized rebalancing script I coded myself. The script executed 4,200 rebalances in three months, yielding a 34% APR. When the market dipped, my pre-set stop-loss parameters cut losses immediately. No emotion. No attachment. Just code. I learned that infrastructure standards emerge when capital demands a clearing price, not when committees agree. The ERC-20 standard won because liquidity flowed through it. Agent Plugins 1.0 will live or die on the same basis. The technical architecture of the standard is worth understanding before we reach the commercial analysis. A plugin contains a manifest — a structured file that declares what the plugin does, what models it targets, what tools it exposes, and what assets it needs. The manifest references the agents.md convention for documentation. It points to MCP server configurations. It binds the skill's logic to the client's execution environment. The portability comes from the manifest's neutrality. Any client that understands the manifest can load the plugin. That is the promise. The reality is more complicated, as we will see. Part 1 — What the Standard Actually Standardizes The market is celebrating Agent Plugins 1.0 for what it includes: the manifest format, skill metadata, MCP server descriptors, and the agents.md convention. This is the packaging layer. The packaging layer is genuinely important. Think of it as the Helm chart moment for agents. Kubernetes defined the container orchestrator. Helm defined how applications get packaged into portable charts. Without Helm, Kubernetes deployment was ad hoc. Without Agent Plugins, agent skills were siloed in each client's private format. The portable package is a necessary condition for an ecosystem. But necessary is not sufficient. What the coalition deliberately excluded matters more. Version 1.0 includes no installation mechanism. No distribution protocol. No provenance verification. No permission model. No sandboxing requirements. No marketplace. No registry. This is not an oversight in a rushed release. It is a structural decision about where the money lands. A packaging standard without a distribution layer is a file format with a trust problem. The platform operator who ships the client becomes the gatekeeper. Because the spec defines no canonical registry — no authoritative source of truth for discovery — each client defines its own discovery and installation experience. VS Code has one. Cursor has another. ChatGPT has a third. Copilot has a fourth. Kiro has a fifth. The fragmentation is not accidental. It is designed. Part 2 — The Commercial Architecture of Omission Let me be explicit about the business structure. When a developer builds a high-value agent skill, they are not just building a portable plugin. They are choosing which gatekeeper controls their access to enterprise buyers. If the plugin is packaged for ChatGPT's distribution channel, OpenAI controls the commercial relationship. If the plugin is packaged for Cursor's channel, Cursor controls the relationship. The cost of switching platforms is therefore not technical. It is commercial. Migrating a plugin from one channel to another may be trivial — the spec guarantees it — but migrating the business relationship is not. The enterprise customer who discovered the skill through OpenAI's marketplace has a relationship with OpenAI. That relationship is an asset. That asset is a moat. I have seen this exact architecture before. In 2021, I bought ten Bored Ape Yacht Club NFTs for $380,000. I was not buying art. I was buying liquidity. When the market overheated in November, I liquidated all positions within 72 hours, securing a 110% return before the crash. My peers criticized my lack of community loyalty. I said profit-taking is a rule, not a sentiment. The lesson extended beyond NFTs. The BAYC standard was open. The marketplace — OpenSea — was the gatekeeper. OpenSea controlled listings, fees, and curation. The NFT assets were portable, but the marketplace relationships were not. The same pattern now applies to agent skills. The plugin format is open. The discovery layer is proprietary. The value will accumulate where discovery happens. Part 3 — Distribution Is the Political Act The exclusion of distribution from Agent Plugins 1.0 is often described as a limitation. I see it as a statement. By leaving distribution out of the standard, the coalition has ensured that each platform operator builds its own channel for how agent skills reach users. Each channel has its own discovery experience. Each has its own installation process. Each has its own developer terms. Each has its own fee structure, real or future. This is a political act disguised as a technical decision. The IETF DAWN charter would have addressed the discovery layer — the layer that determines who can find what. It was deferred in Vienna despite twelve drafts. The industry did not ship a discovery standard because the industry does not want a discovery standard. Walled gardens want discovery to remain proprietary. I have watched this political game in blockchain markets for years. My opinion on oracle feeds is well documented: latency is DeFi's Achilles' heel, and the so-called decentralization of nodes is often a comfortable fiction. Layer2 sequencers tell the same story — single centralized nodes wearing a decentralization costume. The same pattern appears here. The coalition that announces openness while retaining the only layer that matters — distribution — is not building an open ecosystem. It is building a walled garden with a neutral facade. The standard is CC-BY-4.0 for the spec and Apache-2.0 for the code. The licenses are as open as it gets. But the licenses cover the package format, not the channel. The format is free. The channel is not. Part 4 — The Anthropic Divergence The most significant absence from the coalition is Anthropic. This is not a small detail. Anthropic authored the underlying Agent Skills specification. The .claude-plugin format informed the new standard. And yet Claude Code is not a launch client. No Anthropic representative sits on the Technical Steering Committee. Why would the author of the underlying technology refuse to participate in its distribution? The answer is in the feature set. Claude Code's plugin format supports custom subagents, hooks, LSP servers, and background monitors. It is tied to Anthropic's own client structure using claude.md rather than the agents.md convention the coalition adopted. The coalition chose portability. Anthropic chose capability. This is a strategic fork, not a technical disagreement. I watched the same fork in blockchain infrastructure. Bitcoin chose immutability over scalability. Ethereum chose programmability over purity. Both choices were rational. Both created different value captures. The protocol that won was not the one with better technology. It was the one that attracted the liquidity. Anthropic's bet is that richer, platform-specific capabilities outperform portable-but-minimal ones. This bet can work in the short run. Claude Code has a loyal developer base and a reputation for sophisticated agent behavior. But the agent economy runs on network effects. The client with the most plugins wins the long tail. If the coalition's portable standard captures the long tail — and Anthropic's proprietary format captures only the high end — the long tail wins by volume. Technical superiority is irrelevant at the margin. Distribution is everything. Part 5 — The Trust Model Problem Version 1.0 contains no provenance or trust model. This is the most serious problem in the room. Per VS Code documentation, plugins are implicitly trusted at the moment of installation. No cryptographic signatures. No standardized permission model. No sandboxing requirements. Let me put this in language any security engineer will recognize. An agent plugin that can execute code is an attack surface. An agent plugin that can read files or call APIs is a data exfiltration vector. An agent plugin that is implicitly trusted at installation is a re-entrancy vulnerability waiting to be exploited. In 2017, I spent six weeks auditing the 0x Protocol v1 exchange proxy during the ICO boom. I identified a critical re-entrancy vulnerability in the exchange proxy contract. The vulnerability allowed a malicious contract to re-enter the exchange function before state updates were complete. My fix merged within 48 hours. The lesson was not that 0x was sloppy. The lesson was that trust in code is a function of verification, not intent. Agent Plugins 1.0 has no such verification. Implicit trust is not a trust model. It is a deferral of trust. For enterprise environments where security and compliance are non-negotiable, this is a real hurdle. The trust gap creates demand for governance layers on top of the open standard. This is exactly where OpenAI Presence enters. Presence launched in July as a governance-focused control plane for enterprise agent behavior. As MCP gateways crystallize as enterprise infrastructure, companies will need to layer proprietary control planes on top of the open plugin format to manage risk. I find this deeply ironic. The coalition built an open standard. The commercial opportunity is in the proprietary layer that rescues the standard from its own naivety. The trust gap is not a bug. It is the business model. In 2022, when Terra/Luna collapsed, I executed an emergency risk assessment on my remaining portfolio within hours. I liquidated 80% of my assets into stablecoins. I documented the process in a viral post titled "The 4-Hour Protocol." The core lesson: in a crisis, trust is a liability unless verified. The same applies to agent plugins. An open standard without a trust model is not an open ecosystem. It is a permissionless attack surface. Part 6 — Governance Without Enforcement The Technical Steering Committee is designed to prevent any single vendor from holding a majority. Each seat belongs to an individual, not a company. That is a governance fiction, but a useful one. Let me examine the fiction. Clare Liguori works for AWS. Roshan Sadanani works for Cursor. Harald Kirschner works for Microsoft. Gav Verma works for OpenAI. Jonathan Hefner works for Vercel. The seats may be individual, but the incentives are corporate. The governance charter is designed to prevent domination. The real enforcement will be whether competing clients implement the spec in compatible ways. This is the classic fork point. The standard is open. The implementations are not. Each client can choose to be more or less compatible. Each can choose to extend the standard in proprietary directions. I have seen this before. In January 2024, before the spot Bitcoin ETF approval, I analyzed the flow data of BlackRock and Fidelity filings. I identified a $2.1 billion inflow anomaly that preceded the official launch. I published a standardized report predicting a 15% price surge within two weeks. It held. The lesson: institutional flow data is the real signal, not the media narrative. The same applies to governance. The real signal in agent infrastructure will be implementation compatibility, not the governance charter. The current TSC balance is a contract. Contracts are only as good as their enforcement. And enforcement in open standards is entirely voluntary. The moment one client decides that its commercial interest requires a divergence in plugin discovery — or a proprietary extension to the permission model — the governance structure will bend or break. The standard is licensed under CC-BY-4.0 for the spec and Apache-2.0 for the code. That is about as open as it gets. But openness at the packaging layer does not mean openness at the distribution layer. The spec can be supremely open while the market remains a series of walled gardens with a shared file format. Part 7 — The npm Moment That Wasn't The standard has been called the npm moment for the agent ecosystem. The analogy is tempting. npm standardized JavaScript package distribution. Agent Plugins 1.0 standardizes agent skill packaging. But the analogy is misleading. npm included a registry. npm had a central index. npm had a CLI that installs from that registry. The Agent Plugins coalition deliberately excluded all of those. A more accurate historical parallel is the Java ecosystem. Java has JAR files — a portable package format. JAR files are open and standardized. But the distribution layer — Maven Central, Artifactory, Gradle — is where the commercial infrastructure emerged. The package format itself is worthless without a distribution channel. The same applies to Agent Plugins. The coalition built the JAR. The market will build the Maven. And the market will not be neutral. This is the hidden insight. The packaging standard is a commodity. The distribution model is the prize. The coalition has positioned itself — structurally — to capture that prize. The open standard was the price of admission. The distribution layer is the return on investment. Part 8 — What Enterprise Buyers Should Actually Measure For enterprise technology leaders evaluating agent deployments, the technical spec is the least important thing to measure. The important measures are these. First, distribution architecture. Which client controls discovery? What are the terms? Can the enterprise inspect the plugin before installation? Can it verify provenance? Second, trust model. The spec defines none. Enterprises must require one. That means cryptographic signatures, permission manifests, and sandboxing — all of which must be layered on top of a standard that deliberately excludes them. Third, switching costs. The spec makes the technical switch trivial. The commercial switch is not. The enterprise must ask: if I build this skill on OpenAI's distribution channel, what happens when I want to move to Cursor? The answer is that you can move the file. You cannot move the relationship. Fourth, governance direction. The TSC is balanced today. The question is whether it remains balanced as commercial pressure increases. Ask whether the neutral entity holding the project name and logos is genuinely neutral. Ask whether the governance charter has teeth. I have spent twenty-two years observing this industry. I have seen open standards die of indifference and proprietary ecosystems die of arrogance. The agent plugin market will not be different. The winners will be the platforms that combine technical openness with commercial discipline. The losers will be the ones that confuse a file format with an ecosystem. The conventional narrative is that Agent Plugins 1.0.0 is a triumph of collaboration — five competitors shipping a common standard. The tech media will frame it as the industry coming together. The tone will be celebratory. The word "interoperability" will be used without irony. I see the opposite. This is a standardization of the packaging layer to defer — indefinitely — the struggle over the distribution layer. It is a masterful move. By defining the format without defining the channel, the coalition has guaranteed that the channel cannot be neutralized through the format. The open standard creates an illusion of portability while ensuring that each platform remains the gatekeeper of its own ecosystem. The deeper contrarian point is that the absence of distribution in the spec is not a failure. It is the point. The coalition — Amazon, Microsoft, OpenAI, Vercel, Cursor — has enormous incentives to keep distribution fragmented. An open registry, like a canonical DEX for a token standard, would commoditize access. No gatekeeper wants that. Meanwhile, the IETF DAWN process — which actually addresses the discovery layer, the layer that matters for interop — got deferred in Vienna. The industry did not ship a discovery standard because the industry does not want one. Walled gardens want discovery to remain proprietary. The contrarian trade, if you are evaluating infrastructure risk, is not to assume that an open standard produces an open market. The contrarian trade is to assume the opposite. The standard is the candy. The distribution is the wall. The standard is the color of the gate. The gate is still locked. The standard ships. The gatekeepers win. The developers choose. Watch the next phase at the client level, not the TSC level. The winners will be the platforms that attract the highest-value skills, not the ones with the best spec compliance. Watch whether OpenAI Presence — or a similar governance plane — becomes the de facto trust layer for the agent economy. Watch whether Claude Code's richer format competes through capability or loses through isolation. Trust the protocol, verify the exit. The protocol is open. The exit is a walled garden. And exit liquidity, as I learned in the NFT crash, is a courtesy, not a right. In the audit, we find the truth that price hides. The price of the plugin is zero. The cost of access is everything. I watched the ape sell; the code still audits. The ape is the market celebrating a file format. The code is the distribution architecture that will monetize the attention. Ledgers do not lie, but liquidity always flees. The ledger of Agent Plugins 1.0 is open. The liquidity of the agent economy is already being routed through proprietary channels. Strategy is the bridge between chaos and profit. The chaos is the standard's infancy. The profit is in understanding where the gatekeepers will build their toll booths.