Source: https://toddschiller.com/blog/extensibility-radar-2026-09-11.html # Note This Week in Extensibility: Atlassian's agent server reaches general availability, CopilotKit pipes MCP tools into AG-UI apps, and Apple widens the in-app actions its assistant can drive Sep 11, 2026 by [Todd Schiller](https://toddschiller.com/pages/about.html) Week of September 5–11, 2026: Atlassian's Rovo agent server reaches general availability across its suite, CopilotKit ships a first adapter that pipes an MCP server's tools into AG-UI apps, and Apple sets a September 14 launch for an expanded set of in-app actions its assistant can drive. extensibilitypluginssandboxesweb standardsMCPWebMCPWebExtensionsAtlassianApple Atlassian's Model Context Protocol server reached general availability across its whole suite this week, letting a person's own agent drive Jira, Confluence, and the rest through that protocol. Separately, CopilotKit shipped a first adapter that pipes any MCP server's tools into apps built on the AG-UI protocol. The browser-side standards moved in smaller steps, and Apple set a date to widen what its assistant can do inside apps. ## Customization: Atlassian opens its suite to a user's agent **Atlassian brought its Rovo agent server to general availability.** The company [shipped the second version of its Model Context Protocol server](https://developer.atlassian.com/cloud/rovo-mcp/changelog/), letting a person's own agent read and act across Jira, Confluence, Bitbucket, and the rest of the suite through that protocol, the standard many vendors are adopting for connecting agents to apps. This version widened coverage to more of Atlassian's products, and the company said the earlier version will switch over to it automatically on March 1, 2027. Alongside the server, Atlassian [opened an early-access program for packaging reusable agent instructions](https://developer.atlassian.com/platform/forge/changelog/) as an installable unit in its app platform, so a custom agent can be extended with prepared instructions and reference material rather than reconfigured by hand; it is limited to development environments for now. The same platform update eased Atlassian's forced migration off its older app framework, letting a maker fold several legacy content keys into a single new component, and began showing end-of-support notices to administrators of apps whose makers have committed to migrating. **Why it matters:** a customer can now point their own agent at Jira and Confluence through MCP, which reopens the question of what a Marketplace app adds that the raw protocol does not. Atlassian is pushing developers toward the answer: the dev-only instruction-packaging program is where a developer's value moves next, and the end-of-support notices make clear that developers who want to stay have to migrate off the legacy framework first. ## Agent apps: CopilotKit brings MCP tools into AG-UI apps **CopilotKit shipped the first adapter that connects an outside MCP server's tools and interface into apps built on its AG-UI protocol.** AG-UI is CopilotKit's open protocol for wiring an app's front end to the AI agent that drives it; the adapter's [first release](https://github.com/ag-ui-protocol/ag-ui/releases/tag/release%2F2026-09-10) honors which tools are meant to be visible and forwards credentials safely. **Why it matters:** the tools and interface an MCP server already exposes can appear inside an agent-driven app a person uses, rather than each app wiring in those tools by hand. ## Agentic web: WebMCP adds provenance for a user's agent **WebMCP, the draft browser standard for letting a web page offer tools to a user's own agent, gained a way to record where each tool came from.** The editors [merged that change](https://github.com/webmachinelearning/webmcp/pull/281), a trust signal for the browser, and [relaxed how tool inputs are typed](https://github.com/webmachinelearning/webmcp/pull/251) at the request of Chromium's implementers, with work on describing tool outputs and marking developer-only tools still under review. **Why it matters:** these early rules put the browser, not the page, in charge of which tools an agent may see and trust, an early step toward a person pointing their own agent at a site instead of relying on a built-in integration. ## Standards: WebExtensions takes up an official home for extension types **The cross-browser WebExtensions group took up a proposal to give extension developers one official set of type definitions.** Those definitions, which a developer's code editor uses to check that an extension calls each browser's APIs correctly, are fragmented today: Google generates the Chrome ones from Chromium's own source, while the Firefox and cross-browser sets are kept up by volunteers on a community registry, and no single canonical set spans the browsers. At its [September 10 meeting](https://github.com/w3c/webextensions/pull/1082) the group discussed hosting an official set under its own umbrella but reached no decision, and along the way settled a few small interface details across all four major engines. The heavier thread is the chartered Working Group's [September 17 meeting](https://github.com/w3c/webextensions/issues/1078) to build out the structure of the specification itself. **Why it matters:** an official set owned by the group that evolves the standard would give developers one canonical cross-browser reference, instead of stitching together separately maintained type sets that each track the browsers from the outside. ## Infrastructure: sandbox engines tighten how they meter and fence untrusted code **Several of the layers products use to run a customer's or an agent's code in isolation shipped hardening and runtime work, none of it a new end-user capability.** Firecracker, the AWS-built microVM engine behind many hosted sandboxes, [released a version with faster snapshots and support for newer guest kernels](https://github.com/firecracker-microvm/firecracker/releases/tag/v1.17.0); Apple's Containerization framework [hardened how it resolves file paths inside an on-device Linux container](https://github.com/apple/containerization/releases/tag/0.45.0); and Wasmtime, the Bytecode Alliance's widely embedded WebAssembly runtime, [issued a release candidate that fixes how it meters the cost of running untrusted code](https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.0-rc.1), the mechanism a host relies on to keep one guest from running away with resources. Separately, the hosted-sandbox provider E2B [added team workspaces and outbound-network controls](https://docs.e2b.dev/changelog) for organizations running customer or agent code. **Why it matters:** customer plugins and agent code execution depend on these components. A flaw in how they meter resources or fence off the file system becomes a flaw in every product built on them. ## Platforms: Apple sets September 14 for a wider set of in-app actions Siri can drive **Apple set a September 14 release date for its next iPhone and Mac systems,** which turn on an expanded version of the framework that lets apps offer actions for Siri, Shortcuts, and system search to invoke and chain together. The expansion, previewed at the company's [June developer conference](https://developer.apple.com/videos/play/wwdc2026/302/), adds ways to pass structured data between apps, to run longer tasks with progress and cancellation, to continue an assistant conversation across devices, and to build a Shortcuts automation from a plain-language description that Apple's models assemble; a companion framework lets a user swap in an outside model to power Siri. The date was [confirmed at Apple's September 9 hardware keynote](https://9to5mac.com/2026/09/09/apple-confirms-ios-27-release-date-september-14/), which added no new software news beyond restating that Siri can take actions in third-party apps. Invocation stays mediated by Apple's own assistant; there is no open interface for an outside agent to call an app's actions directly. **Why it matters:** Apple is widening how apps can be composed and automated on its platforms while keeping itself the gatekeeper of what may trigger those actions. ## Also worth knowing - **Geiger, a local inventory tool, [catalogs the AI agents, connector servers, and plugins installed on a machine](https://github.com/Atomburstofficial/geiger)** and what each is allowed to touch. ## On the radar - **September 14:** Apple's next iPhone and Mac systems are scheduled to ship, turning on the wider set of in-app actions Siri can drive. - **September 17:** the chartered W3C WebExtensions Working Group meets to build out the structure of the specification. - **September 24 and October 8:** the W3C WebExtensions Community Group holds its next public calls. - **October 26–30:** the W3C's annual TPAC gathering in Dublin, where the WebExtensions groups have opened sign-ups. - **March 1, 2027:** Atlassian's earlier Rovo agent server version switches over to the new one automatically. --- *This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.* More on - [`#extensibility`](https://toddschiller.com/tag/extensibility.html) (17) - [`#plugins`](https://toddschiller.com/tag/plugins.html) (17) - [`#sandboxes`](https://toddschiller.com/tag/sandboxes.html) (17) - [`#web standards`](https://toddschiller.com/tag/web-standards.html) (17) - [`#MCP`](https://toddschiller.com/tag/mcp.html) (14) - [`#WebMCP`](https://toddschiller.com/tag/webmcp.html) (15) - [`#WebExtensions`](https://toddschiller.com/tag/webextensions.html) (7) - [`#Atlassian`](https://toddschiller.com/tag/atlassian.html) (5) - [`#Apple`](https://toddschiller.com/tag/apple.html) (4)