August 6, 2026. The agent ecosystem just got its npm moment.
Amazon, Microsoft, OpenAI, Vercel, and Cursor — five of the most powerful platform operators in software — simultaneously adopted Agent Plugins 1.0.0. An open, vendor-neutral standard for packaging Agent Skills and Model Context Protocol servers into portable plugins.
Not a proposal. Not a white paper. Shipped. Working. Already integrated into VS Code, GitHub Copilot, Cursor, ChatGPT, and Kiro.
I've spent most of 2025 and 2026 tracking the social footprints of AI agents on Farcaster — the ghost chatter that precedes volatility spikes in token markets. This move was never an accident. The agent economy has been building toward a standardization moment for months. It just arrived faster than the standards bodies could blink.
Here's what the industry did while the IETF DAWN working group debated the discovery layer beneath agent ecosystems in Vienna: it built its own answer.
The DAWN charter was deferred at IETF 126 — despite 12 pre-charter Internet-Drafts. Twelve. The working group couldn't even agree to start talking. Meanwhile, five companies that control the largest distribution surfaces in software shipped a working standard in the background.
Agent Plugins 1.0 does not solve the same problem as DAWN. It packages capabilities, not discovery. But the sequencing is not coincidental. The industry chose shipping over consensus. And that choice reshapes who holds power in the agent economy.
Let me decode the pulse of the crypto zeitgeist here — because this isn't just an infrastructure story. It's a power story wearing an open-source costume.
The coalition behind the curtain
Google joined as a core maintainer on day one. Kevin Hou leads the effort from the Google Developers side. The company ships two plugin producers — its Agents CLI and Data Agent Kit — though it's not yet listed as a client entry.
The Technical Steering Committee reads like a who's who of infrastructure: Clare Liguori (AWS), Roshan Sadanani (Cursor), Harald Kirschner (Microsoft), Gav Verma (OpenAI), and Jonathan Hefner of Vercel as lead core maintainer. The project name, logos, domains, and GitHub organization are held in trust by a neutral entity.
Seats belong to individuals, not companies. That's by design. The governance charter prevents any single vendor from holding a majority. But I've been in this industry long enough to know that governance structures are only as strong as their enforcement. The real test won't be the charter. It'll be whether competing clients implement the spec in compatible ways.
The economics of the gatekeeper
Now here's where it gets interesting.
The technical spec is open and vendor-neutral. The business model is anything but.
Agent Plugins 1.0 is notable for what it deliberately excludes: installation mechanisms. Distribution protocols. Provenance verification. Permission models. Sandboxing requirements. Marketplaces.
Read that list again. Every element that determines how an agent skill actually reaches a user — left out of the standard.
If you've been following the MCP server ecosystem at all, you know the pain this solves. Every agent framework ships its own way of loading tools. Every client expects a different directory structure. Developers were manually wiring capabilities into each platform — the exact problem package managers solved for JavaScript a decade ago. Agent Plugins is the npm moment for that mess — minus the central registry.
And that's precisely the catch.
This is where the money lands. The platform operator who ships the client becomes the gatekeeper. Because each platform controls its own distribution — and the spec defines no registry or marketplace — developers who build high-value agent skills are not just building for a standard. They are choosing which gatekeeper controls their access to enterprise buyers. And their path to revenue.
Think about what this means for a developer sitting in a hackathon in Jakarta or Bangalore or São Paulo. They build a brilliant agent skill — something that automates treasury management or audits smart contract interactions. Under this standard, they can package it once in a portable format. That's the promise. But to actually get it in front of enterprise users? They need to publish it into a distribution channel. And every distribution channel is owned by a platform operator who gets to set terms, take the cut, and change the rules.
The fragmentation is structural, not accidental. Each client — VS Code, Cursor, ChatGPT, Copilot, Kiro — will define its own discovery and installation experience. For enterprise technology leaders evaluating agent deployments, the cost of switching platforms isn't just technical. It's commercial.
I've seen this exact pattern before. It's the same dynamic that played out in the early web, in mobile, in cloud. Open at the protocol layer. Locked at the distribution layer. The packaging gets standardized. The pipeline gets monetized.
The ledger remembers what the hype forgets: openness at one layer doesn't guarantee openness at another.
Anthropic's calculated absence
Now — the elephant in the room.
Anthropic is absent from the coalition. Despite having authored the underlying Agent Skills specification. Despite creating the .claude-plugin format that directly informed the standard. Claude Code is not among the launch clients. No Anthropic representative sits on the TSC.
This is not an oversight. This is a bet.
Claude Code's plugin format supports a broader feature set — custom subagents, hooks, LSP servers, background monitors. But it's tied to Anthropic's own client structure, using claude.md rather than the agents.md convention the coalition adopted.
In other words: Anthropic is betting on richer, platform-specific capabilities over the coalition's portable-but-minimal approach. Depth over reach. Control over compatibility.
This mirrors a debate I've watched play out endlessly in crypto: the trade-off between composability and specialization. Ethereum won on composability — an open standard anyone could build against. But it lost the high-performance niches to chains that optimized for specific use cases. Anthropic is betting that agent capabilities are closer to the high-performance niche than the universal standard.
From my vantage point — watching how AI agents actually behave in the wild, how they signal and execute — this is the most consequential strategic split in the agent economy right now. One camp says "build once, run anywhere." The other says "build deep, run remarkably." Both sound reasonable. Only one wins the enterprise default.
The trust gap nobody wants to talk about
Here's what keeps me up at night.
The rush to ship left a significant gap. Version 1.0 contains no provenance or trust model. Per VS Code documentation, plugins are implicitly trusted at the moment of installation. No cryptographic signatures. No standardized permission model. No sandboxing requirements in the spec.
And this is the part that should sound alarm bells for anyone who has lived through a smart contract exploit. I watched the 2017 Ethereum time-lock incident unfold — the panic, the rushed interpretations, the wallets that drained because code was trusted without verification. Agent plugins are re-creating that culture of implicit trust inside software supply chains. It took blockchain years to build the auditing and signing infrastructure that should have been there from day one. The agent economy is starting from the same place.
For enterprise environments where security and compliance are non-negotiable, this is a real hurdle. You're asking CIOs to install third-party agent skills into their code repositories — where their most sensitive logic lives — with a handshake and a prayer.
This is where I'm caught in the current of real-time value. The trust gap creates demand for governance layers on top of the open standard. And that's where OpenAI Presence — which launched in July as a governance-focused control plane for enterprise agent behavior — is positioned to fill exactly this role. As MCP gateways crystallize as enterprise infrastructure, companies will need to layer proprietary control planes on top of the open plugin format to manage risk.
Translation: the open standard creates the market for the proprietary safety layer. And the proprietary safety layer becomes the moat.
Where liquidity meets the human story
I keep coming back to the human element. Enterprise technology leaders aren't just evaluating specs. They're making bets on which ecosystem their teams will invest years of learning in. They're choosing which gatekeeper gets a cut of every future agent transaction.
The standard is licensed under CC-BY-4.0 for the spec and Apache-2.0 for the code. That is about as open as it gets. But openness at the packaging layer does not mean openness at the distribution layer. The coalition has lowered the barrier for building agent skills. Whether the market those skills serve remains open — or becomes a series of walled gardens with a shared file format — is the question that will define the agent economy's next phase.
Here's what I'm watching next. First: whether Google's absence as a client entry is temporary or strategic — if the search giant is building its own distribution channel ahead of a bigger launch. Second: whether Anthropic's richer plugin format becomes a meaningful alternative or a niche deviant. Third: which governance layer wins the enterprise trust budget — and whether it's tied to the coalition or independent of it.
Because in the end, the code is just a container. The real asset is attention. And the real battle is for who gets to control the point where agent capability meets human intent.
The agent economy just got its npm moment. But npm had a central registry. This standard has five. And every one of them is playing to win.