The week's clearest signal came from the Model Context Protocol: Atlassian's MCP server reached general availability across its whole suite, and a first adapter arrived to carry that server's tools into agent-driven apps. The browser-side standards moved in smaller steps, and Apple set a date to widen what its assistant can do inside apps.
Customization: Atlassian opens its suite to a user's agent
Atlassian brought its Rovo agent server to general availability. The company shipped the second version of its Model Context Protocol server, letting a person's own agent read and act across Jira, Confluence, Bitbucket, and the rest of the suite through that protocol, the standard many vendors are adopting for connecting agents to apps. This version widened coverage to more of Atlassian's products, and the company said the earlier version will switch over to it automatically on March 1, 2027. The general-availability release puts a large install base behind a single standard for letting agents operate the suite.
Alongside the server, Atlassian opened an early-access program for packaging reusable agent instructions as an installable unit in its app platform, so a custom agent can be extended with prepared instructions and reference material rather than reconfigured by hand; it is limited to development environments for now. The same platform update eased Atlassian's forced migration off its older app framework, letting a maker fold several legacy content keys into a single new component, and began showing end-of-support notices to administrators of apps whose makers have committed to migrating.
Why it matters: once a suite this large is drivable by a user's own agent, the packaging and migration changes around it decide how much outside developers can build on top.
Agent apps: an adapter brings MCP tools into AG-UI apps
A first adapter connects an outside MCP server's tools and interface into apps built on the AG-UI protocol. AG-UI is an open protocol, stewarded by CopilotKit, for wiring an app's front end to the AI agent that drives it; the adapter's first release honors which tools are meant to be visible and forwards credentials safely.
Why it matters: the tools and interface an MCP server already exposes can appear inside an agent-driven app a person uses, rather than each app wiring in those tools by hand.
Agentic web: WebMCP adds provenance for a user's agent
WebMCP, the draft browser standard for letting a web page offer tools to a user's own agent, gained a way to record where each tool came from. The editors merged that change, a trust signal for the browser, and relaxed how tool inputs are typed at the request of Chromium's implementers, with work on describing tool outputs and marking developer-only tools still under review.
Why it matters: these early rules put the browser, not the page, in charge of which tools an agent may see and trust, an early step toward a person pointing their own agent at a site instead of relying on a built-in integration.
Standards: WebExtensions takes up an official home for extension types
The cross-browser WebExtensions group took up a proposal to give extension developers one official set of type definitions. Those definitions, which a developer's code editor uses to check that an extension calls each browser's APIs correctly, are fragmented today: Google generates the Chrome ones from Chromium's own source, while the Firefox and cross-browser sets are kept up by volunteers on a community registry, and no single canonical set spans the browsers. At its September 10 meeting the group discussed hosting an official set under its own umbrella but reached no decision, and along the way settled a few small interface details across all four major engines. The heavier thread is the chartered Working Group's September 17 meeting to build out the structure of the specification itself.
Why it matters: an official set owned by the group that evolves the standard would give developers one canonical cross-browser reference, instead of stitching together separately maintained type sets that each track the browsers from the outside.
Infrastructure: sandbox engines tighten how they meter and fence untrusted code
Several of the layers products use to run a customer's or an agent's code in isolation shipped hardening and runtime work, none of it a new end-user capability. Firecracker, the AWS-built microVM engine behind many hosted sandboxes, released a version with faster snapshots and support for newer guest kernels; Apple's Containerization framework hardened how it resolves file paths inside an on-device Linux container; and Wasmtime, the Bytecode Alliance's widely embedded WebAssembly runtime, issued a release candidate that fixes how it meters the cost of running untrusted code, the mechanism a host relies on to keep one guest from running away with resources. Separately, the hosted-sandbox provider E2B added team workspaces and outbound-network controls for organizations running customer or agent code.
Why it matters: customer plugins and agent code execution depend on these components. A flaw in how they meter resources or fence off the file system becomes a flaw in every product built on them.
Platforms: Apple sets September 14 for a wider set of in-app actions Siri can drive
Apple set a September 14 release date for its next iPhone and Mac systems, which turn on an expanded version of the framework that lets apps offer actions for Siri, Shortcuts, and system search to invoke and chain together. The expansion, previewed at the company's June developer conference, adds ways to pass structured data between apps, to run longer tasks with progress and cancellation, to continue an assistant conversation across devices, and to build a Shortcuts automation from a plain-language description that Apple's models assemble; a companion framework lets a user swap in an outside model to power Siri. The date was confirmed at Apple's September 9 hardware keynote, which added no new software news beyond restating that Siri can take actions in third-party apps. Invocation stays mediated by Apple's own assistant; there is no open interface for an outside agent to call an app's actions directly.
Why it matters: Apple is widening how apps can be composed and automated on its platforms while keeping itself the gatekeeper of what may trigger those actions.
Also worth knowing
- A cluster of preprints sketched rules for what an agent may do on a person's behalf. One proposes a machine-readable file, in the spirit of the robots file, for stating per-site terms and compensation for agent access; another shows that the Agent Payments Protocol signs the transaction but not the decision behind it and proposes binding the user's intent as a permission grant; a third proposes a shared contract for gating high-risk agent actions. A fourth demonstrates a sandboxing technique that confines a shell script's side effects so it can be edited with live feedback. All are unreviewed preprints.
- Geiger, a local inventory tool, catalogs the AI agents, connector servers, and plugins installed on a machine and what each is allowed to touch.
On the radar
- September 14: Apple's next iPhone and Mac systems are scheduled to ship, turning on the wider set of in-app actions Siri can drive.
- September 17: the chartered W3C WebExtensions Working Group meets to build out the structure of the specification.
- September 24 and October 8: the W3C WebExtensions Community Group holds its next public calls.
- October 26–30: the W3C's annual TPAC gathering in Dublin, where the WebExtensions groups have opened sign-ups.
- March 1, 2027: Atlassian's earlier Rovo agent server version switches over to the new one automatically.
This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.