Define portable component identities for multi-plugin loading

[LangSensei]

Problem

Agent Plugins v1 defines how to discover skills and MCP servers within one plugin, but does not define how a client identifies those components when multiple plugins are loaded in the same session or installation scope.

For example, both plugins may validly provide:

• skills/deploy/SKILL.md
• an MCP server named github

The current specification does not define whether clients should allow both, how they should report the components, or how a client should avoid one silently shadowing the other.

This is a portability issue rather than only a UI issue: a plugin author cannot reliably identify a component across conforming clients once another plugin uses the same local component name.

Related: #6 proposes {plugin-name}:{component-name} for component invocation.

Proposed direction

Define a stable, portable component identity for clients that load more than one plugin in a common scope:

<plugin-name>:<component-name>

Suggested component names:

• Skills: the immediate child directory name discovered under skills/
• MCP servers: the member name in mcp.json mcpServers

A client MAY provide an unqualified alias, fuzzy search, natural-language selection, or another native presentation. If an unqualified name is ambiguous, it must not silently select an unrelated component.

This proposal does not require every client to expose slash commands, mandate a particular UI, or change MCP protocol tool names. It only defines the portable identity and conflict boundary for discovered components.

Questions

1. Should the core specification explicitly model a client loading multiple plugins in a common scope, or should this be an incremental conformance feature?
2. Is plugin-name:component-name the right canonical form?
3. Should ambiguous unqualified aliases be rejected, require disambiguation, or remain wholly client-defined?
4. Is using the skill directory name preferable to relying on Agent Skills frontmatter name for this layer?
5. Should MCP tool collisions remain outside this specification, with the client retaining the originating server identity?