plugin.json

plugin.json defines a plugin's identity and metadata. Portable component locations are fixed by Agent Plugins v1 and are not declared in this file. AgentRig consumes the manifest for catalog metadata, dependency and capability resolution, and provider-native materialization; registry trust remains a property of the reviewed listing or signed registry artifact.

AgentRig plugin manifests are Agent Plugins 1.0.0 conformant. AgentRig-specific fields live under extensions["ai.agentrig"].

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "instructa.core",
  "version": "1.0.0",
  "description": "Lean reusable anti-drift engineering skills for agentic coding.",
  "license": "MIT",
  "extensions": {
    "ai.agentrig": {
      "profile": "core",
      "publicSkills": [
      "project-spec-packager",
      "plan-ledger",
      "architecture-ownership",
      "duplicate-ownership-audit",
      "hard-cut",
      "root-cause-finder",
      "search-context",
      "test-ownership",
      "security-boundary-review",
      "code-review-gate",
      "ship-gate"
    ],
      "supportSkills": ["gitwhat", "git-safe-workflow", "stage-review", "no-mistakes", "package-security-check", "secleak-check", "shellck", "local-health"],
      "optionalCapabilities": ["plan.ledger", "docs.latest", "repo.remote", "ci.status", "repo.security", "secrets.scan", "supplychain.scan", "shell.lint"],
      "aliases": {
      "app-spec-packager": "project-spec-packager",
      "find-duplicate-ownership": "duplicate-ownership-audit",
      "consolidate-test-suites": "test-ownership",
      "stage-review": "ship-gate",
      "no-mistakes": "ship-gate"
      }
    }
  }
}

Field reference

Field	Required	Description
`$schema`	Yes	Must be `https://agent-plugins.org/schemas/1.0.0/plugin.schema.json`.
`name`	Yes	Canonical Agent Plugins machine identifier (`namespace.plugin`).
`version`	No	Semver version (`1.2.3`).
`description`	No	Short summary for registry listings.
`author`	No	Agent Plugins author object, for example `{ "name": "AgentRig" }`.
`license`	No	SPDX identifier.
`keywords`	No	Agent Plugins keywords for filtering.
`homepage`, `repository`	No	Standard Agent Plugins metadata.
`extensions`	No	Reverse-domain extension metadata; AgentRig owns `ai.agentrig`.
`extensions["ai.agentrig"].displayName`	No	AgentRig display label.
`extensions["ai.agentrig"].profile`	No	AgentRig plugin profile: `kit-entry`, `base`, `core`, `project`, `third-party`, or `other`. Omit it when no profile applies.
`extensions["ai.agentrig"].configSchema`	No	AgentRig-specific plugin configuration schema.
`extensions["ai.agentrig"].pluginDependencies`	No	AgentRig plugin dependencies installed before this plugin.
`extensions["ai.agentrig"].publicSkills`	No	Public workflow skills exposed by a core or project plugin.
`extensions["ai.agentrig"].supportSkills`	No	Helper skills shipped by a plugin but not marketed as public workflow surfaces.
`extensions["ai.agentrig"].optionalCapabilities`	No	Array of canonical capability ids this plugin can use when available.
`extensions["ai.agentrig"].requiredCapabilities`	No	Map of canonical capability id to requirement metadata. Used by base and project plugins.
`extensions["ai.agentrig"].aliases`	No	Map from old local skill names to canonical skill names.
`extensions["ai.agentrig"].providesCapabilities`	No	Map of canonical capability id to provider metadata. Used by third-party provider plugins.
`extensions["ai.agentrig"].security`	No	Provider safety metadata such as consent and required env vars.
`extensions["ai.agentrig"].permissions`	No	AgentRig-owned permission metadata consumed by policy tooling.

Every declared publicSkills, supportSkills, or alias target must resolve to an actual valid skills/<name>/SKILL.md component. Invalid AgentRig extension metadata is isolated when loading the portable package and blocks publication.

What does not belong in the extension

ai.agentrig contains stable author-declared metadata only. Catalog category, repository scan coordinates, refs and commits, scan digests, selected paths, verification results, risk assessment, approval state, registry ownership, support level, and advisories are time-dependent AgentRig control-plane data. They are stored on listings, version records, and install bundles outside the published package.

Capability metadata

Capabilities are metadata, not installable artifacts. They stay under extensions["ai.agentrig"] so the manifest remains Agent Plugins 1.0.0 compatible.

Project plugins declare what they need. The following snippets show the extensions fragment; a complete manifest still requires $schema and name:

{
  "extensions": {
    "ai.agentrig": {
      "profile": "project",
      "pluginDependencies": [
      "agentrig/instructa.base@^1.0.0",
      "agentrig/instructa.core@^1.0.0",
      "agentrig/third-party.context7@^1.0.0"
    ],
      "requiredCapabilities": {
      "plan.ledger": {
        "required": true,
        "provider": "third-party.plandb",
        "fallback": "docs/plan-ledger/events.jsonl"
      },
      "docs.latest": {
        "required": true,
        "provider": "third-party.context7"
      },
      "browser.verify": {
        "required": true,
        "provider": "third-party.playwright-mcp"
      }
      },
      "optionalCapabilities": ["repo.remote"]
    }
  }
}

Third-party provider plugins declare what they provide:

{
  "extensions": {
    "ai.agentrig": {
      "displayName": "Plan ledger provider",
      "profile": "third-party",
      "providesCapabilities": {
        "plan.ledger": {
          "type": "ledger",
          "requiredByCore": false,
          "fallback": "docs/plan-ledger/events.jsonl"
        }
      },
      "security": {
        "requiresConsent": true,
        "showsExactCommands": true,
        "requiresEnvVars": [],
        "notes": "Provider manifest only. Does not own PlanDB upstream code."
      }
    }
  }
}

Provider verification cadence, compatibility observations, support level, and risk are attached by AgentRig's control plane after inspection. Authors cannot self-assert those states through plugin.json.

Capability ids follow the AgentRig package schema pattern ^[a-z][a-z0-9]*(\.[a-z][a-z0-9-]*)*$. Implemented capability ids include:

plan.ledger
docs.latest
browser.verify
repo.remote
ci.status
repo.security
deploy.preview
observability.logs
mcp.verify
secrets.scan
supplychain.scan
shell.lint
desktop.runtime
native.debug

Schemas

The CLI generates $schema using https://agent-plugins.org/schemas/1.0.0/plugin.schema.json.

plugin.json

plugin.json

Field reference

What does not belong in the extension

Capability metadata

On this page