GitHub Adds Agent Plugins 1.0 Across VS Code, Copilot CLI, and the Copilot App
The August 12 release makes skills and MCP configurations portable, while leaving trust and permission review to users and administrators.
Key takeaways
GitHub announced on August 12, 2026 that Agent Plugins 1.0 support is generally available in VS Code, Copilot CLI, the Copilot SDK, and the Copilot app. A single package can carry skills, MCP server configuration, and client-specific extensions, reducing duplicate setup across tools. The practical task is to verify the publisher, manifest version, commands, external connections, and permission boundaries before installation. Test one reversible, read-only workflow in a repository without production credentials, then decide whether the package belongs in a team marketplace or managed policy. Portability is not a security endorsement: every command, credential, server, and tool call inside the package still needs an explicit review and revocation path.
# GitHub Adds Agent Plugins 1.0 Across VS Code, Copilot CLI, and the Copilot App
August 13, 2026
Direct answer
Agent Plugins 1.0 standardizes packaging and distribution; it does not certify safety. Inspect the manifest and bundled components, test a read-only task, and verify uninstall and revocation behavior before team rollout.
Fact sources
GitHub announced general Agent Plugins 1.0 support across VS Code, Copilot CLI, the Copilot SDK, and the Copilot app on August 12, 2026.
The specification uses plugin.json at the root, a skills directory, optional MCP configuration, and namespaced client extensions.
Existing Copilot plugins remain supported, while enterprise managed settings can govern plugins, marketplaces, and MCP allowlists.
Five checks before installing an Agent Plugin
- Verify the publisher, repository, license, version, and maintenance history.
- Inspect plugin.json and inventory every skill, MCP server, command, and client extension.
- Install in a test repository without production credentials and run one reversible read-only task.
- Observe network calls, approvals, logs, failures, and configuration left after uninstall.
- For teams, pin a version and assign owners for marketplaces, approval, and revocation.
Why it matters
A portable package can spread the same capability and the same configuration mistake across several AI clients, so distribution efficiency and security review must move together.
Impact for ordinary AI users
Developers can reuse one capability across Copilot surfaces instead of copying configuration. They also need to understand what the package executes and connects to, especially when MCP servers or shell commands are included.
Related tools and tutorials
Start with one reversible task, verify version, permissions, cost, and logs, then record the result in the team runbook.
AI software and tools · AI account and cost services · AI skill tutorials · AI frontier news
FAQ
Is Agent Plugins 1.0 the same as MCP?
No. A plugin is a distributable package that may include MCP configuration; MCP is the connection protocol for tools and data.
Must existing Copilot plugins migrate now?
No. GitHub says existing plugins that do not target the 1.0 specification remain supported.
Will every compatible client behave identically?
No. Clients load supported components, and namespaced extensions can create client-specific behavior.
Source links
- GitHub Changelog: Agent Plugins 1.0 (2026-08-12)
- Agent Plugins: Build an Agent Plugin
- GitHub Docs: About GitHub Copilot plugins
- Agent Plugins Specification 1.0.0
What this means for everyday users
Record publisher, specification version, components, commands, connections, approver, test result, and revocation steps.
Related reading
From Chat Boxes to Personal AI Companions: AI Assistants Are Entering the Desktop Execution Era
AI assistants are moving from answering questions toward continuing real tasks. AI agents, MCP tool ecosystems, personal memory, and local workbenches are pushing this shift together. For users, the real value is not another chat box, but less repeated context setup and more continuity from thinking to doing.
GitHub Copilot Metrics Add OpenCode and Other Clients: Requests Are Not Prompts
GitHub added totals_by_client to the Copilot usage metrics API on October 23, 2026. Enterprise and organization reports can now show model traffic from OpenCode, Claude Code, Codex, Zed, Copilot CLI, GitHub apps, cloud agents, code review, VS Code, JetBrains, and other clients. This article helps administrators build reliable one-day and 28-day reports without confusing model calls with user prompts. It explains request, session, token, model, and selection-mode fields; separates client traffic from agent-app jobs; and adds checks for unknown identifiers, empty arrays, permissions, and coverage. The result is a governance trend report, not an exact invoice or individual productivity score.
GitHub Copilot in Teams Turns Notifications Into Pull Requests: What to Check Before Review
GitHub updated its Microsoft Teams app on October 23, 2026, so an issue notification in a channel, group chat, or private chat can become a Copilot task that investigates the problem, proposes a fix, and opens a pull request. This article helps development and product teams adopt the workflow without mistaking an automated pull request for shipped code. It explains the consolidated app, repository connection, the November 16 retirement of the legacy GitHub app, and the review boundary. A practical acceptance checklist asks teams to reproduce the issue, inspect changed files, run targeted tests, verify permissions, and keep merge and deployment as explicit human decisions.
Copilot in Visual Studio Adds PR Exploration, a BYOM Migration, and NuGet Fixes
GitHub summarized three September updates for Copilot in Visual Studio 2026 on October 22, 2026. The Git agent can explore an attached pull request and link back to comments and files. Bring Your Own Model remains in preview but now requires the new Agent experience, and previously configured Ollama models must be added again. NuGet Audit warnings can open Copilot Chat with the NuGet MCP server to propose dependency fixes. This article gives .NET developers a cautious upgrade checklist: preserve current settings, validate each feature independently, review package and lock-file changes, run targeted tests and vulnerability scans, and keep a rollback path. Summaries and suggested fixes remain review inputs, not verified outcomes.
GitHub Copilot Global Defaults Take Effect: Review Unconfigured Features Before October 26
GitHub began enforcing the global default policy for Copilot Business and Copilot Enterprise on October 22, 2026, with the gradual rollout continuing through October 26. Eligible generally available features that remain Unconfigured will receive the selected default: Enabled, Disabled, or Let organizations decide. This is a one-time change. Explicit feature choices are preserved, and preview features remain opt-in. This article gives administrators a practical review before the policy reaches their enterprise or organization. It separates unconfigured items from deliberate decisions, checks both Features and clients and MCP servers in Copilot, records exceptions, and defines a user-access verification. The goal is to prevent silent access changes caused by assuming that Unconfigured means disabled.
GitHub Copilot Impact Dashboard Adds Industry Comparisons: How to Read the Median and Top Decile
GitHub added an Industry comparison section to the Copilot impact dashboard on October 22, 2026. Eligible enterprises and standalone organizations can opt in to compare agent-first or multi-agent adoption and pull-request merge-rate leverage with aggregated participating peers. When enough peers participate, scores are placed against a 28-day median and, as the group grows, a top-decile reference. This article explains how to decide whether to opt in and how to avoid overreading the result. It covers company-size and industry groups, fallback to broader peer groups when samples are small, regional separation for data-residency customers, daily refreshes, and 30-day deletion of aggregated benchmarks. The comparison is context for planning, not a complete industry census or employee ranking.
Summary
Agent Plugins 1.0 improves reuse, but portability and trust are separate decisions. Inspect the package, test narrowly, pin versions, and keep a documented revocation owner.