Five AI Companies Just Agreed on a Plugin Format — Here's a Free Validator for It

On August 6th, OpenAI, AWS, Cursor, Microsoft, and Vercel published Agent Plugins 1.0.0 — a shared packaging standard so a single plugin folder can install into ChatGPT, Codex, GitHub Copilot, VS Code, Cursor, and AWS's Kiro without rewriting setup instructions for each one. It's not a new format competing with Agent Skills (SKILL.md) or MCP — it's the layer that wraps both: a plugin.json manifest, an optional skills/ folder, and an optional mcp.json for MCP server configs, all in one portable directory.

The catch with a spec this fresh: almost nobody has actually validated a manifest against the real schema yet, because almost nobody's had the chance to. The plugin.json format is deliberately narrow — exactly ten permitted top-level fields, a name field with a strict character-and-length pattern, a closed author object — and most people writing their first one right now are working from blog posts and a single canonical example, not the JSON Schema itself. It's easy to add a field that gets silently dropped, or write a plugin name that looks fine and fails validation outright.

I added a free Agent Plugins Manifest Validator to Bracketly, my free client-side dev tools site. Paste a plugin.json and it checks it against the published 1.0.0 schema: the exact $schema URL, the name pattern (lowercase alphanumeric plus hyphens and periods, no doubled -- or .., must start and end alphanumeric), and correct types on every optional field. It also knows the difference between what the spec treats as fatal versus not — an unrecognized top-level field or a non-object extensions value is explicitly non-fatal per spec (clients report and ignore it, then keep loading the plugin), so those show as warnings rather than errors, matching how a real client actually behaves instead of over-flagging. Paste an optional mcp.json too, and it validates the three MCP transport types — including a rule that's easy to miss by hand: a stdio server's command has to be a single executable token, not a full command line with embedded arguments.

Every check is built directly from the published JSON Schema and spec text at agent-plugins.org, not a paraphrase of a summary post, and verified against more than three dozen hand-constructed test cases — valid and invalid — before shipping.

Like everything on the site, it's 100% client-side. Nothing you paste is sent anywhere.