Everyone Agreed What an AI Plugin Is. Nobody Said How to Install It.

Amazon, Cursor, Microsoft, OpenAI and Vercel do not agree on much. Last week they all put their names on the same thing: the Agent Plugins Specification 1.0.0, one standard way to package a plugin for AI agents. A folder. A plugin.json at the top, a skills/ directory beside it, an mcp.json for the tools.

That part needed doing. Before this, every vendor shipped its own flavor of "plugin" and you translated between the flavors by hand.

Here is the part that gets me. The spec covers packaging only, and it says so right in its own scope. Installation? Distribution? Getting one plugin into the five agent configs you already maintain? Out of scope. The spec draws a clean box around what a plugin is, then stops at the edge of the box.

So I did the math on my own machine. Five agents, one plugin. The manual way is five config files in five different shapes, five chances to fumble a path, five restarts, and an uninstall that turns into an archaeology project across all five. The industry standardized the box, then left everyone standing in the parking lot with no truck to ship it in.

mcptoon 0.7.1 fills that gap. Same idea the CLI has always had, write every agent's native config for you, now pointed at the new plugin format.

Four commands

mcptoon plugin scan <dir>      # validate a plugin package (read-only)
mcptoon plugin install <dir>   # install into mcptoon + every synced agent
mcptoon plugin list            # what is installed
mcptoon plugin remove <name>   # remove everywhere

scan validates. install propagates. list shows what landed where. remove pulls it back out of every config it touched.

install is the one worth studying, because it makes three decisions a naive installer would get wrong.

Variables get resolved before they reach an agent. Plugin packages reference ${PLUGIN_ROOT} and ${PLUGIN_DATA}, and the spec assumes the loading agent will expand them. Most agents cannot. That is exactly why the gap exists. mcptoon is the installer, so it expands both variables into absolute paths itself and writes plain paths into every agent config. No agent ever sees a variable it cannot understand. When mcptoon launches a plugin's stdio server, it injects the same two names as environment variables, so spec-compliant plugins work both ways.

Remove reaches everywhere install reached. plugin remove does not just delete a folder. It prunes the namespaced plugin:server entries out of every agent config the install touched. One thing it keeps on purpose: the plugin's data directory under ~/.mcptoon/plugins-data/. The spec asks for persistent plugin data, so a cache survives an upgrade or a --force reinstall. Delete that folder yourself if you want a truly clean slate.

Validation fails closed. plugin scan checks the manifest against a closed schema. Unknown fields get rejected. Commands must be a single token. Remote URLs must be HTTPS unless they point at loopback. Credentials in headers get refused. Path escapes like ../ get refused. A package that fails scan never reaches an agent config.

Try it

# 1 · install (about 250KB, pure standard library, zero dependencies)
pip install mcptoon

# 2 · validate any Agent Plugins package, no side effects
mcptoon plugin scan ./my-plugin

# 3 · install it into every agent you have synced
mcptoon plugin install ./my-plugin

Because plugins land in the same config as every other MCP server, they inherit everything mcptoon already does. The compressed manifest that saves up to 99.8 percent of tool-listing tokens. mcptoon call. mcptoon health. Version 0.7.1 also picked up stdio cwd support along the way, so a plugin server can declare its own working directory.

The honest limits

This is an installer, not a marketplace. There is no registry search yet, you install from a directory you already have. The validator rejects anything the spec does not define, which is the point, but it also means creative non-standard packages bounce. Data directories persist by design. Cold starts on stdio servers still cost a few hundred milliseconds each.

The suite behind all of this is 610 tests, green in CI, plus a 19-point livefire run against real agent configs.

The vendors settled what a plugin is. Getting it onto every agent on your machine used to be your problem. Now it is one command.