Todd Schiller - plugins

This Week in Extensibility: Edge commits to removing Manifest V2, WebMCP adds Edge and Brave, Cloudflare previews a code-sandbox SDK

2026-08-14T00:00:00-04:00

The Chromium browsers moved in two directions at once this week. Microsoft Edge committed to removing Manifest V2, following Chrome, which narrows what extensions can do; Edge and Brave both turned on WebMCP, also following Chrome, which adds a new surface for a user's agent to act on a page. In the infrastructure layer, Cloudflare previewed a redesigned SDK for running customer and agent code in isolated sandboxes.

Browser extensions: Edge commits to removing Manifest V2

Microsoft Edge committed to removing Manifest V2, following Chrome onto Manifest V3. The August 7 announcement says the consumer transition away from MV2 begins in August 2026, with a goal to complete it by the end of 2026, and enterprise deprecation following in early 2027. The changes start in the Canary, Dev, and Beta channels and broaden to Stable over the following months, with MV2 extensions turned off by default and users directed to MV3 versions where available. Microsoft says 95% of the top MV2 extensions on the Edge Add-ons site have already moved to MV3, and that of the MV2 extensions with meaningful usage, only three lack a publicly available MV3 version. MV3 removes the request-blocking capability that content-blocking and privacy extensions rely on to stop network requests before they load.

Why it matters: a second major Chromium browser removing MV2 narrows what content-blocking and privacy extensions can do for end users across most of the desktop browser market, leaving Firefox as the remaining major engine that still supports request blocking. The timeline is announced and the rollout is phased, so this is a scheduled removal rather than a completed one.

Standards: WebMCP gains a second and third browser

WebMCP turned on an origin trial in Microsoft Edge and gained experimental support in Brave, extending a Chrome-only experiment to two more Chromium browsers. A cross-browser implementation-status document merged August 12 records an origin trial live in Edge 150, built on Chrome's implementation, alongside the existing Chrome 149 origin trial, plus experimental support wired into Brave's Leo AI chat. WebMCP lets a website expose in-page tools that a user's own agent can call rather than the agent scraping the DOM. It remains a Web Machine Learning Community Group draft, and all three implementations are experimental: an origin trial is a time-boxed, single-vendor test, not stable shipping. Neither Gecko nor WebKit has implemented it; Mozilla's position is under review and Apple's WebKit team has filed concerns.

Why it matters: the API that lets a page hand tools to a user's agent now has three Chromium browsers testing it, which concentrates early momentum on one engine family while the other two engines stay out. The support is experimental across the board, so this is broadening adoption of a draft, not cross-vendor agreement or a stable capability.

Infrastructure: Cloudflare previews a redesigned code-sandbox SDK

Cloudflare shipped a 1.0 preview of its Sandbox SDK, the layer a product uses to run untrusted and agent-driven code in isolated, Container-backed sandboxes. The August 7 preview replaces an older, more complicated design with a simpler, unified way to start a task and stream back its output, and it makes the built-in code interpreter an optional add-on a product includes only when it needs one. Cloudflare says it will ship the finished Sandbox SDK 1.0 once pending Cloudflare Containers features land, so this is a preview rather than a stable release.

Why it matters: this is the isolation layer a product uses to run its customers' or a user's agent's code, so a simpler design lowers the cost of letting users run their own code inside an app. The preview label and the deferred 1.0 mean the design can still change before it is stable.

Also worth knowing

A new MCP proposal drafts per-user identity for a single server connection. The Delegated End-User Context extension, opened August 14 as a draft seeking a sponsor, defines a way to attach each request's end-user identity at three trust levels, anonymous, claimed, and verified, and lets the server set access limits that a client can tighten but not loosen. It targets products that expose MCP to their own end customers.

WASI 0.3.1 broadened what portable WebAssembly plugins can do. The August 11 release lets a single plugin use more than one implementation of the same capability under distinct names, for example a remote store alongside a separate in-memory cache, and adds a built-in dictionary type for key-value data. WebAssembly components are a language-neutral way to package plugins that run in a host application's sandbox.

On the radar

August 19: WebExtensions Working Group call.
August 25: WebAssembly Community Group video call.
August 27: WebExtensions Community Group meeting.
August 31: Chrome Web Store removes remaining Manifest V2 extension listings.
End of 2026: Microsoft Edge targets completing the consumer Manifest V2 transition.
Early 2027: Microsoft Edge enterprise Manifest V2 deprecation.

This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.

This Week in Extensibility: six vendors standardize agent-plugin bundles, Mozilla stays neutral on WebMCP, Atlassian opens Rovo to Forge apps

2026-08-07T00:00:00-04:00

The theme this week was a split between packaging and trust. Six rival agent vendors agreed on how to bundle plugins while deliberately leaving security out of scope, Chrome began enforcing store rules that police what an extension may do, and the browser engines filed divergent positions on the API that would let a page hand tools to a user's agent. The packaging layer is converging faster than the trust layer underneath it.

Packaging: six vendors standardize agent-plugin bundles

Amazon, Cursor's maker Anysphere, GitHub, Microsoft, OpenAI, and Vercel published Agent Plugins 1.0.0, a vendor-neutral format for packaging agent extensions. The specification, announced August 6 in a joint post from Vercel, defines a bundle of a plugin.json manifest, a skills/ folder, and an mcp.json file so one plugin installs across ChatGPT, Codex, Cursor, GitHub Copilot, Kiro, and VS Code rather than being repackaged per client. It is labeled a Working Draft, and it carries no permission model, sandboxing, code signing, or secrets mechanism, with each of those deferred to future work; every client keeps its own trust and marketplace decisions.

Why it matters: the same customization, a set of Skills and MCP tools, becomes portable across the major agent clients instead of tied to one vendor's format, so a user is not re-installing per platform. The vendors standardized the bundle while leaving the permission and signing model to each client, so the portability is real and the safety guarantees are not yet part of the standard.

Standards: Mozilla files a neutral position on WebMCP

Mozilla recorded a neutral position on WebMCP, leaving the three browser engines split. WebMCP lets a website expose in-page tools that a user's own agent can call. Mozilla's August 5 position is neutral, while Apple's WebKit team has filed an oppose position citing privacy, security, venue, and API-design concerns, and Google and Microsoft are authoring the proposal. WebMCP remains a Web Machine Learning Community Group draft shipping only as a Chrome origin trial, so there is no cross-vendor agreement and no stable implementation.

Why it matters: the API that would let any site offer tools to a user's agent now has explicit, divergent positions from every engine, which points to a contested track rather than one converging toward shared support. It does not change that the only running implementation is a single browser's origin trial.

Marketplaces: Chrome Web Store begins enforcing its updated policies

Chrome Web Store policy enforcement began August 1 across its extension ecosystem. Four policies published July 1 took effect: a Limited Use rule narrowing data collection to what is strictly necessary for an extension's single disclosed purpose, a duty to notify users of post-install changes to data handling, a Regulated Goods ban on extensions enabling real-money prediction-market transactions, and a Malicious Products clause that bans extensions built to circumvent an AI service's safety guardrails or usage restrictions. Non-compliant extensions face enforcement after the date.

Why it matters: a marketplace of this reach setting a hard rule against extensions that defeat AI guardrails draws a governance line at the store level, where the platform, not each AI service, decides that circumvention tooling is not distributable.

Platforms: Atlassian opens Rovo to Forge apps and extends its Connect deadline

Atlassian shipped an Early Access Rovo MCP Module that lets Forge apps expose their actions as tools inside Rovo Studio. The August 3 changelog entry lets a Forge app publish its actions as callable tools for makers building custom agents in Rovo, extending the app platform into Atlassian's agent framework rather than shipping a single agent. In the same window Atlassian extended Connect end-of-support to January 31, 2027, moving the deadline out of the year-end crunch, and began direct outreach to vendors still running Connect or hybrid apps so they migrate to Forge.

Why it matters: it gives Marketplace developers a supported path to surface their apps as tools inside Atlassian's agents, while the Connect deadline sets the date by which the whole ecosystem must be on Forge to reach that surface at all.

Also worth knowing

Merge added a governed catalog of MCP connectors to its Agent Handler. A July 31 changelog lets a company embedding Merge browse and enable hundreds of generic MCP connectors alongside Merge-built ones on the same authentication, access-control, and governance layer, and adds an AI Guardrails experience with PII detection and a live rule tester.

Wasmtime patched two sandbox-integrity advisories across four release lines. The Bytecode Alliance shipped v47.0.3 and matching v46, v36, and v24 releases on July 31 to fix two low-severity advisories where engine type indices could be confused and where traps during bulk operations could corrupt VM state. Backporting to the v24 long-term line reflects Wasmtime's use as production plugin-isolation infrastructure.

CopilotKit released a Channels SDK for running AG-UI agents in chat surfaces. The August 4 SDK runs one AG-UI agent across Slack, Teams, and other chat platforms with generative UI, human-in-the-loop approvals, and cross-channel memory. It is a developer library for shipping agents rather than a customization surface handed to end users.

On the radar

August 13–14: MCP Dev Summit in Seoul, co-located with Open Source Summit Korea.
September 1: Atlassian Forge Object Store currentVersion field deprecation takes effect.
September 30: Atlassian sunsets the confluence:fullPage and jira:fullPage modules in favor of a unified global:fullPage.
January 31, 2027: Atlassian Connect end-of-support; Marketplace and custom apps must be on Forge.

This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.

This Week in Extensibility: MCP ships its stateless spec with sandboxed app UIs, WebMCP starts tracking cross-engine support, WebExtensions weighs OAuth for MCP servers

2026-07-31T00:00:00-04:00

The agentic-web plumbing consolidated around MCP this week. MCP shipped its biggest revision as a final spec, reworking the protocol to be stateless and formalizing extensions for server-rendered app UIs and long-running tasks. The standards work around it oriented the same way: WebMCP began tracking cross-engine support, and the WebExtensions group started weighing how an extension would authenticate to an MCP server.

Infrastructure: MCP ships its 2026-07-28 specification

MCP shipped the 2026-07-28 specification, its largest revision since launch. The release, out July 28, makes the protocol stateless, dropping the initialize handshake and session-ID pinning so requests self-describe through HTTP headers that gateways can route on, and formalizes an extensions framework. Two extensions lead it: MCP Apps, where a server ships an interactive HTML UI that the host renders in a sandboxed iframe, with UI-initiated actions flowing through the same consent and audit path as tool calls; and a stateless Tasks extension for long-running work an agent can start and resume from a handle. Authorization moves from Dynamic Client Registration toward client metadata documents, and the release sets a formal twelve-month minimum deprecation window for the features it retires (Roots, Sampling, Logging, and the HTTP+SSE transport). The TypeScript, Python, Go, and C# SDKs are updated; the Rust SDK supports the new spec in beta.

Why it matters: end users of an MCP host can now be shown interactive, server-supplied interfaces inside the same consent boundary as tool calls, rather than plain text, and the Tasks extension lets an agent hand off long-running work and return to it later. Making the core stateless also lets MCP run behind ordinary load balancers, which lowers what it takes to operate.

Standards: WebMCP starts tracking cross-engine support

WebMCP opened an implementation-status document tracking Brave, Chrome, Firefox, and Safari. WebMCP lets a website expose in-page tools for a user's own agent to call. It specified the getTools() discovery API the prior week; this week a July 28 commit normalized how a tool accesses this and the abort signal, and a July 31 pull request added a central file to record where each engine stands. The status document is still an open pull request, and WebMCP remains a Web Machine Learning Community Group draft shipping only as a Chrome origin trial, so the tracker records intent and progress, not shipped cross-vendor support.

Why it matters: a standards effort standing up a cross-engine status tracker is a signal it is being managed as a multi-vendor track rather than a single-vendor experiment. It does not change that the only running implementation is one browser's origin trial.

Governance: WebExtensions weighs how extensions authenticate to MCP servers

The WebExtensions group triaged a proposal to let extensions authenticate to MCP servers without per-developer OAuth setup. At its July 30 call the Community Group discussed an issue, opened July 4 by @MiguelsPizza, to have browsers or extension stores host an OAuth Client ID Metadata Document for each extension, so an authorization server can validate the extension's identity and redirect URIs without the developer pre-registering a client or implementing Dynamic Client Registration. The stated motivation is connecting extensions to MCP servers and other OAuth sign-in flows. The discussion, recorded in the still-open minutes, drew caution from Mozilla and others about the trust model and about further centering extension identity on app-store distribution.

Why it matters: it connects the browser-extension platform to the same authentication problem MCP is working through in its own spec, where the July 28 release also moves away from Dynamic Client Registration toward client metadata documents. This is an early triage, not an agreed work item.

Applications: n8n opens verified community nodes as agent tools

n8n 2.33.0 let verified community nodes act as agent tools and added admin-managed instance credentials. The July 28 release lets a workflow builder wire a vetted third-party community node into an agent as a callable tool, widening the set of extensions an automation can use beyond the built-in nodes, and adds centrally provisioned instance credentials that an admin manages so end-user builders do not each configure their own. The same release handles MCP OAuth2 token expiry and PKCE negotiation and makes MCP connection failures non-blocking for agents.

Why it matters: it expands what an n8n builder can assemble, both the vetted extensions available as agent tools and the connections an admin can standardize, in a widely self-hosted automation platform. The community-node-as-tool path runs through n8n's node-verification program, which ties the new capability to a governance gate.

Also worth knowing

Merge.dev added per-integration control over its embedded connect flow. A July 24 changelog lets a company embedding Merge's Link connector tailor what its end users see per integration, hiding specific authentication or configuration steps and disabling the Selective Sync screen while it keeps running in the background.

Microsoft 365 Copilot Agent Builder added SharePoint lists as knowledge sources. A July 29 release note lets makers building Copilot agents ground them on SharePoint list data and enables adaptive-card refresh for custom-engine agents, incremental additions to the agent-authoring surface.

Svix said the MCP working group is developing webhook support for a future MCP version. A July 30 post frames the stateless 2026-07-28 change as the groundwork and describes webhook delivery, where a client makes a request and receives the response later, as the next step for long-latency MCP operations. This is stated direction, not a dated spec item.

Four provisional URI schemes surfaced for expert review. Requests to register pay:, gcx:, aet:, and glue: reached the IETF uri-review list in late July, ahead of any IANA registration; pay: is aimed at payment deep links.

On the radar

July 28 onward: MCP's twelve-month minimum deprecation window began for Roots, Sampling, Logging, and the HTTP+SSE transport.
August 1: Chrome Web Store policy enforcement begins; the bans on prediction-market and AI-guardrail-circumvention extensions and the narrowed data-collection rules take effect.
August 4–5: W3C WebAssembly Community Group in-person meeting, with phase votes queued for several core proposals, followed by a Research Day on August 6.

This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.

This Week in Extensibility: Wasmtime enables GC and exceptions by default, WebMCP specs in-page agent APIs, the WebExtensions group commits to shipping spec text

2026-07-24T00:00:00-04:00

The week moved extensibility work from proposal to committed output. Wasmtime turned a pair of long-incubating WebAssembly proposals on by default, the WebExtensions group agreed to start writing normative spec text instead of just triaging ideas, and WebMCP specified the two APIs a user's in-page agent needs to find and call a site's tools.

Infrastructure: Wasmtime turns on WebAssembly GC and exceptions by default

Wasmtime 47.0.0 enabled the WebAssembly garbage-collection and exception-handling proposals by default. The release, out July 20, flips both proposals on without a flag and adds bounds-checked unsafe intrinsics that account for Spectre mitigations. Wasmtime is the reference host runtime under the Wasm plugin platforms a product uses to run its customers' code, so GC-by-default widens which guest languages (e.g., Kotlin, Java, Dart, OCaml) compile cleanly to guest components.

Why it matters: it expands the set of languages a customer can use to write plugins for a Wasm host, and the Spectre-aware intrinsics tighten the sandbox boundary that isolation depends on.

Standards: WebMCP specs how a page's tools are discovered and invoked

WebMCP specified getTools() and drafted executeTool(), the discovery and invocation half of in-page agents. WebMCP lets a website expose in-page tools for a user's agent to call. The getTools() API, merged July 21, returns the tools a document and its descendant iframes register, with a fromOrigins filter and a "tools" permissions-policy gate, and is aimed at agents written in JavaScript that run inside the page. A companion executeTool() draft, opened the same day, adds the call that runs a discovered tool with an abort signal and same-origin checks.

Why it matters: together these let a user's own agent find and drive a web app's real functions instead of scraping the DOM. WebMCP is a Web Machine Learning Community Group draft shipping only as a Chrome origin trial (Chrome 149 through 156), so this is a single-vendor implementation of an unratified spec, not a stable or cross-vendor capability.

Governance: WebExtensions commits to writing normative spec text

The W3C WebExtensions group drafted a division of labor and agreed to ship spec text in small iterations. A first-draft governance document, opened July 23, codifies the split: exploratory and browser-specific work stays in the Community Group, while normative, public-facing spec commitments move to the chartered Working Group, and only after two or more browser vendors commit to implement. The same-day Working Group minutes record a decision to shorten approval windows to about a week and land accurate-but-incomplete spec text incrementally, starting with the Alarms API.

Why it matters: the cross-browser extension platform is shifting from incubation to normative output. The two-vendor gate keeps it consensus-driven, and the incremental-text decision is a bet that publishing partial spec beats waiting for comprehensive review.

Applications: HubSpot opens customer-built agents in public beta

HubSpot launched Agent Hub and Agent Builder in public beta. The July 23 release gives all Professional and Enterprise customers a console to build and manage AI agents. Agent Builder assembles custom agents on a single canvas in natural language via Breeze Assistant, running on existing CRM context (deal history, contact records, call transcripts) with triggers from schedules, webhooks, or third-party integrations, per the beta announcement.

Why it matters: this is a customer-facing build-your-own-agent surface inside a widely used CRM, not a single prebuilt agent. It moves agent authoring to the end customer, though it is a public beta and no public agent marketplace is named yet.

Also worth knowing

A W3C Web App Manifest change would let users inspect and modify shortcut URLs. The merged recommendation, from July 23, asks user agents to let a user see and edit an installed app's shortcut URL, motivated by shortcut URLs embedding tracking identifiers that survive clearing site data. It expands end-user control over what an installed app's deep links carry.

Kata Containers cut a 4.0.0 release. Kata 4.0.0, out July 20, is a major bump to the VM-isolated container runtime used for untrusted and customer workloads, but its release notes are boilerplate with no feature list, so what the new version changes is unconfirmed at the source.

Atlassian Forge began rolling out end-of-support messaging for Connect apps. The Forge changelog shows a July 24 production rollout of staggered end-of-support notices on the Connected Apps page, part of the ongoing Connect-to-Forge migration.

Two provisional URI schemes entered expert review. A request to register nostr:, filed July 23, would formalize the existing NIP-21 scheme so any client or OS can register as a handler for decentralized-social deep links; a ust: request was filed July 21. Both are early and under review, ahead of any IANA registration.

Vendo pitched embeddable, sandboxed feature-building for a product's own users. In a Show HN on July 15, the YC-backed Vendo positioned itself as a layer a product embeds so its users can build their own micro-apps and features on top of it, generating custom UIs, customizing components, wiring automations, and connecting external tools. User-written code runs in secure sandboxes inside the host's brand, guardrails, and API, and the open-source project integrates with agent frameworks, currently the Vercel AI SDK.

On the radar

July 28: Target date for the MCP 2026-07-28 specification release candidate (stateless core, MCP Apps for server-rendered UIs, and a Tasks extension).
July 30: Next W3C WebExtensions Community Group call; the Alarms API is the first target for detailed spec text.

This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.

This Week in Extensibility: the Chrome Web Store bans two extension categories, Mozilla proposes a permission model for AI agents, Cloudflare runs customer code before signup

2026-07-17T00:00:00-04:00

The week was about boundaries, not new capabilities. The Chrome Web Store banned two categories of extension outright and tightened what the rest may collect, Mozilla floated a permission model to rein in AI agents, and the one capability that actually shipped, Cloudflare running a customer's code before signup, is itself a piece of tenant isolation.

Governance: the Chrome Web Store narrows data collection and bans two extension categories

Google published a Chrome Web Store policy update, effective August 1, that bans two categories of extension outright. Out: extensions that facilitate real-money bets on predicted outcomes, and extensions built to bypass the safety guardrails or usage limits of AI services. The updated policies also tighten Limited Use for every listing: an extension may collect only data strictly necessary to its disclosed single purpose, and developers must disclose any change to their data handling after install.

Why it matters: the store is the chokepoint for a large cross-browser extension ecosystem, so its policy text sets what an extension is allowed to be. The data rules move the baseline; the two bans are Google taking a side on specific uses. This is announced policy, not yet enforced: compliance action starts August 1, with no grace period after it.

Standards: a permission model for AI agents, and isolation keys for extension pages

Mozilla opened a proposal for a browser-mediated permission model for AI agents at the WebExtensions Community Group. Filed July 6 by Mozilla's c-nar, the issue argues agent access today is all-or-nothing and declarative rather than enforced, and sketches WebExtensions-style request/grant/revoke/audit primitives so a user could scope an agent's reach and revoke it mid-action. The open question, posed in the issue itself: does an agent permission lifecycle belong in WebExtensions or on the wider web platform? It awaits triage from Chrome, Firefox, and Safari. A separate July 4 proposal would add cross-origin isolation manifest keys to extension pages, unlocking SharedArrayBuffer and multithreaded WebAssembly for uses like on-device inference; Chrome already ships it, Safari and Firefox are supportive, and Firefox is blocked on process-model work.

Why it matters: both move the boundary of what an extension or agent may touch, and both are early. Mozilla's names a real gap, enforced and revocable agent permissions, but it is a scoping question, not an agreed work item. The isolation keys have all three engines supportive yet no spec text.

Agentic web: WebMCP debates batched and persistent tools

WebMCP debated two questions about how a page's tools run. WebMCP lets a website expose in-page tools for a user's agent to call; it is in a Chrome origin trial, not a shipping default. A July 14 proposal for a code mode execute_tools batch primitive would let an agent run several registered tools in one call, cutting roundtrips and token use. A July 9 thread proposes worker-backed tools that survive a page navigation and run without a visible tab.

Why it matters: batching and persistence point the same way, agents doing more per page and across navigations. Both are Community Group issues layered on a single-vendor origin trial, so this is direction, not capability.

Infrastructure: Cloudflare runs customer code before signup

Cloudflare Workers for Platforms added a Temporary Accounts API. The new API, shipped July 14, lets a platform provision a preview account and deploy a live Worker before the end user signs in, then hand them a claim URL to make it permanent. Workers for Platforms is the multi-tenant layer a product uses to run its own customers' code in isolation; Cloudflare aims this at coding and agent platforms that generate a working app first and ask for the signup second.

Why it matters: the one thing that actually shipped this week, and it removes a step: a customer's generated or customized code can run in an isolated sandbox before they have an account. A small change to the onboarding edge of the isolation layer that customization products build on.

Also worth knowing

The WebAssembly Community Group put multibyte array access to a phase-2 vote at its July 14 call, a proposal for efficient multi-byte loads and stores over byte arrays. Minutes are not yet posted, so the outcome is unconfirmed.

Local-First Conf 2026 ran in Berlin July 12–14, closing with an Ink & Switch Lab Day on the lab's malleable-software projects. It is the venue where new end-user-programming primitives tend to surface first, so watch for writeups.

GitHub is locking down public stargazer and watcher data. A June 30 changelog restricts the list-stargazers and list-watchers endpoints to admins and collaborators and deprecates "repos watched by a user," narrowing what third-party tools built on public engagement data can read.

Shopify moved partner earnings to a GMV-share model. A July 7 partner post swapped subscription-only revenue share for 20% of subscription fees plus 0.1% of eligible online GMV over four years, effective for deals signed on or after August 10, tying app-partner earnings to merchant sales.

On the radar

July 20: Deno Subhosting v1 API shuts down; platforms running end-user Deno code must be on v2.
July 22: Next W3C WebAssembly Working Group meeting.
July 28: Target launch for the MCP 2026-07-28 specification; Chrome 151 reaches stable and is scheduled to remove the last flag for re-enabling Manifest V2 extensions.
August 1: Chrome Web Store policy enforcement begins.
August 10: Shopify's GMV-share partner earnings take effect.
August 31: Remaining Manifest V2 extensions scheduled for removal from the Chrome Web Store.

This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.

This Week in Extensibility: MCP's spec locks down its auth and skills, WebMCP gets conformance tests, WebAssembly components bind to real-world interfaces

2026-07-10T00:00:00-04:00

The connective layer for agent-driven software kept maturing this week. MCP's next specification entered its final editing pass ahead of a July 28 launch, this time reworking how a user's client authenticates to servers and adding a way to distribute agent skills. WebMCP gained its first cross-vendor conformance suite, Apple introduced a first-party way for agents to drive Safari, and in the runtime layer the WebAssembly Component Model moved to bind components to real-world interfaces.

Protocols: MCP's next spec locks down its auth and skills pieces

MCP's 2026-07-28 specification entered its final editing pass. On July 10 the project pushed a burst of finalization commits as the spec moved toward its scheduled July 28 launch. The leaner stateless core and mid-run Multi Round-Trip Requests were covered in prior weeks; the fresh changes this week are about authentication and distribution. The draft deprecates OAuth Dynamic Client Registration in favor of Client ID Metadata Documents, changing how a user's client identifies itself to the servers it connects to. Alongside it, a draft Skills extension defines a skill:// convention for serving reusable agent skills over MCP, with reference implementations named across Claude Code, goose, codex, gemini-cli, and the GitHub MCP server.

Why it matters: the specification is a release candidate scheduled to launch July 28, not final. What changed this week is at the protocol's edges, not its core. The client-auth model now leans on metadata documents instead of dynamic registration, and the Skills convention standardizes how an agent's skills are packaged and shared. Both are still draft.

Agentic web: a conformance suite, and a first-party browser server

WebMCP published a public conformance test suite. On July 10 the W3C Web Machine Learning Community Group added a web-platform-tests suite for WebMCP, the protocol that lets a website expose in-page tools for a user's agent to call. A shared test suite is the first cross-vendor step toward measuring interoperability. It remains a Community Group draft with no shipping stable browser: the capability is in a Chrome origin trial, an experiment, not a default. Design work continued alongside, including an open proposal for a machine-readable hint that marks an action as easily reversible so a user's agent can skip confirmation on low-consequence steps.

Apple introduced a first-party Safari MCP server. On July 1, WebKit shipped a Safari MCP server in Safari Technology Preview 247 that connects an agent to a live Safari window with access to the DOM, network requests, screenshots, and console output, plus the ability to evaluate JavaScript and click, type, and scroll. It is aimed at web developers debugging their own sites and ships only in the preview build, not stable Safari.

Why it matters: two mechanisms for pointing an agent at the browser advanced in the same week. With WebMCP, a page exposes tools to the agent; Apple's server drives the browser from the outside through safaridriver. Neither is a shipped consumer capability yet. WebMCP is an early draft in a single-vendor origin trial, and the Safari server is a developer-facing preview.

Runtime: the WebAssembly Component Model binds to real-world interfaces

The WebAssembly Component Model added external-id and implements. A change merged July 8 lets a component's imports and exports bind to arbitrary external identifiers, e.g., URLs, ES module specifiers, or named host instances like redis, instead of only the kebab-case names the interface language allows. It was demonstrated with experimental Wasmtime support at the July 9 WASI call.

Why it matters: the Component Model is the layer that produces portable, sandboxed plugins. Letting components declare that they implement a real-world interface, rather than a name invented for the spec, is a step toward wiring Wasm plugins against the host systems they actually target. This is pre-standard, implemented experimentally in the reference runtime.

Also worth knowing

Standard Webhooks hardened its client libraries to reject empty signing secrets on July 7, a small cross-vendor guard against a common misconfiguration in the convention many vendors use to sign webhook payloads.

A request for WebKit's position on handle_links was filed July 5. The manifest member would let an installed web app declare whether links opened from outside it route into the app or a browser tab. No WebKit position is recorded yet.

Merge.dev gave its embedded agent handler generic Salesforce CRUD, letting customer-facing agents read and write any Salesforce object rather than a fixed set, a modest widening of what an embedded agent can do inside a customer's connected app.

The sandbox market (E2B, Modal, Daytona, Cloudflare) was quiet at the capability level, as were the webhook and URL-scheme standards beyond the item above and the malleable-software community.

On the radar

July 12–14: Local-First Conf 2026, Berlin, theme "user empowerment in an age of fluid software."
July 16: Next W3C WebExtensions Community Group meeting.
July 23: Next W3C WebExtensions Working Group meeting.
July 28: Target launch date for the MCP 2026-07-28 specification; the release candidate and beta SDKs are already out.

This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.

This Week in Extensibility: MCP trims to a stateless core, extensions weigh softer permission prompts, ChatGPT adds plugin governance

2026-07-03T00:00:00-04:00

Welcome to This Week in Extensibility, a weekly read on the meta layer of software extensibility: the infrastructure that decides what end users and customers can customize, automate, and modify in the software they already use. Plugin platforms, sandboxes for untrusted code, agentic-web actuation, and the policies that govern plugin ecosystems. Not individual plugins, and not generic AI tooling.

The connective standards for agent-driven software carried the week. MCP put out beta SDKs for a leaner, stateless next specification, and WebMCP moved a step closer to a formal standards venue over a browser vendor's objection, while the extension platform's community group took up a proposal to make permission prompts less disruptive.

Protocols: the agent-to-app standards advance on two fronts

MCP published beta SDKs for its next specification. On June 29, the project released betas across all four reference SDKs (Python, TypeScript, Go, and C#) implementing the 2026-07-28 protocol. The headline change is a stateless core: the spec drops the initialize handshake and protocol-level session management, so any server instance can handle any request and a remote server can scale behind a plain round-robin load balancer without sticky sessions. A second addition, Multi Round-Trip Requests, lets a tool ask the user a question mid-execution and have the client retry with the answer, rather than holding open a long-lived stream. The specification is a release candidate scheduled to launch July 28, not final.

WebMCP's community group resolved to open formal wide review. At its June 25 teleconference, the W3C Web Machine Learning Community Group adopted a resolution to "initiate wide review of WebMCP with the TAG, Privacy WG and Security IG," the procedural step that precedes any transition to a chartered Working Group. That follows last week's open question about whether to formalize the protocol at all. The venue remains contested: WebKit's standards position is still "oppose", and per the minutes Apple has suggested moving away from the current group structure. Design work continued alongside, including a new issue flagging an HTML-injection-to-agent-hijacking escalation path in the declarative tool API.

Why it matters: both protocols for letting agents drive the apps a person uses moved this week, MCP toward a cheaper hosting model and a way to pause for human input mid-run, and WebMCP toward a formal standards venue. Read the status qualifiers: MCP's spec is a release candidate, not shipped, and WebMCP is an early Community Group draft with one browser vendor on record to oppose.

Standards: WebExtensions weighs softer permission prompts

The WebExtensions Community Group took up deferrable_permissions. Per the July 2 minutes (still in an open pull request), Benjamin Bruneau proposed the mechanism as a middle ground between two existing approaches: treat added permissions as optional on update but required on a fresh install, so an extension can request new capabilities without alarming or disabling its existing users. Apple leaned toward the defer approach, Google wanted more async discussion first, and Mozilla raised how Firefox's update deferral would interact with it. The same meeting discussed making userScripts.register overwrite by default and an unresolved split over storage limits.

Why it matters: the permission prompt is the main checkpoint between an extension gaining a capability and the user allowing it, and today it shapes how developers build. To avoid the update prompt that can force users to manually re-enable an extension, developers either hold back features that would need new permissions, or over-request permissions on a fresh install so they never have to ask again. A softer update path removes that pressure, though it also changes how quietly an already-installed extension can expand what it does, so it cuts both ways for user control. This is proposal-stage, with no vendor commitment yet.

Governance: ChatGPT gives workspace admins a plugin control plane

OpenAI added a plugin management surface to ChatGPT Business. Per OpenAI's ChatGPT Business release notes dated June 26, workspace admins can now manage plugins from Workspace settings, with discovery and governance in one place: search and filters by status, installation policy, roles, and category. Admins can set whether a plugin is member-installable or installed workspace-wide by default, and see which apps each plugin uses.

Why it matters: as an AI assistant's plugin catalog grows, the governing question shifts from what a plugin can do to who inside an organization is allowed to install it. This is the admin control plane for that decision, the same shape of policy layer that enterprise app marketplaces have long had.

Also worth knowing

Wasmer shipped experimental interruptible Wasm execution on June 30, a way to interrupt running guest code in an embeddable engine used to run plugins. The same release also removed two backends and dropped x86-64 macOS, so it narrows as well as adds.

Daytona moved its open-source sandbox repo into maintenance in late June, with a notice that core development has moved to a private codebase and the public repository will get no further updates. It is a small market-map shift among the vendors selling isolation for customer and agent-generated code (E2B, Modal, Cloudflare Sandboxes, Fly Machines).

Webhook and event standards (Standard Webhooks, CloudEvents, AsyncAPI) and URL-scheme registries were quiet again, only routine maintenance plus one provisional IANA registration, the PURL pkg: scheme, which identifies software packages rather than actuating software.

On the radar

July 12–14: Local-First Conf 2026, Berlin, theme "user empowerment in an age of fluid software."
July 16: Next W3C WebExtensions Community Group meeting.
July 23: Next W3C WebExtensions Working Group meeting.
July 28: Target launch date for the MCP 2026-07-28 specification; the release candidate and beta SDKs are already out.

This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.

This Week in Extensibility: hyperscale sandboxes, extensions get a standards track, and prompt-to-plugin

2026-06-26T00:00:00-04:00

The substrate for running other people's code is becoming a first-class product this week, and the rules around it are starting to get formalized.

Infrastructure: AWS turns per-user code isolation into a managed product

On June 22, AWS shipped Lambda MicroVMs to general availability. The pitch is narrow and on-theme: a managed primitive for giving each end user their own isolated environment to run code the app developer did not write. It is Firecracker-backed (the same isolation under Lambda's reported 15-trillion-plus monthly invocations) and supports snapshot-resume for near-instant warm starts with auto-suspend on idle. Each environment runs up to 8 hours, with 16 vCPU, 32 GB memory, and 32 GB disk on ARM64. At GA, that covers five regions (N. Virginia, Ohio, Oregon, Ireland, Tokyo).

AWS frames the use case explicitly as multi-tenant apps that "hand each end user their own dedicated execution environment in which to safely run code that the application developer did not write," naming AI coding assistants, interactive code environments, user-supplied game-server scripts, and data-analytics platforms.

Why it matters: this is the safe-execution problem that every product hits the moment it lets customers run their own scripts, customizations, or agent-generated code. There is already a competitive lane here (E2B, Modal, Daytona, Cloudflare Sandboxes, Fly Machines). The news is a hyperscaler making per-end-user isolation a managed product rather than something you assemble yourself, and shipping it GA rather than as a preview.

Standards: extensions reach a standards track, the agentic web stays contested

Two threads moved in opposite directions this week.

The W3C WebExtensions Working Group held its first meeting on June 25. This is a newly chartered, standards-track Working Group, not a rename of the long-running WebExtensions Community Group. The Community Group still exists and keeps incubating cross-browser extension work informally; the Working Group sits above it as the body that can publish formal W3C Recommendations. The large cross-browser extension ecosystem spanning Chrome, Firefox, Edge, and Safari now has a path from loose proposal to formal standard.

No API decisions yet: 13 participants from Mozilla, Apple, Google, Microsoft, 1Password, and Capital One set process, made minutes public-by-default, and fixed the division of labor (the Community Group incubates, the Working Group writes normative spec text). Next meeting is July 23, with the chair rotating to Apple's Timothy Hatcher.

Meanwhile, WebMCP, the protocol that lets a user's agent actuate websites on their behalf, had an active week of design work and an open question about whether to formalize it at all. Substantive issues advanced (dynamic tool definitions, persistent tools via workers, per-tool run-location annotations), and Apple's Mike Wyrzykowski opened issue #192 asking whether to transition it to a Working Group. The catch: this remains an early-stage Community Group draft, and the venue is contested. WebKit's standards position is "oppose" (closed June 11 on duplication, venue, security, and consent grounds), and Mozilla's position is still open.

Why it matters: extensions are graduating to a standards track the same week the agentic-web equivalent has one browser vendor on record to "oppose" and another still undecided. The significance for extensions is structural, not technical: a path from Community Group draft to formal W3C standard.

End-user programming: Figma makes plugin authoring a writing task

At Config 2026, Figma announced generative plugins: describe a tool's behavior, controls, and parameters in natural language, and Figma's agent generates a working plugin, with "no local dev environment or plugin API knowledge required." Cited examples are accessibility audits, layout generators, and vector pattern builders.

The qualifiers carry the story. This is rolling out gradually, not yet GA. At launch, generated plugins live inside a single file and can be shared with anyone who has file access. Publishing to the Community and private publishing to your organization are described as arriving "in the coming months."

Why it matters: the barrier to building your own tool is dropping fast for a large non-developer audience, but this is not yet a marketplace capability.

Governance: marketplaces race to make trust machine-verifiable

Two items frame the same tension.

Atlassian launched "Enterprise Certified," a new marketplace trust tier replacing the Cloud Fortified badge. It adds machine-verified signals admins filter on (SOC 2, ISO 27001, penetration testing, bug-bounty participation, partner trust centers) plus verified-field markers on each app's Privacy and Security tab. Rollout begins Q3 2026; Cloud Fortified retires by end of 2026.

And the counter-example: security firm Manifold disclosed 23 code-executing ClawHub plugins published under the official @openclaw/ and @clawhub/ scopes by 15 unaffiliated accounts, violating ClawHub's own "scope must match publish owner" rule. The plugins ran with payment, host-command, and API privileges; no malware was found in the reviewed versions. The point is the gap: the official-namespace trust signal was policy-only, with no technical enforcement behind it. ClawHub has since added a dispute process.

Why it matters: marketplaces are racing to make trust machine-verifiable, and where that trust is only policy-deep, it breaks.

Also worth knowing

Wasmtime patched a WASI sandbox-confinement bypass (GHSA-4ch3-9j33-3pmj, CVSS 6.5). A guest with read-only file access could bypass per-preopen FilePerms by hard-linking or renaming files into write-permitted directories. This is the engine running untrusted customer code on platforms like Shopify Functions and Fastly Compute, so it is worth a patch-status check even at moderate severity. Coordinated same-day fix across four release branches on June 24.

Worth stating plainly: webhook and event standards (Standard Webhooks, CloudEvents, AsyncAPI) and URL-scheme registries were quiet this week. Nothing at the capability level, only routine maintenance.

On the radar

June 30: Atlassian Marketplace V2 API full sunset (/rest/2/); also the deadline for app bug-bounty programs to go public to keep Marketplace badges.
June 30: Shopify Scripts stop executing entirely (migrate to Functions).
July 9: Cloudflare Sandbox SDK drops HTTP and WebSocket transports from new releases; migrate to RPC.
July 12–14: Local-First Conf 2026, Berlin, theme "user empowerment in an age of fluid software."
July 23: Next W3C WebExtensions WG meeting (chair rotates to Apple).
July 28: target ship date for the MCP 2026-07-28 spec. The release candidate is already out; its Extensions framework folds in MCP Apps, which launched as the first official MCP extension back in January.

This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.