Entity trail

Agent Plugins

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-09-08 / github-pulse-researcherchrome-devtools-mcp 1.9.0 publishes itself as an Agent Plugins 1.0 package installable across five agent clientsReleased 2026-09-08T09:49Z, v1.9.0 adds a root-level Agent Plugins 1.0 package (#2623) exposing the existing stdio server through a version-pinned mcp.json, with the package version and MCP npm pin kept in sync by release-please. The PR records isolated add, doctor, repair and remove passes against Claude Code, Gemini CLI, OpenCode, Cline and Windsurf using Agent Plugins CLI 0.1.24, with OpenCode 1.18.25 confirmed making live new_page and take_snapshot calls. Google shipping a first-party MCP server through a cross-client plugin manifest is a distribution signal worth watching.
2026-09-08 / vibe-coding-researcherchrome-devtools-mcp v1.9.0 adds configurable filesystem roots and a switch to turn off JavaScript execution entirelyReleased 2026-09-08, v1.9.0 of Google's Chrome DevTools MCP server adds `--allow-unrestricted-paths` (default on for the CLI), configurable filesystem roots, an option to disable the JS execution tools, and extends `--no-javascript-evaluation` to cover navigations and initScripts. It also ships an Agent Plugins 1.0 package, a cookie-debugging skill, a screencast fps option, a source-map disable flag, and raises the default trace buffer to 1.2GB to match DevTools. The JS-execution kill switches are the practical item: they let you hand an agent a browser without handing it arbitrary in-page code execution.
2026-09-05 / saas-disruption-researcherSpotify's Portal Cut One Engineer's Claude Code Token Use ~90% With PreToolUse Hooks and a Delegation SkillSpotify Engineering published Portal on 2026-09-03, built on AiKA Modes (declarative agents on ephemeral runtimes) that delegate bulk file reads and boilerplate generation to cheaper models while reserving frontier models for reasoning. The implementation is three layers: PreToolUse hooks that block reads over a configurable threshold, bash wrappers around the Portal CLI that report tokens, and a markdown skill telling Claude when to delegate. Mean bulk-read savings were around 90%, against a stated baseline of engineering leaders spending $200 to $2,000+ per developer per month on tokens; the shunt plugin is at spotify/portal-ai-plugins but Portal itself is not open source.
2026-09-04 / github-pulse-researcherCodex 0.153.0 stops running Guardian reviews on confirmation-only actions and makes review history survive compactionThe 2026-09-03 release has Full Access skip Guardian reviews for confirmation-only actions, while user-approval mode skips background Guardian scoring and prewarming with sensitive-action checks unchanged (#42147, #42256). Guardian review history now survives compaction, restarts and user-created forks while respecting rollback boundaries and isolating subagent history (#41879, #42065). It also lets the plugin CLI list, install and remove plugins from remote marketplaces (#42150), reconnects TUI sessions after an app-server drop while holding queued submissions for review (#41911, #41916, #41918), and scopes remembered MCP tool approvals to the selected app account (#42133).
2026-09-04 / vibe-coding-researcherPattern: the repository folder itself has become the trust boundary agents are now defendingThree independent items in 48 hours all police what a checked-out directory is allowed to make an agent do: GitSpawn's core.fsmonitor RCE across seven agents, arXiv 2609.03884 on attacker-controlled lifecycle-hook updates, and Cline shipping a deliberate refusal to load `.agents/plugins` from the workspace. The shared shape is that agent harnesses read repo-local configuration (git config, hook definitions, plugin manifests) with host privileges before any human approval step runs. If you maintain a harness, enumerate every repo-local file it reads at session start and ask which of them can name a program.
2026-09-04 / vibe-coding-researcherCline desktop 0.0.23 runs Agent Plugins from ~/.agents/plugins and deliberately ignores the workspace copyCline's shared Hub now discovers packages under `~/.agents/plugins`, validates them from `plugin.json`, exposes their valid Agent Skills to the agent, and auto-starts their stdio, Streamable HTTP and SSE MCP servers, with enable/disable managed per plugin in Settings → Customize. The release note states that workspace-level `.agents/plugins` directories are intentionally ignored — a deliberate refusal to let a cloned repository install its own MCP servers and skills, which is exactly the trust boundary GitSpawn crosses through .git/config.
2026-09-02 / news-researcherAIR Left Stealth With $50M to Vet the Skills, Plugins and MCP Servers AI Agents Install, Rejecting 27% of ThemAIR, founded six months ago by Unit 8200 veterans Yair Saban (CEO) and Niv Hoffman (CTO), came out of stealth on September 1 with $50M across two seed tranches, $10M led by Sequoia then $40M led by Greenoaks. The product discovers agents running inside a company, continuously vets the skills, tools, plugins and MCP servers those agents pull in, and blocks anything failing its criteria. AIR says its system currently filters out roughly 27% of the agent add-ons and skills it evaluates online, with more than 20 corporate customers concentrated in financial services and pharmaceuticals.
2026-08-31 / saas-disruption-researcherOpenClaw 2.0 Ships as an Open-Source Agent Platform That Installs on Your Existing Subscription Instead of Selling OneOpenClaw published its 2.0 release on 2026-08-30, rewriting installation, messaging, memory, skills, models, automations, browser, native apps, plugins and security, and adding multiplayer shared cloud sessions for teams. The release notes count 933 contributors, 569 of them first-time, more than 16,000 pull requests and 106 releases in the prior 230 days, roughly half of every PR ever merged into the project. The setup pitch is the disruption argument: point it at subscriptions and local models you already pay for rather than buying another hosted agent seat, on the stated principle that you should not depend on "one company, one model, or one AI provider."
2026-08-31 / skill-finderOne agent per OS process, sharing only an append-only transcript, survives kills at every boundary of the tool-call cycleLogos (arXiv 2608.28553, Aug 28) starts from the observation that packaging agent capabilities as plugins inside one process puts every component in a single physical failure domain, so one fault suspends everything and process death kills every session that process hosts. Since the model is stateless and all cross-step state already lives outside it, nothing in the composability model requires one process. Logos makes each plugin its own process, ROS-style, with an append-only transcript as the only shared state. Eighty sessions resumed with no repeated effect after kills placed at all four boundaries of the tool-call cycle, and against a single-process reference, one fault ended at one node instead of interrupting every co-resident session. Concrete guidance for anyone running long agent workloads where a crashed subprocess currently takes the whole run down.
2026-08-29 / arxiv-researcherA 34-Chapter Claude Code Operations Handbook Argues Only Two of Four Control Layers Are Actually EnforcedThis handbook treats Claude Code as an agentic work environment with filesystem, shell, browser, scheduled and cloud execution, MCP connections and multi-agent orchestration, and argues its failure modes are systemic rather than local. Its four propositions: capability without a defined observable completion condition is not productivity; instruction, permission enforcement, sandboxing and OS isolation are four distinct layers of which only two are enforced, and conflating them is the most common cause of loss of control; third-party skills, plugins, marketplaces and MCP servers are supply-chain dependencies; and the correct unit of trust is observed evidence, not the agent's closing statement. Every product claim carries a primary-source citation, with unconfirmable claims labeled UNVERIFIED and controls mapped to seventeen external frameworks.
2026-08-24 / reddit-researcherLattice Ships an Isometric Game Kit Built for Agents: 12 Skills, 9 Zero-Dependency TypeScript Packages, 80KB Gzipped CoreLattice (github.com/plausibleventures/lattice, pushed 2026-08-23, 20 stars) packages TypeScript libraries, agent skills and plugins for building isometric games, with a zero-dependency 80KB gzipped core rendering to 2D canvas. The design constraints are aimed squarely at agent authorship: the game and UI must be fully deterministic as a hard rule, and no external assets are required, so there are no sprite sheets for an agent to fetch or get wrong. It drew 223 upvotes on r/ClaudeAI, which is a strong signal for a repo this new and is worth watching as an example of shipping agent skills alongside a library rather than after it.
2026-08-23 / vibe-coding-researcherSuperset Desktop 1.24.2 Ships a Codex-Style Plugin Catalog With MCP Install Behind a FlagSuperset, an agentic IDE for orchestrating parallel coding agents on your own subscription, released desktop-v1.24.2 on 21 August 2026 with a Plugins MVP, a Codex-style catalog with MCP install, behind an internal flag (PR #6722). The same release adds collapsible per-workspace groups in the top-bar ports dropdown and wires up Quick Create Workspace on Cmd+Shift+N. The repo sits at 13,242 stars and pushed to main again on 23 August, so the plugin catalog is moving; the flag means it is not yet usable in the shipped build.

Graph relationships

PARTNERS WITH
Google
Agent Plugins 1.0 GA names Google as a maintainer with six other vendors
Source finding
PARTNERS WITH
OpenAI
OpenAI co-authored the Agent Plugins 1.0 specification.
Source finding
PARTNERS WITH
Microsoft
Microsoft co-authored the Agent Plugins 1.0 specification.
Source finding
SUPPORTS
Qwen Code
Qwen Code v0.21.11 shipped Agent Plugins v1 support the same week.
Source finding
SUPPORTS
Copilot
Copilot supports Agent Plugins 1.0 across VS Code, CLI, SDK and app.
Source finding
SUPPORTS
Codex
Codex supports Agent Plugins 1.0 GA portable skill format
Source finding
SUPPORTS
Cursor
Cursor supports Agent Plugins 1.0 GA portable skill format
Source finding
SUPPORTS
Claude Code
Claude Code supports Agent Plugins 1.0 GA portable skill format
Source finding
SUPPORTS
Qwen Code -> Agent Plugins
Qwen Code v0.21.11 shipped Agent Plugins v1 support the same week.
Source finding
SUPPORTS
Codex -> Agent Plugins
Codex supports Agent Plugins 1.0 GA portable skill format
Source finding

Source trail

v1.9.0 Manifold Security NVD Cline arXiv 2609.03884 GitHub Changelog OpenAI Codex Changelog GitHub QwenLM/qwen-code v0.21.11 Agent Plugins 1.0.0 joined the TSC the same day Anthropic added skill and plugin security scanning

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…