Sharing AI skills, plugins and MCP connectors across a team
How skills, plugins and MCP connectors spread through a company, the admin controls in Claude, ChatGPT, Microsoft 365 and Google, and a playbook for IT.
TL;DR
- Teams now share three kinds of AI building blocks: skills (written instructions an assistant loads when needed), plugins (bundles of skills, commands and connectors) and MCP connectors (links from an assistant to an app or data source).
- These formats are shared across vendors. MCP came from Anthropic in November 2024 and moved to the Linux Foundation's Agentic AI Foundation in December 2025 (Anthropic). Agent Skills became an open standard in December 2025 and is used by ChatGPT, Codex, Gemini CLI, GitHub Copilot and Cursor (agentskills.io).
- Claude, ChatGPT, Microsoft 365 and Google Workspace all have admin controls to approve, pre-install or block these for a team.
- The risk is real. The MCP specification says "tools represent arbitrary code execution" (MCP specification). Anthropic says a plugin "can execute arbitrary code on your machine with your user privileges" (Claude Code docs).
- Our view: IT gets more control by running a short approved list that is easy to install than by blocking. People who can't find an approved option tend to find their own.
Facts were checked on vendor pages on 15 October 2026. Caspian publishes this article and sells a product that helps here. Where we give an opinion, we say so.
What people are sharing
| Building block | What it is | Where it came from |
|---|---|---|
| Skill | A folder with a SKILL.md file of instructions, plus optional scripts, that an assistant loads when a task needs it | Anthropic launched Agent Skills on 16 October 2025 and published the format as an open standard on 18 December 2025 (Anthropic; agentskills.io) |
| Plugin | A bundle of skills, slash commands, agents, MCP servers and hooks, installed in one step | Claude Code plugins launched 9 October 2025 (Anthropic). OpenAI is replacing custom GPTs with plugins shared by ChatGPT and Codex (Virtualization Review) |
| MCP connector | A server that gives an AI assistant tools and data from another app, using the Model Context Protocol | Anthropic introduced MCP on 25 November 2024 (Anthropic). The current spec version is 2026-07-28 (MCP specification) |
| Gem or custom assistant | A saved assistant with its own instructions and files | Google lets Workspace users share Gems the way they share Drive files, on by default (Google Workspace Updates) |
When Anthropic donated MCP, it counted "more than 10,000 active public MCP servers" (Anthropic, December 2025). OpenAI, Google and Microsoft products support it.
OpenAI's custom GPTs are being retired on 11 December 2026, with Enterprise workspaces able to defer to 11 February 2027 (Virtualization Review, medium confidence because we could not load OpenAI's own release notes). If your team shares GPTs today, plan the move.
Why blocking doesn't hold
In 2024, 78% of AI users said they bring their own AI tools to work (Microsoft and LinkedIn, Work Trend Index). In 2025, 46% of leaders said their companies use agents to fully automate workflows or processes (Work Trend Index 2025).
Our view: a good skill spreads by word of mouth. Someone writes a PR review skill, a colleague asks for it, and it gets pasted into a chat. If IT blocks that path without offering another, the sharing moves somewhere IT can't see.
The risks to manage
- Tools run code. Hosts must get user consent before invoking any tool, per the MCP specification (MCP specification).
- Tool poisoning. In April 2025, Invariant Labs showed that instructions hidden in an MCP tool description are "invisible to users but visible to AI models", and used this against Cursor (Invariant Labs).
- Malicious packages. In September 2025, a fake
postmark-mcppackage on npm added a hidden BCC to every email it sent. It was reported as the first malicious MCP server found in the wild (The Hacker News, medium confidence). - Broad scopes. A connector acts with the permissions of the person who signed in. A read-write connector to email or a CRM can do anything that person can.
- Leavers. Connector tokens are tied to a person. They need to be revoked when that person leaves.
OWASP published a Top 10 for Agentic Applications for 2026, which covers these risks in more depth (OWASP).
The controls each platform gives you
| Platform | What an admin can do | Plan | Source |
|---|---|---|---|
| Claude (claude.ai) | Per plugin: Not available, Available to install, Installed by default, or Required. Sync plugins from GitHub or GitLab. Set publishing to Requires review, Open or Off. See 30-day users per plugin. | Team and Enterprise | Claude docs |
| Claude (connectors) | An Owner enables each connector. Members then sign in individually. Owners can set each tool to Always allow, Needs approval or Blocked. | Team and Enterprise | Claude Help Center |
| Claude Code | Managed settings pre-install plugins from a private marketplace, allowlist or block marketplaces, and limit which MCP servers can run | Team and Enterprise, or via MDM | Claude Code docs; Managed MCP |
| ChatGPT | Apps and plugins are off by default on Enterprise and Edu, on by default on Business. Role-based access on Enterprise. Skill permissions and a Skills page with 30-day use. | Business, Enterprise, Edu | OpenAI Help Center; OpenAI Help Center |
| Microsoft 365 | Agent Registry in the admin center: install, block, uninstall or pin an agent for users or groups. Lists the MCP servers each agent uses. | Microsoft 365; Security tab needs Agent 365 or E7 | Microsoft Learn |
| Google Workspace | Turn Gem sharing on or off per domain, OU or group. Allow or block Gemini Enterprise agents. | Workspace with Gemini | Google Workspace Updates; Google Workspace help |
| Slack | MCP servers go through Slack's app approval. "No server enters a workspace without explicit admin sign-off." | Slack workspaces | Slack |
The OpenAI rows are medium confidence: the help pages blocked our reader, so their content comes from search results. Microsoft Agent 365 is sold at $15 per user per month or included in Microsoft 365 E7 (Microsoft).
A sharing playbook
Our view, not a sourced claim. Each step uses the controls above.
- Find what is already in use. Read the OAuth app report in Google Workspace or Entra, and ask each team which skills and connectors they rely on.
- Publish a short approved list. For each item, say what it is for, who uses it, and how to start. A reason gets read. A bare list gets ignored.
- Host your own marketplace. Put approved skills and plugins in one private repository. Claude Code and claude.ai can sync from it. The MCP Registry project expects companies to run private sub-registries for the same purpose (MCP blog).
- Pre-install the few everyone needs. Use "Installed by default" for those. Keep "Required" for security tools.
- Approve connectors by scope. Start read-only. Use per-tool approval for anything that writes, sends or deletes.
- Review publishing. Let anyone propose a skill, and have one person approve it before it reaches the whole company.
- Measure use. Retire what nobody uses after 90 days. Claude and ChatGPT both show 30-day use per skill or plugin.
- Clean up on leave. Add connector tokens and AI app accounts to the leaver checklist.
Where Caspian fits
This section describes our own product. Caspian's free tier lists every app and AI tool in use and includes an employee app store (Caspian pricing). In the app store, people see the apps and AI tools their company approved, with what each is for and the company's rules for using it, and can request access. It does not list or install skills, plugins or MCP connectors: share those through the platform controls above. The same inventory shows IT which AI tools are in use, and who has access.
Caspian is a young company: its ISO 27001 external audit is scheduled and its SOC 2 Type 2 observation window is running. It holds neither certification today.
Sources
| Source | Publisher | Date | Confidence |
|---|---|---|---|
| Introducing the Model Context Protocol | Anthropic | 25 Nov 2024 | High |
| Donating MCP and establishing the Agentic AI Foundation | Anthropic | 9 Dec 2025 | High |
| MCP specification | Model Context Protocol | Version 2026-07-28, checked 15 Oct 2026 | High |
| MCP Registry preview | Model Context Protocol | 8 Sep 2025 | High |
| Agent Skills | Anthropic | 16 Oct 2025, updated 18 Dec 2025 | High |
| Agent Skills standard | agentskills.io | Checked 15 Oct 2026 | High |
| Claude Code plugins | Anthropic | 9 Oct 2025 | High |
| Plugin security | Anthropic | Checked 15 Oct 2026 | High |
| Plugins for organizations | Anthropic | Checked 15 Oct 2026 | High |
| Managed MCP | Anthropic | Checked 15 Oct 2026 | High |
| Plugin admin | Anthropic | Checked 15 Oct 2026 | High |
| Connectors | Anthropic | Checked 15 Oct 2026 | High |
| OpenAI to retire custom GPTs | Virtualization Review | 28 Sep 2026 | Medium |
| Apps and plugins admin controls | OpenAI | Checked 15 Oct 2026 | Medium (read via search) |
| Workspace skills | OpenAI | Checked 15 Oct 2026 | Medium (read via search) |
| Agent details in the admin center | Microsoft Learn | 7 Oct 2026 | High |
| Microsoft Agent 365 | Microsoft | Checked 15 Oct 2026 | High |
| Gem sharing | 18 Sep 2025 | High | |
| Control access to Gemini Enterprise agents | Google Workspace help | Checked 15 Oct 2026 | High |
| Slackbot and MCP security | Slack | 17 Jun 2026 | High |
| MCP security notification: tool poisoning | Invariant Labs | 1 Apr 2025 | High |
| First malicious MCP server found | The Hacker News | Sep 2025 | Medium |
| Top 10 for Agentic Applications 2026 | OWASP | 9 Dec 2025 | High |
| Work Trend Index 2024 | Microsoft and LinkedIn | 8 May 2024 | High |
| Work Trend Index 2025 | Microsoft | 23 Apr 2025 | High (vendor survey) |
| Pricing | Caspian | Checked 15 Oct 2026 | High (our own page) |
