Agent Plugins 1.0: One Skill, Every AI Coder (2026)

The practical guide to writing an agent capability once and running it in every AI coding tool you use.

In late 2025, three of the most bitter rivals in artificial intelligence quietly agreed on the same file format, and by August 2026 more than 60,000 open-source projects were using it - agents.md. That is the strange, underappreciated story of the year in AI tooling. The models compete harder than ever, but the way you teach an agent a job, connect it to your tools, and package that up for reuse is converging on a small set of open, boring, portable formats. A skill you author for one agent increasingly runs, unchanged, in a dozen others.

The reason this matters is money and lock-in. If a single SKILL.md folder only worked inside one vendor's product, then every hour you spent teaching that agent your invoicing process, your brand rules, or your deployment checklist would be an hour of switching cost locking you to that vendor. When the format is open, the hour becomes an asset you keep. This is the same shift the web went through when HTML stopped being a browser feature and became a standard: the value moved from the runtime to the content you authored for it.

But here is the problem: nobody handed operators a map. The space is a soup of overlapping names. Agent Skills, plugins, MCP servers, AGENTS.md, subagents, hooks, extensions, marketplaces, registries. Half are Anthropic terms, half are OpenAI terms, and half are community projects that will be renamed by the time you finish reading. Most explainers describe one vendor's slice and stop.

This guide is the map. It breaks down exactly what "Agent Plugins 1.0" means in practice, the four portable layers that make "one skill, every AI coder" real, which of the twelve major coding agents actually support each layer, what all of it costs, where it is genuinely dangerous, and where the "write once, run everywhere" promise quietly breaks. We start high level with the fragmentation that forced this convergence, then go deep on each format, the security incidents that should scare you, the players fighting over the standard, and a concrete adoption playbook you can run this week.

Contents

1. The fragmentation problem: a different rules file for every agent
2. Anatomy of Agent Plugins 1.0: the four portable layers
3. Agent Skills: teaching an agent a repeatable job
4. Claude Code plugins: one install, five kinds of extension
5. AGENTS.md: the one file every agent agrees to read
6. MCP: the universal socket for tools and data
7. What actually runs where: reading the scorecard
8. Registries and marketplaces: where skills and servers live
9. What it costs, and what is genuinely free
10. The security reality: portable skills run real code
11. The players and the standards war
12. Where one skill, every coder breaks: five honest limits
13. The adoption playbook: standardize once, travel everywhere
14. The future: the plug is standard, the electricity is not

The 2026 Portability Scorecard: Every Major AI Coder Ranked

Before the deep dives, here is the whole field on one page. The table below scores the twelve most-used AI coding agents on how well they support the portable formats this guide is about. Read the criteria carefully, because this is not a ranking of which tool is best, fastest, or most popular. It is a ranking of one specific thing: format portability and freedom from lock-in. A tool that reads every open format and lets you bring any model scores high here even if it has a smaller user base. A tool that is excellent but insists on its own proprietary instruction file and its own models scores lower, by design.

That is why the result is counterintuitive and worth sitting with. The open, model-agnostic tools lead, and Claude Code, which is both the most-adopted agent and the birthplace of two of these standards, lands mid-table precisely because it standardizes on its own CLAUDE.md file and its own Claude models. The scorecard measures the plug, not the appliance.

How to read the criteria. Rules / AGENTS.md (25%) asks whether the tool reads the open, cross-vendor instruction file at your repo root. MCP tools (25%) asks whether it speaks the Model Context Protocol to reach your systems. Agent Skills (20%) asks whether it loads the open SKILL.md folder format. Packaging & subagents (15%) rewards the ability to bundle and delegate. Openness (15%) rewards open-source clients and the freedom to bring any model. Scores are 0 to 10, the final column is the weighted average rounded to one decimal, and the table is sorted by that final score. Sources for every claim appear in the sections below. Now the detail.

1. The fragmentation problem: a different rules file for every agent

Every convergence story starts with a mess, and this one is no exception. To understand why an open plugin standard emerged in 2026, you have to feel the pain of the eighteen months before it. Through 2024 and most of 2025, if you wanted your AI coding agents to follow your project's conventions, you did not write that guidance once. You wrote it again, and again, and again, in a slightly different file for every tool your team happened to use. Claude Code read a CLAUDE.md file. Cursor read a .cursorrules file. GitHub Copilot read .github/copilot-instructions.md. Windsurf read .windsurfrules. Cline read .clinerules. Each one was a near-duplicate of the others, and each one drifted out of sync the moment someone updated one and forgot the rest.

The structural cause here is worth naming precisely, because it is the same cause behind most format wars. When a capability is new and every vendor is racing, each vendor invents its own convention to ship fast, and none of them can afford to wait for a committee. Fragmentation is not a failure of coordination. It is the predictable output of a land grab. The instruction file was the first place the pain became unbearable, because it is the one artifact every serious repository needs and the one that a human, not the model, has to maintain by hand. Duplicated tool wiring is annoying. Duplicated, drifting English instructions across five files is a genuine tax on every commit.

• CLAUDE.md for Claude Code, still its native format today
• .cursorrules for Cursor, now legacy and ignored in its agent mode - Codersera
• .github/copilot-instructions.md for GitHub Copilot
• .windsurfrules and .clinerules for Windsurf and Cline
• Half a dozen more for the smaller agents

The practical consequence is what pushed the industry to act. A team using three agents maintained three copies of the same knowledge, and the copies were never identical, so agents behaved inconsistently on the same codebase. The fix could have been another vendor trying to win by fiat, but no single lab could force a standard while its rivals sat at rough capability parity. That parity is the hidden precondition for everything that follows: when no one can win the format war, everyone benefits from ending it. This is exactly the dynamic that produced the open convergence of 2026, and it is why the winning move came not from a product team but from a shared, neutral convention that any tool could adopt without conceding an inch of competitive ground. The rest of this guide is about what that convention turned into.

2. Anatomy of Agent Plugins 1.0: the four portable layers

The phrase "agent plugin" gets used loosely, so let us define it from first principles rather than by analogy to browser extensions. An agent does four separable things when it works on your behalf, and each one has become its own portable layer. It follows your rules (project conventions, guardrails, style). It reaches your tools (databases, APIs, file systems, SaaS apps). It applies know-how (repeatable, multi-step procedures like "close the books" or "generate a branded deck"). And it ships as a package you can install, version, and share. "Agent Plugins 1.0" is not a single product. It is the moment all four of those layers got their own open, cross-tool format at roughly the same time.

Keeping these four layers distinct is the single most useful mental model in this entire space, because the industry constantly blurs them and the blur is where people get confused and overspend. Rules are not tools. Tools are not know-how. Know-how is not packaging. Each layer answers a different question, each has a different standard, and each fails differently when it goes wrong. Once you can name which layer a given feature belongs to, the marketing fog lifts and the buying decisions get simple.

• Rules layer: the open format is AGENTS.md, a plain Markdown file at your repo root
• Tools layer: the open standard is the Model Context Protocol (MCP), the socket that connects an agent to external systems
• Know-how layer: the open format is Agent Skills, the SKILL.md folder Anthropic released and then opened up
• Packaging layer: the least standardized, where each ecosystem still ships its own bundle (Claude Code plugins, Gemini CLI extensions, Amp plugins)

The interpretation that matters for a non-technical operator is this: three of the four layers are now genuinely portable, and the fourth is catching up. Rules travel via AGENTS.md, tools travel via MCP, and know-how travels via SKILL.md, so the bulk of what you teach an agent is no longer trapped in one vendor. Only packaging, the outer wrapper that bundles the other three into a one-click install, remains tool-specific, and even there the wrappers all contain the same portable parts. Anthropic itself frames Skills as complementary to MCP rather than competitive, teaching workflows that use the tools MCP connects - Anthropic Engineering. Get the layering right and the entire ecosystem, covered in depth across our writing on the 2026 MCP spec and on which agent protocol to use, stops looking like alphabet soup and starts looking like a stack.

3. Agent Skills: teaching an agent a repeatable job

Of the four layers, Agent Skills is the one that most deserves the word "skill," and it is the newest, so start here. Anthropic announced Agent Skills on October 16, 2025, in an engineering post titled "Equipping agents for the real world with Agent Skills" - Anthropic Engineering. The idea is almost aggressively simple. A Skill is a folder containing a file called SKILL.md, which is Markdown with a short block of metadata at the top. The metadata's only required fields are a name and a description, and the body is plain instructions for how to do some task. Optionally, the folder can bundle scripts the agent can run and reference files it can consult.

What makes this more than a fancy prompt is the loading mechanism, and this is the part that changes the economics of teaching an agent. Skills use progressive disclosure, a three-level scheme that keeps them nearly free until the moment they are needed - Claude Developer Platform docs. At startup the agent loads only each Skill's name and description, roughly 100 tokens apiece. When your request matches a Skill's description, the agent loads the fuller SKILL.md body, usually under 5,000 tokens. Only if the task actually needs a bundled script or reference file does that content load or execute, and a script's code never enters the model's context at all, only its output does. The result is that an agent can carry hundreds of Skills at almost no ongoing cost, reaching for the right one the way a person reaches for the right checklist.

The description field is not a label, it is the trigger, and understanding that unlocks how to author good Skills. Because the agent decides whether to load a Skill by matching your request against its description, that one sentence must state both what the Skill does and when to use it. A vague description means the Skill never fires. Anthropic even encodes hard rules on the format: the name is capped at 64 characters, lowercase letters, numbers, and hyphens only, and it cannot contain the reserved words "anthropic" or "claude," while the description must be non-empty and under 1,024 characters - Claude Developer Platform docs. Those constraints exist because the metadata is machine-matched, not human-read.

Where Skills run is what turns them from a Claude feature into a portable asset. Inside Claude's own products, a Skill runs anywhere the model has a filesystem and code execution: claude.ai, Claude Code, the Claude Agent SDK, and the Claude Developer Platform API, where you pass a skill_id into a sandboxed container and upload custom Skills through /v1/skills endpoints. In Claude Code specifically there is no upload at all, because Skills are just files: personal Skills live in ~/.claude/skills/ and project Skills in .claude/skills/. Anthropic ships four pre-built document Skills for PowerPoint, Excel, Word, and PDF, and open-sourced many more in its anthropics/skills repository, which has grown to roughly 170,000 GitHub stars - GitHub. If you want the mechanics of building agents on Anthropic's stack, our Claude Agent SDK deep dive covers the tooling around Skills in detail.

The genuinely important development came on December 18, 2025, when Anthropic released the SKILL.md format as an open standard, published at agentskills.io. This is the sentence that makes "one skill, every AI coder" literally true rather than aspirational. The same SKILL.md folder now loads, unmodified, in a large and growing set of non-Claude tools. The standard's own client showcase lists on the order of 46 products that read it, spanning coding agents and full platforms: Cursor, OpenAI Codex, GitHub Copilot, VS Code, Gemini CLI, Amp, OpenCode, Goose, Roo Code, and Factory, alongside vendors like Mistral, ByteDance's TRAE, Snowflake, and Databricks - agentskills.io client showcase. A Skill you wrote to enforce your company's invoice format is no longer a Claude Code artifact. It is a portable capability.

To make this concrete, picture a Skill named brand-deck whose description reads "Build an on-brand slide deck from an outline. Use when the user asks for a presentation, pitch, or slides." Its folder bundles the company's fonts, the logo, and a short reference file listing the approved color codes and the three layout templates the marketing team allows. A designer authored it once. Now, when anyone asks Claude Code, Cursor, or Codex to "turn this outline into a deck," the description fires, the agent reads the brand rules, runs the bundled script that assembles the slides, and produces something that looks like the company made it. Nobody re-explained the brand. That is the whole point: the procedure, the assets, and the judgment travel together as one versioned folder, and now they travel across tools.

One caution belongs here, and section 10 will make it concrete. Anthropic's own docs warn that you should treat installing a Skill like installing software: only use trusted sources, because a malicious Skill can direct the agent to run code or misuse its tools. A Skill is not a passive document. It is executable know-how, and that is precisely what makes it powerful and dangerous in equal measure.

4. Claude Code plugins: one install, five kinds of extension

If Skills are the know-how layer, plugins are the packaging layer, and Claude Code's plugin system is the most fully realized version of it, so it is the best one to study even if you use a different tool. Anthropic launched Claude Code plugins in public beta on October 9, 2025 - Claude blog. A plugin is a self-contained directory that bundles up to five kinds of extension at once: slash commands, subagents, MCP servers, hooks, and Agent Skills. In other words, a single plugin can carry pieces from three of our four layers, wrapped so a teammate can install the whole thing with one command instead of assembling the parts by hand.

The mechanics are deliberately git-native, which is what makes plugins shareable the way code is. A plugin's identity lives in a .claude-plugin/plugin.json manifest. A marketplace, meaning a catalog that distributes plugins, is defined by a .claude-plugin/marketplace.json file hosted in a git repository. Users run the interactive /plugin command, which opens a panel with Discover, Installed, Marketplaces, and Errors tabs, add a catalog with /plugin marketplace add owner/repo, and install with /plugin install name@marketplace - Claude Code docs. Anthropic auto-registers an official marketplace and runs a separate reviewed community marketplace whose entries are each pinned to a specific commit SHA, a small but meaningful supply-chain safeguard.

A concrete example makes the value obvious. Imagine your team's "release" plugin. It carries a slash command called /ship that kicks off the process, a subagent that drafts the changelog, an MCP server wired to your issue tracker so the agent can read closed tickets, a hook that blocks the release if tests are failing, and a Skill that encodes your exact versioning and tagging conventions. A new engineer installs the whole thing with one line and, on day one, ships a release the same way a five-year veteran would. Without packaging, that same setup is five separate things to find, configure, and keep in sync. The plugin is the difference between onboarding in a minute and onboarding in a week.

The connection back to Skills is the detail most coverage misses, and it is the key to the whole "plugins" concept. A plugin ships Agent Skills by dropping SKILL.md files under a skills/ directory, at which point they become model-invoked and namespaced as /plugin-name:skill-name - Claude Code docs. So a plugin is not a competitor to Skills. It is a delivery truck for them, plus commands, subagents, tool connections, and event hooks. This is why the four-layer model matters: "plugin" is the outer box, and the interesting cargo inside is the portable formats we have already met.

The ecosystem that formed around this in under a year is the proof that packaging solves a real problem. The two largest community catalogs are verifiable by star count: wshobson/agents sits around 38,900 stars and davila7/claude-code-templates, browsable at aitmpl.com, around 30,300 stars - GitHub. Plugins are free, they toggle on and off to save context, and they can install at user, project, or local scope. The single most important line in the docs is the warning: plugins and marketplaces execute arbitrary code with your user privileges, so only install from trusted sources. If you are new to the tool, start with our Claude Code beginner's guide and the subagents fleet guide, which cover the pieces a plugin bundles.

5. AGENTS.md: the one file every agent agrees to read

AGENTS.md is the layer that started the convergence, and it is the simplest artifact in this entire guide, which is exactly why it won. It is a single Markdown file placed at a repository's root that acts as a README for AI agents: a predictable, dedicated place to put the build commands, test commands, conventions, and guardrails an agent needs but that would clutter human-facing documentation. There is no schema, no required fields, and no special tooling. If you can write a README, you can write an AGENTS.md, and any tool that supports the convention will read it.

The origin explains why so many rivals adopted it so fast. AGENTS.md was proposed by OpenAI's Codex team in August 2025, deliberately as a vendor-neutral convention, in collaboration with Sourcegraph's Amp, Google's Jules and Gemini, Cursor, and Factory - Factory.ai. Because it was cross-vendor from day one and cost nothing to adopt, it spread on its own logic. By August 2026 the official site reports it is used by more than 60,000 open-source projects and read natively by roughly 26 tools, including Codex, Cursor, Copilot in VS Code, Gemini CLI, Jules, Zed, Windsurf, Aider, Amp, OpenCode, Devin, Factory, Warp, and Junie - agents.md. Nested files are supported, so a large monorepo can carry many AGENTS.md files, and the one closest to the code being edited wins, which lets a subteam override the root conventions without editing anyone else's guidance.

Then the standard did the thing that signals real maturity: it gave up single-vendor control. On December 9, 2025, AGENTS.md was contributed to the newly formed Agentic AI Foundation (AAIF) under the Linux Foundation, alongside Anthropic's MCP and Block's Goose, for neutral multi-vendor stewardship - Linux Foundation. The foundation's platinum members read like a truce table: Amazon Web Services, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft, and OpenAI. OpenAI's own framing was that the standard should now evolve by community consensus rather than one company's roadmap - OpenAI. When eight fierce competitors agree to steward a Markdown file together, the file has stopped being a product feature and become infrastructure.

What actually goes inside a good AGENTS.md is more mundane and more valuable than the governance drama suggests. The best ones are short and operational: the exact commands to install, build, test, and lint the project, the directories an agent should never touch, the coding conventions a reviewer would otherwise flag, and the handful of gotchas that trip up every newcomer, human or machine. The trap teams fall into is writing an essay. An AGENTS.md is not documentation, it is a briefing, and every sentence that does not change what the agent does is noise that costs tokens and dilutes the instructions that matter. Written well, it is the single highest-leverage file in a repository, because it improves the output of every agent that reads it, on every task, for the price of writing it once.

• What it is: a plain-Markdown project file, no schema, at the repo root
• Who reads it: ~26 tools natively, from Codex and Cursor to Zed and Windsurf
• Scale: 60,000+ open-source projects
• Governance: donated to the Linux Foundation's Agentic AI Foundation
• The one catch: Claude Code does not read it natively

That last bullet is the practical wrinkle every team hits, so it needs prose, not just a line. As of Claude Code version 2.1.201 in August 2026, Claude Code still does not read AGENTS.md natively, it reads CLAUDE.md, and the long-running community request to change that is tracked in issue #34235, still unshipped - GitHub. The recommended bridge is not to maintain two files but to make them one: either import AGENTS.md from CLAUDE.md with an @AGENTS.md line, or symlink the two so a single canonical file serves both. This is a small friction, but it is emblematic of the whole theme of this guide. The standard fixes the format, and a lone holdout can still make you do a little glue work, even when the holdout is the tool that co-created the rest of the stack.

6. MCP: the universal socket for tools and data

If AGENTS.md is how you tell an agent the rules and Skills are how you teach it a job, the Model Context Protocol (MCP) is how it actually touches your world. MCP is an open standard, originated by Anthropic on November 25, 2024, that gives any AI application a single, standard way to plug into external tools, data sources, and workflows - Anthropic. The official site's metaphor has become the canonical one: MCP is a USB-C port for AI applications. Before it, every agent connected to every system with a bespoke integration. After it, a system exposes one MCP server and every MCP-speaking agent can use it.

Architecturally it is less exotic than the acronym suggests, and knowing the shape helps you reason about cost and risk. MCP is a JSON-RPC protocol between a host (the AI app), a client per connection, and servers that expose three primitives: Tools the model can call, Resources it can read for context, and Prompts it can reuse as templates. It runs over two transports, local stdio for servers on your machine and remote Streamable HTTP with OAuth for hosted ones. The spec moves quickly, and precision matters here because vendors reference specific revisions: the current, final revision as of August 2026 is dated 2026-07-28, which made the protocol fully stateless by dropping the old initialization handshake and session IDs - Model Context Protocol Blog. Our guide to the MCP 2026 spec going stateless walks through what builders had to change.

The way MCP and Skills compose in practice is what makes the stack more than the sum of its parts. Suppose you ask an agent to "reconcile last month's invoices." The MCP layer is what lets it reach the accounting system, the bank feed, and the spreadsheet, three separate servers exposing their data and actions through one protocol. The Skill layer is what tells it how reconciliation actually works at your company: which accounts to match, how to handle partial payments, what a discrepancy over a threshold should trigger. Neither layer alone finishes the job. MCP without a Skill is a pile of connected tools with no procedure, and a Skill without MCP is a procedure with nothing to act on. The agent supplies the reasoning that stitches them together, which is exactly why the model layer keeps its value even as the formats around it commoditize.

The reason MCP belongs in a guide about portability is that it won the adoption war outright, and a standard that everyone implements is the definition of portable. Adoption is now industry-wide. OpenAI built its Apps SDK, announced at DevDay on October 6, 2025, on top of MCP so developers can build apps that run inside ChatGPT - OpenAI. Google added official MCP support across Gemini and Google Cloud in December 2025, and Microsoft supports it natively in Copilot Studio and is building it into Windows 11. At the December 2025 donation, Anthropic reported more than 97 million monthly SDK downloads and over 10,000 active public MCP servers, with first-class client support in ChatGPT, Claude, Cursor, Gemini, Microsoft Copilot, and VS Code - Anthropic.

Governance sealed it. MCP was donated to the same Agentic AI Foundation as AGENTS.md, and its governance now vests in individuals with no reserved company seats, an unusually strong anti-capture design - MCP governance docs. The strategic logic is worth pausing on, because it is the same first-principles move behind the whole convergence: a standard is only valuable if no one can own it, so the labs made the tool layer deliberately unownable and moved their competition up to the model and the agent. If you want to build on this layer, our practical walkthroughs on how to build a remote MCP server and on MCP versus A2A go deeper than we can here.

7. What actually runs where: reading the scorecard

With the four layers defined, the scorecard at the top of this guide becomes readable, and this section explains the pattern it reveals rather than repeating the numbers. The headline finding is that two layers are genuinely cross-tool today and a third just became so. AGENTS.md and MCP are the two you can rely on almost everywhere: nearly every serious agent reads the first and speaks the second. Agent Skills was the surprise of 2026, because Anthropic opening the SKILL.md format flipped it from a Claude-only feature to something roughly 46 products load unmodified. The layer that remains stubbornly tool-specific is packaging, where Claude Code has plugins, Gemini CLI has extensions, and Amp has plugins, all wrapping the same portable parts in incompatible boxes.

The counterintuitive ranking deserves an honest defense, because a scorecard that puts Zed and OpenCode above Claude Code will raise eyebrows. It is correct for the specific question asked. Zed is the first editor with native project-level and global AGENTS.md, it speaks MCP through Context Servers, it adopted Agent Skills, it is open source, and its Agent Client Protocol makes agents pluggable into any editor - Zed docs. OpenCode reads all three portable formats and is fully model-agnostic with no markup. Both maximize portability and minimize lock-in, which is the exact axis being measured. Claude Code lands at a still-excellent 8.3 only because it reads CLAUDE.md rather than AGENTS.md and locks to Anthropic's models, two deliberate choices that trade portability for a tighter, more opinionated product.

That trade-off points at the deeper truth the scorecard cannot fully show. A tool can be the most popular and the most locked-in at the same time, and those two facts are not in tension, they are causally linked. Claude Code is the origin of both Skills and MCP and, by the JetBrains 2026 survey, the most-adopted AI coding agent in the market, yet it is the one major tool that will not read the industry's shared instruction file. Adoption buys the freedom to be opinionated. The lesson for buyers is not "pick the highest score." It is "know which axis you are optimizing." If you want maximum freedom to switch tools and models later, weight portability and the open tools win. If you want the most refined single experience today, a lower-portability, higher-polish tool may serve you better, as our comparison of Cursor versus GitHub for AI agents explores. The scorecard tells you the price of the switch, not which tool to love.

8. Registries and marketplaces: where skills and servers live

A portable format is only half a solution. The other half is distribution: a trustworthy place to find, publish, and update the skills, plugins, and servers that use the format. In 2026 this settled into three distinct layers, and confusing them is a common and expensive mistake. There is the official-registry layer that acts as a source of truth, the aggregator layer that indexes far more than the official registries do, and the community-curation layer where humans hand-pick what is actually good. Each plays a different role, and you use all three for different reasons.

The official layer is deliberately conservative, which is a feature, not a bug. The official MCP Registry launched in preview on September 8, 2025 at registry.modelcontextprotocol.io as a vendor-neutral catalog that other directories can federate from, and it intentionally froze its API at v0.1 in October 2025 to let integrators build against a stable target before a v1 general-availability release - Model Context Protocol Blog. Anthropic runs the parallel official Claude Code plugin marketplace, with the community variant pinning each approved plugin to a fixed commit. Official registries move slowly on purpose, because a source of truth that changes underneath you is worse than no source of truth at all.

The practical skill here is learning to read a registry's trust signals, since anyone can list a server and not all listings are safe. The questions worth asking are always the same. Is the entry pinned to a specific version or commit, or does it float to whatever the author pushes next? Is the publisher verified, and does the server's code live somewhere you can actually inspect it? Does the directory do any screening, as Anthropic's community marketplace does, or is it an open index that lists everything indiscriminately? A large server count is a sign of momentum, not of safety, and the two are easy to confuse. Treat the aggregators as a discovery tool and the official, screened registries as the place you install from, and you get the breadth of the ecosystem without inheriting its worst actors.

The aggregator and curation layers are where the real volume lives, and their scale tells you how fast this ecosystem is compounding. Independent MCP directories index an order of magnitude more servers than the official registry: PulseMCP lists around 22,000 servers and Smithery, now part of Arcade.dev, lists more than 16,500 - PulseMCP. On the curation side, community hubs do the human filtering that raw indexes cannot, with hesreallyhim/awesome-claude-code at roughly 52,700 GitHub stars and davila7's templates project at 30,300. The chart below shows how lopsided the momentum is toward the open Anthropic-adjacent ecosystem.

The most important entries in this layer, for the thesis of this guide, are the portability tools that let you author once and emit many formats. The clearest example is rulesync, an npm command-line tool that generates and syncs configuration for more than 20 AI coding tools, including Claude Code, Cursor, Copilot, Windsurf, Cline, and Gemini CLI, from a single unified source - GitHub. This is "write once, run everywhere" made literal for the rules layer. The caution is that this space is young and consolidating: an earlier popular collection, steipete/agent-rules, is already archived and read-only. When you standardize on a portability tool, treat it like any dependency, because the tool that syncs your configs can also become the thing you have to migrate off. The raw number of servers, meanwhile, keeps climbing.

9. What it costs, and what is genuinely free

The most reassuring fact in this entire guide is that the formats cost nothing. AGENTS.md is just Markdown. MCP is an open protocol. Agent Skills and plugins are open, author-it-yourself formats. There is no license fee for any of the four layers, and you never pay to adopt the standard. What you pay for is model compute, the intelligence that reads your AGENTS.md, runs your Skill, and calls your MCP tools. Keeping that distinction clear is the difference between a rational budget and a panicked one. You are not buying plugins. You are buying the tokens the agent burns while using them.

The pricing of that compute has settled into a recognizable shape across every major tool, which makes comparison shopping easier than it looks. Almost all of them now offer a free tier to try, an individual plan around $10 to $20 a month, a power-user tier in the $40 to $100 range, and a top individual tier at roughly $200 a month, with per-seat team plans above that. The engine underneath shifted from flat "unlimited" toward metered usage, which is the trend operators most need to understand. GitHub Copilot moved all plans to usage-based billing on June 1, 2026, where 1 AI credit equals $0.01 and each plan includes monthly credits equal to its dollar price - GitHub Blog. Cursor bills a monthly credit pool roughly equal to the subscription price. The table gives the current lay of the land.

A few numbers behind the table are worth stating in prose, because they reveal where value is really moving. On Anthropic's API, the models that power Claude Code are metered per million tokens: Sonnet 5 at $2 in and $10 out, Opus 5 at $5 and $25, and Haiku 4.5 at $1 and $5 - Anthropic API pricing. Sonnet 5's input price is roughly a fifth of a comparable flagship a year earlier, which is the commoditization of intelligence showing up on an invoice. Google's Gemini CLI keeps the most generous free tier, up to 1,000 model requests per user per day with a personal Google account, and the OpenAI Codex CLI is itself open source under Apache-2.0, so you pay only for the tokens it consumes - Gemini CLI docs. For a fuller breakdown of one tool's economics, our Claude Code pricing guide traces where the money goes.

The practical takeaway for budgeting is to stop worrying about the layer you are reading this guide to understand. The plugin, the skill, the MCP server, and the AGENTS.md file are free forever. Model usage is the recurring cost, it is falling per token but rising in total as agents do more autonomous work, and the tools are steadily moving you onto metered billing where heavy use is visible. Standardize on the free formats aggressively, and shop the compute the way you would shop any utility, since that is the only line item the format decision does not eliminate.

10. The security reality: portable skills run real code

Here is the sentence that should reframe everything cheerful in the sections above: a skill, a plugin, and an MCP server all run real code with your real privileges. Portability is a double-edged sword, because the same openness that lets a Skill travel to every agent also lets a malicious Skill travel to every agent. Anthropic's own documentation is blunt about it, warning that Skills and plugins should be treated like installing software and that a bad one can direct the agent to run code or misuse tools - Claude Developer Platform docs. This is not hypothetical caution. 2025 produced a string of real incidents that prove the threat is live.

The watershed was the s1ngularity attack in August 2025, notable as one of the first documented cases of malware weaponizing AI CLI tools themselves. Attackers published malicious versions of the popular Nx build packages that specifically hunted for the config files and tokens of AI tools like Claude, Gemini, and Q, then abused those tools' own permissions for reconnaissance and exfiltration. GitGuardian's analysis found 2,349 distinct stolen secrets across 1,079 compromised repositories, and the attackers created over 1,400 public repositories to leak the loot - The Hacker News. The lesson is uncomfortable and precise: the elevated access we grant our agents is itself a target, and a compromised dependency can turn your helpful agent into the attacker's tool.

Weeks later the Shai-Hulud worm showed how this spreads at ecosystem scale. Discovered in September 2025, it was a self-propagating npm worm that compromised hundreds of packages, harvested cloud and CI tokens, and republished itself using any credentials it found, prompting a CISA advisory on September 23, 2025 and a resurgent "2.0" variant in November - CISA. This matters directly to our topic because plugins and many MCP servers install from that exact npm supply chain. The portable-format ecosystem inherits the security posture of the package registries it rides on, and those registries have been under sustained attack.

• s1ngularity (Aug 2025): malware hunted AI CLI credentials, 2,349 secrets stolen
• Shai-Hulud (Sept 2025): self-spreading npm worm, hundreds of packages, CISA alert
• MCPoison, CVE-2025-54136: silently swapped an approved Cursor MCP config for a malicious one, yielding persistent code execution - Check Point Research
• Tool poisoning: hidden instructions inside an MCP tool's description, now codified as OWASP MCP Top 10 entry MCP03 - OWASP
• GitHub MCP exploit: a malicious public issue hijacked an agent into leaking private repos through a public pull request - Invariant Labs

Those last three are the ones that should change how you configure tools, because they attack the trust model rather than a bug. Tool poisoning hides malicious instructions in the parts of an MCP server a human never reads but the model always does, its name and description. The GitHub MCP exploit needed no compromised tool at all: untrusted content, a public issue, flowed into a trusted agent connected to a fully legitimate server, and that was enough to exfiltrate private data. This is the structural pattern behind almost every agent security failure, the combination of private data access, exposure to untrusted content, and the ability to act, and we treat it in depth in our guides to prompt injection defense and to securing agents with non-human identity.

Security researchers have a useful name for the pattern behind these incidents, the lethal trifecta: an agent that simultaneously has access to private data, exposure to untrusted content, and the ability to act or communicate externally. Remove any one leg and most exfiltration attacks collapse. An agent that reads private repos but cannot reach the internet cannot leak them. An agent exposed to a malicious public issue but with no private access has nothing worth stealing. This is why the strongest single control is not a scanner but an architecture decision: never let one agent hold all three legs at once. Split the read-private task from the write-public task, gate any outbound action behind a human, and the poisoned skill or tool description loses its payload even when it slips past your review.

The right response is neither panic nor complacency, it is discipline, and it maps cleanly onto the "install software" framing. Install skills, plugins, and MCP servers only from sources you would trust with a shell on your machine, because that is effectively what you are granting. Prefer official registries and commit-pinned community marketplaces over a random gist. Sandbox aggressively, run agents in a devcontainer or a VM when they touch anything untrusted, and never wire an agent to both your private data and the open internet without a human in the loop. The portability that makes a skill valuable is exactly the portability that makes a malicious one dangerous, and the mitigation is to treat capability as privilege.

11. The players and the standards war

Step back from the formats and look at the board, because the market structure explains why the standards exist at all. The AI coding world has split into two layers that are pulling apart in value. Below sits the model, the raw intelligence, which is commoditizing fast as three or more labs reach rough parity and prices fall. Above sits the agent, the tool where work actually happens, and that is where revenue and lock-in now concentrate. When intelligence becomes a cheap input, the money moves to whoever owns the workflow that turns intelligence into outcomes, and right now that is the coding agent.

The financials make the split vivid. Cursor's parent Anysphere raised at a $29.3 billion valuation in November 2025 with over $1 billion in ARR, and was then reported to be acquired by SpaceX for around $60 billion, described as the largest venture-backed startup acquisition ever - TechCrunch. Anthropic hit roughly a $30 billion annualized run rate by April 2026, with Claude Code its fastest-growing product ever. Adoption is shifting fast underneath the valuations: in the JetBrains 2026 developer survey of more than 15,000 developers, Claude Code led at 39% adoption, up from 18% at the start of the year, while GitHub Copilot slipped to 21% and OpenAI Codex rose roughly fivefold to 16% - JetBrains.

Now the first-principles question that explains the whole standards war: why would fierce competitors donate their standards to a neutral foundation? The answer follows directly from the two-layer split. No single lab can force a standard while rivals sit at parity, so the connective tissue between agents becomes worthless to fight over and expensive to fragment. The rational move is to make the plumbing free and unownable, then compete ferociously on the model and the agent experience above it. That is exactly what happened in December 2025 when Anthropic's MCP, OpenAI's AGENTS.md, and Block's Goose were all donated to the same Agentic AI Foundation - Linux Foundation. The standards are engineered to be unownable precisely because ownership would be worthless and destructive.

The upstart players are worth watching because they are betting on this same logic from the other direction. Zed and JetBrains launched the Agent Client Protocol (ACP) and an ACP Registry so any agent can plug into any editor, published once and available everywhere - Zed. Factory raised a $150 million Series C at a $1.5 billion valuation for its enterprise "Droid" agents, and open-source, model-agnostic tools like OpenCode and Cline have built large followings by charging no model markup at all. The strategic pattern is consistent: the incumbents make the protocol free to remove it as a battleground, and the insurgents make the client free to attack the incumbents' margins. Value is being squeezed out of the connective layers and concentrated at the extremes, the model below and the agent experience above. For a broader tour of the tooling ecosystem, our roundup of the top agent frameworks maps the adjacent landscape.

12. Where one skill, every coder breaks: five honest limits

A guide that only sold the promise would be marketing, not analysis, so this section pressure-tests the thesis. "One skill, every AI coder" is directionally true and genuinely useful, but it is not absolute, and the places it breaks are predictable enough to plan around. The core reason it breaks is a distinction the marketing elides: a standard fixes the interface, not the behavior. Two agents can both read the same SKILL.md and the same AGENTS.md and still do different things with them, because the file is an input to a model, and the models differ. Portability of the artifact does not guarantee portability of the outcome.

The first and most important limit follows directly. Thirty-plus agents read AGENTS.md, and each interprets it through its own model, its own system prompt, and its own tool set, so the same instructions produce different results in different tools. The second limit is the capability floor: a portable skill silently assumes the agent running it is smart enough to execute it, so a Skill authored against a frontier model like Claude Opus 5 or GPT-5.6 can degrade badly on a weaker or cheaper model, even though the file loaded fine. The third is neutral governance with a platinum paywall: the foundations are open, but the eight paying members steer the roadmap, so "vendor-neutral" is neutral among the giants, not among everyone.

• Interface, not behavior: same file, different model, different result
• Capability floor: a skill degrades on a weaker model even when it loads
• Platinum-tier steering: neutral governance still concentrates influence
• Registry fragmentation: MCP Registry, Docker Catalog, and ACP Registry already compete
• Lock-in re-accumulates above the protocol: memory, subagents, and orchestration are proprietary

The last two limits are where lock-in quietly comes back, and they are the ones that matter most for a five-year decision. Registries are already fragmenting: the official MCP Registry, the Docker MCP Catalog, and Zed's ACP Registry are separate directories with separate trust models, so "publish once, appear everywhere" is not yet true at the distribution layer even though it is true at the format layer. And crucially, the labs' deepest features sit above the shared protocol. Persistent memory, native multi-agent orchestration, background execution, and managed sandboxes are not standardized, so a team that leans on them re-accumulates exactly the lock-in the open formats were supposed to prevent. The honest summary is the one to remember: the plug is becoming standard, but the socket's electricity is not. You can move your skills and rules between tools cheaply. Moving your whole way of working is still a migration. Our writing on agent memory architectures shows just how proprietary that layer remains.

13. The adoption playbook: standardize once, travel everywhere

Enough theory. Here is what to actually do, framed so a small team can run it this week and get most of the portability benefit for a few hours of work. The governing principle is to push everything you can into the open, portable formats and keep the tool-specific packaging thin. The more of your agent setup that lives in AGENTS.md, MCP, and SKILL.md, the less any single tool owns you, and the cheaper every future switch becomes. Work the layers in order of leverage, which is roughly the order they pay off.

Start with the rules layer, because it is the cheapest win and the most portable. Write one AGENTS.md at your repo root with your build and test commands, conventions, and guardrails, and for the one holdout, Claude Code, symlink it so a single file serves both tools. Then expose your real systems through MCP rather than pasting credentials into each agent, and author your repeatable procedures as SKILL.md folders so the know-how travels. The commands below are the entire glue for a portable setup.

# Make one canonical instruction file serve Claude Code too
ln -s AGENTS.md CLAUDE.md

# Author a project skill Claude Code and ~46 other agents can load
mkdir -p .claude/skills/release-notes
$EDITOR .claude/skills/release-notes/SKILL.md

# Install a vetted plugin bundle from a trusted marketplace
/plugin marketplace add anthropics/claude-code
/plugin install release-tools@claude-code

A minimal SKILL.md shows how little it takes to make know-how portable, and the description line is the part to labor over, since it is the trigger the model matches against. Keep the name short and lowercase, make the description state both what the skill does and when to use it, and put the actual procedure in the body.

---
name: release-notes
description: Draft release notes from merged pull requests. Use when the user asks to summarize changes, write a changelog, or prepare a release.
---

# Release notes

1. List merged pull requests since the last tag.
2. Group them into Features, Fixes, and Breaking changes.
3. Write one plain-language line per item, linking the PR.
4. Output Markdown ready to paste into the GitHub release.

The interpretation to carry away is a sequence, not a checklist, because order determines payoff. Rules first, because AGENTS.md is trivial and instantly cross-tool. Tools second, because MCP removes credential sprawl and connects every agent to the same systems. Know-how third, because SKILL.md turns your best procedures into assets you keep when you switch tools. Packaging last and lightly, because plugins and extensions are conveniences that bundle the first three, not things worth deep investment. A different answer to the same portability problem, worth knowing about, comes from cloud AI-workforce platforms: instead of copying a SKILL.md onto every machine, a platform like O-mega keeps skills in a managed library its agents search and load at runtime, so the same capability is available to an entire fleet without per-device setup, an approach we contrast with local-CLI setups in our guide to vibe-automating agents. Choose the model that fits how your team works, but push the value into the open formats either way.

This is the shift that Yuma Heymans (@yumahey), founder of O-mega and co-founder of the autonomous recruiting platform HeroHunt.ai, has been circling for years: the durable value in AI is not the model of the month but the repeatable, reusable capability you build on top of it, the thing that keeps working when the model underneath changes. A portable skill is that idea made concrete.

14. The future: the plug is standard, the electricity is not

Where does this go? The first-principles read is that the connective layers will keep commoditizing and the value will keep migrating to the two ends, the model below and the agent experience above. Standards like AGENTS.md, MCP, and Agent Skills are becoming genuine infrastructure, boring in the best sense, the way TCP/IP and HTTP are boring. Nobody competes on whether their app speaks HTTP. Within a year or two, nobody will compete on whether their agent reads AGENTS.md or speaks MCP either. Those will be table stakes, assumed, invisible, and free, and the competition will move entirely to what sits on top.

That migration is where the interesting fights of 2026 and 2027 will happen, and it is why the "one skill, every coder" story has a ceiling. The layers that are still proprietary, persistent memory, native multi-agent orchestration, background autonomy, and managed sandboxes, are exactly where the labs are investing hardest, because they are the layers a standard has not yet flattened. Expect the next wave of lock-in to form there, above the shared protocol, even as the protocol itself becomes fully open. The portable formats solved the artifact problem. They did not solve the workflow problem, and the workflow is where switching costs will regroup. Our coverage of long-running coding agents and of self-improving agents tracks that frontier.

For the operator making decisions today, the strategic conclusion is steady and reassuring. Adopt the open formats aggressively, because they are free, they are converging, and they are the one part of your AI stack that will not strand you when you switch tools or models. Treat every layer above them, the memory, the orchestration, the polish, as a rental you can walk away from, and keep your genuinely valuable know-how in portable SKILL.md folders and portable AGENTS.md rules that you own outright. The plug is becoming standard across every AI coder, which is a real and hard-won gift. Just remember that the electricity running through it, the intelligence and the workflow, is still very much for sale.

Conclusion: a decision framework

If you take one thing from this guide, take the four-layer model, because it turns every future decision into a simple question. Rules go in AGENTS.md, tools connect through MCP, know-how lives in SKILL.md skills, and packaging is a thin, disposable wrapper. Anything a vendor sells you should be sorted into one of those four boxes, and the moment you can name the box, you can see whether you are buying something portable and cheap or something proprietary and sticky.

The decision rule follows directly from the scorecard. If your priority is freedom to switch tools and models later, weight portability, standardize on the open formats, and favor the open, model-agnostic tools that lead the scorecard, such as Zed and OpenCode. If your priority is the most refined experience today and you accept the lock-in, a higher-polish tool like Claude Code or Cursor is a rational choice, as long as you keep your rules and skills in portable formats so the exit stays cheap. Either way the winning move is the same: own your know-how in open formats, rent everything else. Push value down into AGENTS.md, MCP, and SKILL.md, keep the packaging thin, treat every skill and plugin as executable code from a source you trust, and you get most of the "one skill, every AI coder" promise while sidestepping most of its traps. The convergence is real. The discipline is on you.

This guide reflects the AI coding and agent-tooling landscape as of August 2026. Models, prices, and features in this space change monthly, so verify current details on each vendor's official pages before making a purchasing or architecture decision.