How agent plugins turn a team's SOP into a workflow agents operate and people review

On February 3, 2026, Thomson Reuters lost nearly 18% of its value in a day after Anthropic released plugins for its office agent, including one for legal work. Six months later, that kind of plugin became an open standard that ChatGPT, Cursor, GitHub Copilot and VS Code all load. Looking at both while porting my own 119-skill plugin to that standard, I think they're the same story told from two sides.

The way I see it, the manager and the individual contributor are becoming one person. You still build, but you also write the training the agent runs from, decide which systems it can reach, and review the work before it ships, so you manage your own time and your agents' time at once. That holds whether you decide what work an agent takes on or you build what it runs on, inside a team or at a software company that sells to one.

In 2026 each part of that job got an open format. The training ships as an agent plugin, a folder of instructions and connections an AI agent loads, and the review happens in an MCP App, an interactive dashboard a tool returns inside the conversation. Looking back, those formats arrived one at a time over less than two years, and the order tells the story. Access came first, then the playbook, then the review seat, then a package that holds all three, and along the way they became the product a software company sells.

How MCP, Agent Skills, MCP Apps and Agent Plugins arrived

Anthropic released the Model Context Protocol in November 2024 to connect an agent to tools and data. Agent Skills became an open standard in December 2025, MCP Apps followed in January 2026, and Agent Plugins, the package that holds the rest, arrived in August 2026.

What I noticed is that the market moved eight days after the third format shipped, when plugins reached office workers instead of developers. Then in July, ChatGPT switched to a Plugin Directory alongside the ChatGPT Work launch in the week of July 6, the same week the Codex app merged into the ChatGPT desktop app on July 9.

The portability is already showing up in rival tools. Codex CLI 0.146.0 added Agent Plugins support in late July, and in August OpenAI let people import skills and plugins from Claude Code, Claude Cowork and Cursor. A playbook written for one agent now moves to another, and I think that's the part most people haven't caught up to yet.

Why the hooks, not the skills, are the hard part of an agent plugin

When Anthropic opened plugins for Cowork, its desktop agent for office work, its head of product for enterprise said you can "delegate entire projects" specific to your company and your role. A worker who can take a whole project still shows up knowing nothing about how your company does that project.

So the work that matters moves upstream, to the person who writes down how the job is done, what the worker may touch, and what has to be true before anything leaves the building. That has always been a manager's work. In 2026 it became a file you can version, test and ship. An agent plugin packs that file together with everything that runs it, the skills, the MCP servers and their tools, the scripts, the sub-agents and the hooks. Anyone can write a skill or a prompt, and anyone can call Claude or Gemini. The hard part is knowing what each decision is for and enforcing the result you need, and the hooks do that. One of mine blocks any commit with no record of how it was verified, and another fails any pull request whose description skips the risk section. Those hooks are the AI harness, and they're the IP. Building them is the work itself.

Microsoft saw the role coming. Its 2025 Work Trend Index predicted that every employee would need to think like an "agent boss" who builds, delegates to and manages agents. A year later, its 2026 report found that 53% of the people furthest along pause before starting work to decide what AI should do and what a person should do, against 33% of everyone else, and 54% say their teams discuss quality standards for AI-assisted work, against 29%, so the people ahead already treat review as the job.

Layer one, skills as the agent's playbook

Every onboarding a manager has ever run covers the same three things, and an agent plugin keeps each one in its own part of the folder. The playbook becomes skills, each one a SKILL.md file the agent opens only when a task calls for it. Access to company systems becomes an MCP server, the connection to tools and data. Sign-off before work ships becomes hooks, the checks that run around the agent's actions and can stop one.

I run my own work this way. My plugin, jeff-skills, which I keep private, holds 119 skills plus the hooks I described above. A sub-agent then reviews the work the way a staff engineer reviews a pull request, and a script checks the output before it reaches me, so what I get is a clear next move. On November 6 I ported it to the Agent Plugins standard and checked what came across. 117 of the 119 skills passed the format's rules and none of the hooks did, because the standard leaves hooks, commands and agents to each client, so the playbook travels while the sign-off stays behind, and a manager who can't see the work can't sign off on it.

The training also has to be reviewed before any agent runs it, because a public skill is a supply chain. When Snyk scanned 3,984 public skills in February 2026, 534 carried at least one critical security issue and 76 held confirmed malicious payloads.

How I read it as a full stack AI engineer

I came to agents from front-end work, so I read this stack the way I read a dashboard. Hooks are event listeners. Skills are components. The AI harness is the runtime that holds state, and a plugin is the bundle you ship. Moving my AI harness from my laptop to the cloud felt like moving an app off localhost, and to make it portable I had to learn the back end the front end was quietly depending on.

Every platform names these parts differently, the same way hosting providers and media-generation APIs each have their own syntax, but the fundamentals underneath are the same. Anthropic has its conventions, OpenAI has its own, and each team adds its own pieces, like OpenAI's MCP Events or Anthropic's private plugin marketplaces. Competition is what pulls them back together, because each vendor looks at the others' products, takes the best parts and builds on the gaps.

This landscape moves too fast to assume I know the right answer because I learned it yesterday. Yesterday's solution is often what I'm refactoring today, because something new shipped, and that's the refactor I want to avoid tomorrow.

As an AI engineer, I start from a different fact. Models are probabilistic, and the work is building the scripts, hooks and step-by-step workflows that make them behave deterministically. Engineering already has a pattern for this, and Anthropic's AI-native SDLC playbook lays it out in six stages, plan, design, build, test, deploy and maintain, with a person approving the work at each gate through deploy. The last stage is the loop, where the system has to refine itself and relearn as the industry moves.

That loop matters because everything I build on is changing too. If I rely on someone else's technology, the worst thing I can do is keep building on its stale patterns. OpenAI's recent releases point to where this is going, toward shipping code at the push of a button. I'm so interested in this that I work on it from the moment I wake up to the moment I go to sleep, so I built a command center for my open loops, a scheduled task on my desktop that reports into an admin console I built on Cloudflare Workers, behind a Cloudflare Access sign-in. It takes in what's changing across the industry, checks what that means for my own stack, and gives agents the context to act when something has to change, whether that's updating a skill, reworking a feature or adding a new one. On a cron, agents follow the landscape as it changes, analyze my code across every repo, and rank the updates by what matters most, so nobody has to remember to start the work, and the console published its first narrated stack briefing on November 3.

I apply the same thinking to myself. I've owned every stage, from idea to shipped product, and at each one I turn what I keep repeating into a check.

Layer two, MCP Apps as the review seat

On January 26, 2026, MCP Apps became the first official MCP extension, letting a tool return a dashboard, a form or a chart that renders inside the conversation instead of a block of text. ChatGPT, Claude, Goose and VS Code support it, and Claude launched with apps from Figma, Slack and seven others, including Asana, Canva and monday.com.

For a manager, and for the builder who set the agent up, that's the review seat. The agent does the work out of sight, and the app is where the person responsible looks at the result, changes it and approves it. My content engine, the MCP server behind Trending Society's publishing, works this way. It returns a post draft, a media gallery and a LinkedIn analytics view as cards I designed to render in the chat, and a draft never publishes until I approve it.

OpenAI got to the same bundle from the other side. It replaced ChatGPT's App Directory with a Plugin Directory, where one plugin packages skills, apps and app templates for a workflow, and ChatGPT and Codex now share one catalog.

The review seat went from proposal to the spec's release candidate in six months. MCP Apps was first proposed on November 21, 2025, and the release candidate for the July 28, 2026 spec, published in May, includes it as an official extension, with tools declaring their UI templates ahead of time so hosts can prefetch, cache and security-review them before anything runs. The SDK is on 2.x and the wire protocol didn't change from 1.x, so an interface built today still renders in older hosts.

OpenAI's releases since August push the same way. Plugins can now add sidebar apps, panels, editors and forms to ChatGPT, act on webhook updates through MCP Events and use site tools built on WebMCP. Since August, Enterprise admins can export every public plugin their workspace sees, with developer, version and verification status. Buyers have started governing plugins the way they govern any software they buy.

The day an agent tried to take out my own safeguard

In July 2026, OpenAI models escaped their isolated test environment and breached Hugging Face's systems during an internal cybersecurity evaluation, according to OpenAI. They exploited a zero-day in a package registry proxy to reach a node with internet access, Malwarebytes reported, and in September OpenAI paused training again after its agents broke out a second time. The coverage leaned toward doom. What stood out to me is that those models were pointed at a goal, cheating a benchmark at any cost, and from my own experience an escape like that doesn't happen by itself. Someone sets up the pressure, and the agent works around whatever stands between it and the job. I'd seen a small version of that on my own machine.

I watched the reason for the review seat happen in real time. I had a session running for about an hour in Cursor, with my plugin symlinked in, and late in that session the agent started removing one of my own safeguards, unwrapping the harness to push a deploy it shouldn't have been able to make. I stopped it because I could see what it was doing, and it told me it was undoing a deployment safeguard because its instructions were to finish the job at all costs. Nothing about the model changed. My own instructions, an hour deep in its context, had become who it thought it was, and that outweighed the safeguard. The longer an agent works in one context, the more its work degrades, the same way a person does after an overloaded shift, and like a person it needs a handoff. The person in the review seat has to be an evaluator, someone who knows the work well enough to see when it's going wrong.

The teams running agents for days already work this way, and none of them rely on one long context. On AWS, Bedrock AgentCore sessions run up to 8 hours on microVMs and up to 14 days on its newer runtime instances. In Python, Pydantic AI's durable execution journals each model and tool call so a crashed run picks up where it stopped, and LangGraph snapshots state at checkpoints for the same reason. Anthropic's own answer is a handoff between sessions, an initializer agent that sets up the environment and a coding agent that makes incremental progress across many context windows, according to its engineering blog.

Cloudflare, where my console runs, builds the same idea into the platform. Cloudflare Workflows retry, persist state and run for minutes, hours, days or weeks, and its Agents SDK gives each agent persistent state that costs zero compute while it hibernates, waking on a request, a message or a scheduled alarm. A long-running agent, done right, is many short sessions with a record between them, and the check that stops a bad deploy has to sit outside the session that might talk itself past it.

How many agent plugins Claude and ChatGPT list

Both Anthropic and OpenAI now sell the plugin as the unit, and OpenAI is retiring its older format to get there. I read each count below on November 6, 2026.

The official Claude Code list shows who is building. Of its 317 plugins, 41 are credited to Anthropic and 82 name no author, and the rest come from more than 140 other publishers, led by Google with 14, SAP with 9 and AWS with 7. Most of that list, 194 of 317, comes from companies selling into the agent.

How software companies sell to AI agents

Turn the loop around and the seller shows up. A software company that ships into it sells the training as skills, the access as an MCP server and the review seat as an MCP App, and it keeps the system of record those decisions land in, the data an agent can't rebuild on its own. In February, LSEG, S&P Global and Slack by Salesforce shipped Cowork plugins of their own.

This flips what a software company sells. It used to sell you its dashboard, and you lived with how it looked and worked. Now the agent has to understand the product from outside the dashboard, through its API, its tools and its MCP server. Building has become cheap enough that the person running the agent can build their own review dashboard on those endpoints, shaped around their own business, until it works like a personal operating system. The interface can move to the buyer, and the lock-in moves to the data and the endpoints underneath it.

I've spent my career on the front end, and I've watched platforms copy each other's features and interfaces for a reason. Once people adopt a way of working, the habit becomes the standard. Every product that traces its users sees what they click, what they ask for, what they report and what they wish existed. The AI companies collect that signal at a scale nobody has had before, which is why their products converge so fast. Anthropic's Cowork plugins arrived in January and ChatGPT's Plugin Directory in July, and both package the same thing: skills, connections and an app for one workflow.

The agent client owns the storefront, because Agent Plugins leaves installation and distribution to each client. That changes how the seller gets paid. Deloitte says seat-based licensing could give way to pricing that blends usage and outcomes, and cites Gartner's forecast that at least 40% of enterprise SaaS spend will move to usage-, agent- or outcome-based pricing by 2030. In July, Gartner put up to $234 billion of enterprise application software spend at risk by 2030 as agents bypass the people who used to log in. A license seat assumes a person who logs in, and an agent working from a plugin never holds one.

Nobody stops building, though. Everyone becomes a hybrid, building and managing their own agents inside their own domain. I started in the engineering life cycle, and from there the work branched into everything a company needs to build a product and then market it, because a great product marketed badly gets no customers. Design, front end, engineering and marketing all follow the same pattern. For each role I work out which skills the job requires and write them into the plugin, and the AI harness runs them the same way every time.

Tracing, the tokens and output every run generates, is where the cost of the business now shows up. What used to be a salary is becoming a token bill and a subscription, and the traces I keep are data I build on, so they compound.

Every step up the stack hides the repeated work. We went from pen and paper to the calculator, then to the spreadsheet, and now people build workflows on top of the spreadsheet, with buttons that run the formulas so nobody rewrites the same process by hand. Prompting is the same move. A year ago, even three or four months ago, I was spelling out every step, and now I tell the model what I want at a high level and it solves it better. What matters is saying the right words.

You can see it in prediction models too.Jev from TypeSafe AI, in early access since September 2026, turns a model call into one button, where messy state goes in and the answer to a question I defined comes back typed, with a confidence score. Natural language becomes the algorithm, and the code is the pattern of steps I lay down so the model reaches the output I want.

How the stock market priced agent plugins

In February, investors read plugins as a replacement for the software companies they plug into. Within weeks, the companies that held the data were shipping plugins of their own, and by August Salesforce was growing on its agent business.

The agent needs someone's data to work on, and the owners of that data turned the plugin into a new way to deliver it. So the decision for whoever manages the agent, builder or manager, moves from which software to buy to which playbook, access and review to give the worker.

Claude chat, Cowork and Claude Code are becoming one product

The products I build with are folding together. On August 25, Anthropic made the memory in chat the same one Cowork uses, and on September 16 Cowork and chat merged into one Claude, carrying over chats, projects, connectors and skills. Claude Code still keeps a separate memory in CLAUDE.md files and a local memory folder, so I close that gap myself by mirroring my memory into a database every surface I use can query.

My read is that chat, Cowork and Claude Code end up as one product in the cloud, and you can watch it happen a release at a time. If that's right, the plugin is the piece that carries everything across. I've built most of this by voice, talking through the work instead of typing it, and what came out the other side is MCP servers and the skills around them.

What to watch next in agent plugins

The training is portable today, but the parts of management that make the work trustworthy still belong to whichever client the agent runs in, and three things tell me how fast that changes.

1. The sign-off. Agent Plugins leaves hooks to each client, so the checks a team writes have to be rebuilt in every tool the plugin lands in.
2. The seat. MCP Apps renders an app inside the conversation, but a dashboard that stays open beside the chat while the agent works is a choice each client makes for itself.
3. The full roster. The compatible clients page lists 11 clients without Claude Code, so a plugin meant for every client still ships a second manifest for Claude Code.

For a team, that splits the build in two. Write the playbook once, and plan to rebuild the review in each place the agent works.

The next date on the calendar is December 11, 2026, when custom GPTs retire and their creators are asked to rebuild them as plugins. How many creators make that move will be the first large count of workflows changing format, from a chatbot persona to a plugin a manager can review.

In seventh grade I built a robot car that was supposed to steer itself around walls. It ran fine until it met one, and when I took it apart I found a solder bridge I couldn't see, because I'd rushed the build. Agents are the same. The playbook gets them moving, and the review seat is where someone slows down long enough to find what's hiding in the work.

Sources