Todd Schiller - MCP

This Week in Extensibility: Edge commits to removing Manifest V2, WebMCP adds Edge and Brave, Cloudflare previews a code-sandbox SDK

2026-08-14T00:00:00-04:00

The Chromium browsers moved in two directions at once this week. Microsoft Edge committed to removing Manifest V2, following Chrome, which narrows what extensions can do; Edge and Brave both turned on WebMCP, also following Chrome, which adds a new surface for a user's agent to act on a page. In the infrastructure layer, Cloudflare previewed a redesigned SDK for running customer and agent code in isolated sandboxes.

Browser extensions: Edge commits to removing Manifest V2

Microsoft Edge committed to removing Manifest V2, following Chrome onto Manifest V3. The August 7 announcement says the consumer transition away from MV2 begins in August 2026, with a goal to complete it by the end of 2026, and enterprise deprecation following in early 2027. The changes start in the Canary, Dev, and Beta channels and broaden to Stable over the following months, with MV2 extensions turned off by default and users directed to MV3 versions where available. Microsoft says 95% of the top MV2 extensions on the Edge Add-ons site have already moved to MV3, and that of the MV2 extensions with meaningful usage, only three lack a publicly available MV3 version. MV3 removes the request-blocking capability that content-blocking and privacy extensions rely on to stop network requests before they load.

Why it matters: a second major Chromium browser removing MV2 narrows what content-blocking and privacy extensions can do for end users across most of the desktop browser market, leaving Firefox as the remaining major engine that still supports request blocking. The timeline is announced and the rollout is phased, so this is a scheduled removal rather than a completed one.

Standards: WebMCP gains a second and third browser

WebMCP turned on an origin trial in Microsoft Edge and gained experimental support in Brave, extending a Chrome-only experiment to two more Chromium browsers. A cross-browser implementation-status document merged August 12 records an origin trial live in Edge 150, built on Chrome's implementation, alongside the existing Chrome 149 origin trial, plus experimental support wired into Brave's Leo AI chat. WebMCP lets a website expose in-page tools that a user's own agent can call rather than the agent scraping the DOM. It remains a Web Machine Learning Community Group draft, and all three implementations are experimental: an origin trial is a time-boxed, single-vendor test, not stable shipping. Neither Gecko nor WebKit has implemented it; Mozilla's position is under review and Apple's WebKit team has filed concerns.

Why it matters: the API that lets a page hand tools to a user's agent now has three Chromium browsers testing it, which concentrates early momentum on one engine family while the other two engines stay out. The support is experimental across the board, so this is broadening adoption of a draft, not cross-vendor agreement or a stable capability.

Infrastructure: Cloudflare previews a redesigned code-sandbox SDK

Cloudflare shipped a 1.0 preview of its Sandbox SDK, the layer a product uses to run untrusted and agent-driven code in isolated, Container-backed sandboxes. The August 7 preview replaces an older, more complicated design with a simpler, unified way to start a task and stream back its output, and it makes the built-in code interpreter an optional add-on a product includes only when it needs one. Cloudflare says it will ship the finished Sandbox SDK 1.0 once pending Cloudflare Containers features land, so this is a preview rather than a stable release.

Why it matters: this is the isolation layer a product uses to run its customers' or a user's agent's code, so a simpler design lowers the cost of letting users run their own code inside an app. The preview label and the deferred 1.0 mean the design can still change before it is stable.

Also worth knowing

A new MCP proposal drafts per-user identity for a single server connection. The Delegated End-User Context extension, opened August 14 as a draft seeking a sponsor, defines a way to attach each request's end-user identity at three trust levels, anonymous, claimed, and verified, and lets the server set access limits that a client can tighten but not loosen. It targets products that expose MCP to their own end customers.

WASI 0.3.1 broadened what portable WebAssembly plugins can do. The August 11 release lets a single plugin use more than one implementation of the same capability under distinct names, for example a remote store alongside a separate in-memory cache, and adds a built-in dictionary type for key-value data. WebAssembly components are a language-neutral way to package plugins that run in a host application's sandbox.

On the radar

August 19: WebExtensions Working Group call.
August 25: WebAssembly Community Group video call.
August 27: WebExtensions Community Group meeting.
August 31: Chrome Web Store removes remaining Manifest V2 extension listings.
End of 2026: Microsoft Edge targets completing the consumer Manifest V2 transition.
Early 2027: Microsoft Edge enterprise Manifest V2 deprecation.

This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.

This Week in Extensibility: six vendors standardize agent-plugin bundles, Mozilla stays neutral on WebMCP, Atlassian opens Rovo to Forge apps

2026-08-07T00:00:00-04:00

The theme this week was a split between packaging and trust. Six rival agent vendors agreed on how to bundle plugins while deliberately leaving security out of scope, Chrome began enforcing store rules that police what an extension may do, and the browser engines filed divergent positions on the API that would let a page hand tools to a user's agent. The packaging layer is converging faster than the trust layer underneath it.

Packaging: six vendors standardize agent-plugin bundles

Amazon, Cursor's maker Anysphere, GitHub, Microsoft, OpenAI, and Vercel published Agent Plugins 1.0.0, a vendor-neutral format for packaging agent extensions. The specification, announced August 6 in a joint post from Vercel, defines a bundle of a plugin.json manifest, a skills/ folder, and an mcp.json file so one plugin installs across ChatGPT, Codex, Cursor, GitHub Copilot, Kiro, and VS Code rather than being repackaged per client. It is labeled a Working Draft, and it carries no permission model, sandboxing, code signing, or secrets mechanism, with each of those deferred to future work; every client keeps its own trust and marketplace decisions.

Why it matters: the same customization, a set of Skills and MCP tools, becomes portable across the major agent clients instead of tied to one vendor's format, so a user is not re-installing per platform. The vendors standardized the bundle while leaving the permission and signing model to each client, so the portability is real and the safety guarantees are not yet part of the standard.

Standards: Mozilla files a neutral position on WebMCP

Mozilla recorded a neutral position on WebMCP, leaving the three browser engines split. WebMCP lets a website expose in-page tools that a user's own agent can call. Mozilla's August 5 position is neutral, while Apple's WebKit team has filed an oppose position citing privacy, security, venue, and API-design concerns, and Google and Microsoft are authoring the proposal. WebMCP remains a Web Machine Learning Community Group draft shipping only as a Chrome origin trial, so there is no cross-vendor agreement and no stable implementation.

Why it matters: the API that would let any site offer tools to a user's agent now has explicit, divergent positions from every engine, which points to a contested track rather than one converging toward shared support. It does not change that the only running implementation is a single browser's origin trial.

Marketplaces: Chrome Web Store begins enforcing its updated policies

Chrome Web Store policy enforcement began August 1 across its extension ecosystem. Four policies published July 1 took effect: a Limited Use rule narrowing data collection to what is strictly necessary for an extension's single disclosed purpose, a duty to notify users of post-install changes to data handling, a Regulated Goods ban on extensions enabling real-money prediction-market transactions, and a Malicious Products clause that bans extensions built to circumvent an AI service's safety guardrails or usage restrictions. Non-compliant extensions face enforcement after the date.

Why it matters: a marketplace of this reach setting a hard rule against extensions that defeat AI guardrails draws a governance line at the store level, where the platform, not each AI service, decides that circumvention tooling is not distributable.

Platforms: Atlassian opens Rovo to Forge apps and extends its Connect deadline

Atlassian shipped an Early Access Rovo MCP Module that lets Forge apps expose their actions as tools inside Rovo Studio. The August 3 changelog entry lets a Forge app publish its actions as callable tools for makers building custom agents in Rovo, extending the app platform into Atlassian's agent framework rather than shipping a single agent. In the same window Atlassian extended Connect end-of-support to January 31, 2027, moving the deadline out of the year-end crunch, and began direct outreach to vendors still running Connect or hybrid apps so they migrate to Forge.

Why it matters: it gives Marketplace developers a supported path to surface their apps as tools inside Atlassian's agents, while the Connect deadline sets the date by which the whole ecosystem must be on Forge to reach that surface at all.

Also worth knowing

Merge added a governed catalog of MCP connectors to its Agent Handler. A July 31 changelog lets a company embedding Merge browse and enable hundreds of generic MCP connectors alongside Merge-built ones on the same authentication, access-control, and governance layer, and adds an AI Guardrails experience with PII detection and a live rule tester.

Wasmtime patched two sandbox-integrity advisories across four release lines. The Bytecode Alliance shipped v47.0.3 and matching v46, v36, and v24 releases on July 31 to fix two low-severity advisories where engine type indices could be confused and where traps during bulk operations could corrupt VM state. Backporting to the v24 long-term line reflects Wasmtime's use as production plugin-isolation infrastructure.

CopilotKit released a Channels SDK for running AG-UI agents in chat surfaces. The August 4 SDK runs one AG-UI agent across Slack, Teams, and other chat platforms with generative UI, human-in-the-loop approvals, and cross-channel memory. It is a developer library for shipping agents rather than a customization surface handed to end users.

On the radar

August 13–14: MCP Dev Summit in Seoul, co-located with Open Source Summit Korea.
September 1: Atlassian Forge Object Store currentVersion field deprecation takes effect.
September 30: Atlassian sunsets the confluence:fullPage and jira:fullPage modules in favor of a unified global:fullPage.
January 31, 2027: Atlassian Connect end-of-support; Marketplace and custom apps must be on Forge.

This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.

This Week in Extensibility: MCP ships its stateless spec with sandboxed app UIs, WebMCP starts tracking cross-engine support, WebExtensions weighs OAuth for MCP servers

2026-07-31T00:00:00-04:00

The agentic-web plumbing consolidated around MCP this week. MCP shipped its biggest revision as a final spec, reworking the protocol to be stateless and formalizing extensions for server-rendered app UIs and long-running tasks. The standards work around it oriented the same way: WebMCP began tracking cross-engine support, and the WebExtensions group started weighing how an extension would authenticate to an MCP server.

Infrastructure: MCP ships its 2026-07-28 specification

MCP shipped the 2026-07-28 specification, its largest revision since launch. The release, out July 28, makes the protocol stateless, dropping the initialize handshake and session-ID pinning so requests self-describe through HTTP headers that gateways can route on, and formalizes an extensions framework. Two extensions lead it: MCP Apps, where a server ships an interactive HTML UI that the host renders in a sandboxed iframe, with UI-initiated actions flowing through the same consent and audit path as tool calls; and a stateless Tasks extension for long-running work an agent can start and resume from a handle. Authorization moves from Dynamic Client Registration toward client metadata documents, and the release sets a formal twelve-month minimum deprecation window for the features it retires (Roots, Sampling, Logging, and the HTTP+SSE transport). The TypeScript, Python, Go, and C# SDKs are updated; the Rust SDK supports the new spec in beta.

Why it matters: end users of an MCP host can now be shown interactive, server-supplied interfaces inside the same consent boundary as tool calls, rather than plain text, and the Tasks extension lets an agent hand off long-running work and return to it later. Making the core stateless also lets MCP run behind ordinary load balancers, which lowers what it takes to operate.

Standards: WebMCP starts tracking cross-engine support

WebMCP opened an implementation-status document tracking Brave, Chrome, Firefox, and Safari. WebMCP lets a website expose in-page tools for a user's own agent to call. It specified the getTools() discovery API the prior week; this week a July 28 commit normalized how a tool accesses this and the abort signal, and a July 31 pull request added a central file to record where each engine stands. The status document is still an open pull request, and WebMCP remains a Web Machine Learning Community Group draft shipping only as a Chrome origin trial, so the tracker records intent and progress, not shipped cross-vendor support.

Why it matters: a standards effort standing up a cross-engine status tracker is a signal it is being managed as a multi-vendor track rather than a single-vendor experiment. It does not change that the only running implementation is one browser's origin trial.

Governance: WebExtensions weighs how extensions authenticate to MCP servers

The WebExtensions group triaged a proposal to let extensions authenticate to MCP servers without per-developer OAuth setup. At its July 30 call the Community Group discussed an issue, opened July 4 by @MiguelsPizza, to have browsers or extension stores host an OAuth Client ID Metadata Document for each extension, so an authorization server can validate the extension's identity and redirect URIs without the developer pre-registering a client or implementing Dynamic Client Registration. The stated motivation is connecting extensions to MCP servers and other OAuth sign-in flows. The discussion, recorded in the still-open minutes, drew caution from Mozilla and others about the trust model and about further centering extension identity on app-store distribution.

Why it matters: it connects the browser-extension platform to the same authentication problem MCP is working through in its own spec, where the July 28 release also moves away from Dynamic Client Registration toward client metadata documents. This is an early triage, not an agreed work item.

Applications: n8n opens verified community nodes as agent tools

n8n 2.33.0 let verified community nodes act as agent tools and added admin-managed instance credentials. The July 28 release lets a workflow builder wire a vetted third-party community node into an agent as a callable tool, widening the set of extensions an automation can use beyond the built-in nodes, and adds centrally provisioned instance credentials that an admin manages so end-user builders do not each configure their own. The same release handles MCP OAuth2 token expiry and PKCE negotiation and makes MCP connection failures non-blocking for agents.

Why it matters: it expands what an n8n builder can assemble, both the vetted extensions available as agent tools and the connections an admin can standardize, in a widely self-hosted automation platform. The community-node-as-tool path runs through n8n's node-verification program, which ties the new capability to a governance gate.

Also worth knowing

Merge.dev added per-integration control over its embedded connect flow. A July 24 changelog lets a company embedding Merge's Link connector tailor what its end users see per integration, hiding specific authentication or configuration steps and disabling the Selective Sync screen while it keeps running in the background.

Microsoft 365 Copilot Agent Builder added SharePoint lists as knowledge sources. A July 29 release note lets makers building Copilot agents ground them on SharePoint list data and enables adaptive-card refresh for custom-engine agents, incremental additions to the agent-authoring surface.

Svix said the MCP working group is developing webhook support for a future MCP version. A July 30 post frames the stateless 2026-07-28 change as the groundwork and describes webhook delivery, where a client makes a request and receives the response later, as the next step for long-latency MCP operations. This is stated direction, not a dated spec item.

Four provisional URI schemes surfaced for expert review. Requests to register pay:, gcx:, aet:, and glue: reached the IETF uri-review list in late July, ahead of any IANA registration; pay: is aimed at payment deep links.

On the radar

July 28 onward: MCP's twelve-month minimum deprecation window began for Roots, Sampling, Logging, and the HTTP+SSE transport.
August 1: Chrome Web Store policy enforcement begins; the bans on prediction-market and AI-guardrail-circumvention extensions and the narrowed data-collection rules take effect.
August 4–5: W3C WebAssembly Community Group in-person meeting, with phase votes queued for several core proposals, followed by a Research Day on August 6.

This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.

This Week in Extensibility: MCP's spec locks down its auth and skills, WebMCP gets conformance tests, WebAssembly components bind to real-world interfaces

2026-07-10T00:00:00-04:00

The connective layer for agent-driven software kept maturing this week. MCP's next specification entered its final editing pass ahead of a July 28 launch, this time reworking how a user's client authenticates to servers and adding a way to distribute agent skills. WebMCP gained its first cross-vendor conformance suite, Apple introduced a first-party way for agents to drive Safari, and in the runtime layer the WebAssembly Component Model moved to bind components to real-world interfaces.

Protocols: MCP's next spec locks down its auth and skills pieces

MCP's 2026-07-28 specification entered its final editing pass. On July 10 the project pushed a burst of finalization commits as the spec moved toward its scheduled July 28 launch. The leaner stateless core and mid-run Multi Round-Trip Requests were covered in prior weeks; the fresh changes this week are about authentication and distribution. The draft deprecates OAuth Dynamic Client Registration in favor of Client ID Metadata Documents, changing how a user's client identifies itself to the servers it connects to. Alongside it, a draft Skills extension defines a skill:// convention for serving reusable agent skills over MCP, with reference implementations named across Claude Code, goose, codex, gemini-cli, and the GitHub MCP server.

Why it matters: the specification is a release candidate scheduled to launch July 28, not final. What changed this week is at the protocol's edges, not its core. The client-auth model now leans on metadata documents instead of dynamic registration, and the Skills convention standardizes how an agent's skills are packaged and shared. Both are still draft.

Agentic web: a conformance suite, and a first-party browser server

WebMCP published a public conformance test suite. On July 10 the W3C Web Machine Learning Community Group added a web-platform-tests suite for WebMCP, the protocol that lets a website expose in-page tools for a user's agent to call. A shared test suite is the first cross-vendor step toward measuring interoperability. It remains a Community Group draft with no shipping stable browser: the capability is in a Chrome origin trial, an experiment, not a default. Design work continued alongside, including an open proposal for a machine-readable hint that marks an action as easily reversible so a user's agent can skip confirmation on low-consequence steps.

Apple introduced a first-party Safari MCP server. On July 1, WebKit shipped a Safari MCP server in Safari Technology Preview 247 that connects an agent to a live Safari window with access to the DOM, network requests, screenshots, and console output, plus the ability to evaluate JavaScript and click, type, and scroll. It is aimed at web developers debugging their own sites and ships only in the preview build, not stable Safari.

Why it matters: two mechanisms for pointing an agent at the browser advanced in the same week. With WebMCP, a page exposes tools to the agent; Apple's server drives the browser from the outside through safaridriver. Neither is a shipped consumer capability yet. WebMCP is an early draft in a single-vendor origin trial, and the Safari server is a developer-facing preview.

Runtime: the WebAssembly Component Model binds to real-world interfaces

The WebAssembly Component Model added external-id and implements. A change merged July 8 lets a component's imports and exports bind to arbitrary external identifiers, e.g., URLs, ES module specifiers, or named host instances like redis, instead of only the kebab-case names the interface language allows. It was demonstrated with experimental Wasmtime support at the July 9 WASI call.

Why it matters: the Component Model is the layer that produces portable, sandboxed plugins. Letting components declare that they implement a real-world interface, rather than a name invented for the spec, is a step toward wiring Wasm plugins against the host systems they actually target. This is pre-standard, implemented experimentally in the reference runtime.

Also worth knowing

Standard Webhooks hardened its client libraries to reject empty signing secrets on July 7, a small cross-vendor guard against a common misconfiguration in the convention many vendors use to sign webhook payloads.

A request for WebKit's position on handle_links was filed July 5. The manifest member would let an installed web app declare whether links opened from outside it route into the app or a browser tab. No WebKit position is recorded yet.

Merge.dev gave its embedded agent handler generic Salesforce CRUD, letting customer-facing agents read and write any Salesforce object rather than a fixed set, a modest widening of what an embedded agent can do inside a customer's connected app.

The sandbox market (E2B, Modal, Daytona, Cloudflare) was quiet at the capability level, as were the webhook and URL-scheme standards beyond the item above and the malleable-software community.

On the radar

July 12–14: Local-First Conf 2026, Berlin, theme "user empowerment in an age of fluid software."
July 16: Next W3C WebExtensions Community Group meeting.
July 23: Next W3C WebExtensions Working Group meeting.
July 28: Target launch date for the MCP 2026-07-28 specification; the release candidate and beta SDKs are already out.

This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.

This Week in Extensibility: MCP trims to a stateless core, extensions weigh softer permission prompts, ChatGPT adds plugin governance

2026-07-03T00:00:00-04:00

Welcome to This Week in Extensibility, a weekly read on the meta layer of software extensibility: the infrastructure that decides what end users and customers can customize, automate, and modify in the software they already use. Plugin platforms, sandboxes for untrusted code, agentic-web actuation, and the policies that govern plugin ecosystems. Not individual plugins, and not generic AI tooling.

The connective standards for agent-driven software carried the week. MCP put out beta SDKs for a leaner, stateless next specification, and WebMCP moved a step closer to a formal standards venue over a browser vendor's objection, while the extension platform's community group took up a proposal to make permission prompts less disruptive.

Protocols: the agent-to-app standards advance on two fronts

MCP published beta SDKs for its next specification. On June 29, the project released betas across all four reference SDKs (Python, TypeScript, Go, and C#) implementing the 2026-07-28 protocol. The headline change is a stateless core: the spec drops the initialize handshake and protocol-level session management, so any server instance can handle any request and a remote server can scale behind a plain round-robin load balancer without sticky sessions. A second addition, Multi Round-Trip Requests, lets a tool ask the user a question mid-execution and have the client retry with the answer, rather than holding open a long-lived stream. The specification is a release candidate scheduled to launch July 28, not final.

WebMCP's community group resolved to open formal wide review. At its June 25 teleconference, the W3C Web Machine Learning Community Group adopted a resolution to "initiate wide review of WebMCP with the TAG, Privacy WG and Security IG," the procedural step that precedes any transition to a chartered Working Group. That follows last week's open question about whether to formalize the protocol at all. The venue remains contested: WebKit's standards position is still "oppose", and per the minutes Apple has suggested moving away from the current group structure. Design work continued alongside, including a new issue flagging an HTML-injection-to-agent-hijacking escalation path in the declarative tool API.

Why it matters: both protocols for letting agents drive the apps a person uses moved this week, MCP toward a cheaper hosting model and a way to pause for human input mid-run, and WebMCP toward a formal standards venue. Read the status qualifiers: MCP's spec is a release candidate, not shipped, and WebMCP is an early Community Group draft with one browser vendor on record to oppose.

Standards: WebExtensions weighs softer permission prompts

The WebExtensions Community Group took up deferrable_permissions. Per the July 2 minutes (still in an open pull request), Benjamin Bruneau proposed the mechanism as a middle ground between two existing approaches: treat added permissions as optional on update but required on a fresh install, so an extension can request new capabilities without alarming or disabling its existing users. Apple leaned toward the defer approach, Google wanted more async discussion first, and Mozilla raised how Firefox's update deferral would interact with it. The same meeting discussed making userScripts.register overwrite by default and an unresolved split over storage limits.

Why it matters: the permission prompt is the main checkpoint between an extension gaining a capability and the user allowing it, and today it shapes how developers build. To avoid the update prompt that can force users to manually re-enable an extension, developers either hold back features that would need new permissions, or over-request permissions on a fresh install so they never have to ask again. A softer update path removes that pressure, though it also changes how quietly an already-installed extension can expand what it does, so it cuts both ways for user control. This is proposal-stage, with no vendor commitment yet.

Governance: ChatGPT gives workspace admins a plugin control plane

OpenAI added a plugin management surface to ChatGPT Business. Per OpenAI's ChatGPT Business release notes dated June 26, workspace admins can now manage plugins from Workspace settings, with discovery and governance in one place: search and filters by status, installation policy, roles, and category. Admins can set whether a plugin is member-installable or installed workspace-wide by default, and see which apps each plugin uses.

Why it matters: as an AI assistant's plugin catalog grows, the governing question shifts from what a plugin can do to who inside an organization is allowed to install it. This is the admin control plane for that decision, the same shape of policy layer that enterprise app marketplaces have long had.

Also worth knowing

Wasmer shipped experimental interruptible Wasm execution on June 30, a way to interrupt running guest code in an embeddable engine used to run plugins. The same release also removed two backends and dropped x86-64 macOS, so it narrows as well as adds.

Daytona moved its open-source sandbox repo into maintenance in late June, with a notice that core development has moved to a private codebase and the public repository will get no further updates. It is a small market-map shift among the vendors selling isolation for customer and agent-generated code (E2B, Modal, Cloudflare Sandboxes, Fly Machines).

Webhook and event standards (Standard Webhooks, CloudEvents, AsyncAPI) and URL-scheme registries were quiet again, only routine maintenance plus one provisional IANA registration, the PURL pkg: scheme, which identifies software packages rather than actuating software.

On the radar

July 12–14: Local-First Conf 2026, Berlin, theme "user empowerment in an age of fluid software."
July 16: Next W3C WebExtensions Community Group meeting.
July 23: Next W3C WebExtensions Working Group meeting.
July 28: Target launch date for the MCP 2026-07-28 specification; the release candidate and beta SDKs are already out.

This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.