v0.7.1 — Agent Plugins Spec 1.0.0 support

What's new

mcptoon now installs, validates and manages the new cross-vendor Agent Plugins standard (https://agent-plugins.org — backed by Amazon, Cursor, Microsoft, OpenAI and Vercel). The spec deliberately leaves installation, distribution and cross-agent sync undefined — mcptoon fills exactly that gap:

Install once — every agent can use it.

mcptoon plugin scan <dir>        # validate a plugin package (read-only)
mcptoon plugin install <dir>     # install into mcptoon + every synced agent
mcptoon plugin list              # what is installed
mcptoon plugin remove <name>     # remove everywhere (data dir is kept)

Highlights

• Strict spec validation — closed manifest schema, single-token commands, HTTPS-only non-loopback URLs, no credentials in headers, path-escape checks. Structural problems are fatal; a broken server entry skips only that entry (spec failure boundaries).
• The pivot: pre-expanded paths — mcptoon is the installer, so ${PLUGIN_ROOT} / ${PLUGIN_DATA} are expanded into absolute paths at merge time and written into every agent's native config. Agents need zero plugin-loader support — including agents that never adopted the standard.
• Namespaced, collision-free — plugin:server keys; removal prunes from mcptoon config AND every agent config it reached.
• Persistent data dir — ~/.mcptoon/plugins-data/<name>/ survives --force upgrades and removal (spec §PLUGIN_DATA).
• stdio cwd end to end + spec-required PLUGIN_ROOT/PLUGIN_DATA env injection at server start.

Quality

• 610 tests passing (+41), zero third-party dependencies, ruff clean
• 19-point acceptance livefire: scan → install → list → verify expanded absolute paths in a real Claude Desktop config → remove → verify everything cleaned

Full changelog: CHANGELOG.md · README (EN + zh-CN) now carries an Agent Plugins badge and section.