Catalogs Govern Agent Work

If You Only Read One Thing

Agent progress is shifting from smarter prompts to governed ability catalogs. Pydantic Ships The Capability Catalog shows the framework version: on-demand capabilities keep tools and instructions out of context until needed. Cursor Turns Skills Into Admin shows the IDE version: skills, MCPs, hooks, and subagents become objects a team can install, scope, and watch.

Pydantic Ships The Capability Catalog

The agent-framework problem has stopped being "can this model call a tool?" The harder question is which tools, instructions, hooks, and settings should even be visible on a given turn.

Pydantic AI v2.0 is now stable after seven betas, and its important primitive is not another wrapper around chat completion. It is "capabilities": composable bundles that can include tools, instructions, hooks, model settings, toolsets, history processors, file search, context factories, and event streams. The practical mechanism is progressive disclosure. In Pydantic's example, a capability marked defer_loading=True collapses to an ID and description until the model asks to load it, at which point the full bundle enters the run. Pydantic also moved event streaming toward Agent.run_stream_events(), changed usage accounting toward provider-native details, and defaulted OpenAI provider names toward the Responses API.

Why it matters: Agent systems have been treating context as a dumping ground. Every extra tool schema, instruction block, and "just in case" rule competes with task evidence for model attention and costs tokens even when it is irrelevant. Capabilities create a narrower runtime contract: the model starts with a catalog, not the whole warehouse. That changes both economics and control. A capability can carry permissions, cleanup behavior, typed dependencies, usage limits, and provider settings as a unit; the application can then reason about an ability as something loaded, not merely something described in prose. The abstraction also turns prompt engineering into packaging: a useful agent ability is no longer a loose paragraph plus a Python function, but an installable object with lifecycle and scope.

The deeper shift is that frameworks are becoming capability managers. LangGraph, Vercel AI SDK, MCP servers, Claude Code skills, and Cursor plugins all approach the same boundary from different angles: tool use is moving from ad hoc prompt context into runtime inventory. Pydantic's version is notable because it says the quiet part clearly. The scarce resource is no longer only output quality; it is the right to occupy context at the moment work happens.

Room for disagreement: Framework primitives are cheap to announce and hard to standardize. Pydantic's proof will not be its v2 release note; it will be whether capabilities make complex agents easier to audit, migrate, and debug after teams have dozens of them in production.

Cursor Turns Skills Into Admin

Cursor's latest release looks like a customization page. It is really an admin surface for agent behavior.

Cursor 3.9 adds a Customize page that brings plugins, skills, MCPs, subagents, rules, commands, and hooks into one place. The scope is the important part: Cursor says these objects can be managed at the user, team, or workspace level. The release also adds a marketplace leaderboard for popular plugins, skills, and MCPs inside a team, supports plugin canvases as reusable setup templates, and lets Team Marketplaces import plugin repositories from GitLab, Bitbucket, or Azure DevOps.

Why it matters: Coding agents are becoming organizational software before most buyers have admitted it. A local .md rule, an MCP server, or a skill file feels like developer convenience when one person is experimenting. In a team setting, the same object becomes a policy surface: who can install it, which repositories it can touch, which credentials it inherits, whether it can call external services, and whether the rest of the team can discover or reuse it. Cursor is pulling that mess into the product UI. That makes the IDE less like a text editor with a model attached and more like a control plane for code-writing automations.

This is also how extension economies start. The first phase is distribution: install this plugin, import this MCP, share this canvas. The second is governance: approve this for the workspace, remove that broken hook, let the data team reuse the Atlassian setup, block the dependency that leaks secrets. Cursor is putting the distribution and governance surfaces next to each other, which is exactly where agent tooling has to go if it is going to survive outside power-user machines.

Room for disagreement: A team marketplace is not an audit system by itself. The missing evidence is whether Cursor exposes enough review history, permission metadata, and failure telemetry for these extensions to be managed like production dependencies rather than UI preferences.

The Contrarian Take

Everyone says: agent tooling is fragmenting into too many skills, MCP servers, plugins, hooks, and framework-specific abstractions.

Here's why that's wrong (or at least incomplete): the names are fragmented, but the shape is converging. Pydantic calls the unit a capability. Cursor is making plugins, skills, MCPs, subagents, rules, commands, and hooks manageable objects. Claude Code is tightening sandbox and model-selection policy. The common structure is a catalog of abilities with scope, loading rules, and authority boundaries. That is a more durable standard than any one file format because it maps to the real operational constraint: context and permissions have to be allocated before a model acts.

Under the Radar

Claude Code made credential access a sandbox setting - Claude Code 2.1.187 added sandbox.credentials to block sandboxed commands from reading credential files and secret environment variables, and extended organization-configured model restrictions across the model picker, --model, /model, and ANTHROPIC_MODEL. That is a small release-note line with a large implication: agent sandboxes are moving from "can it run commands?" to "which ambient authority survives inside the command environment?"
Cline is putting skills into the CLI path - The latest Cline releases are mostly maintenance, but the recent CLI stream added cline skill alongside plugin and MCP management. The pattern rhymes with Cursor and Pydantic: skills are becoming installed runtime objects, not just snippets users paste into a prompt.

Quick Takes

Vercel keeps absorbing provider churn - The latest Vercel AI SDK releases added xAI lineup support for grok-4.3, grok-build-0.1, and grok-imagine-image-quality, plus none and medium reasoning-effort values. That looks minor until a multi-provider app breaks because a model name or reasoning knob changed. The adapter layer is becoming the shock absorber for model distribution. (Source)
Speculative decoding is becoming a model family, not a trick - Modal's speculation post says its new DFlash draft models for Qwen variants add another 5-20% speedup across workloads on top of the existing baseline. The important bit is not one percentage range. It is that draft models are becoming trainable, model-specific artifacts that compound with workload data. (Source)
Codex is being framed as persistent workspace - OpenAI's Codex-maxxing guide pushes Codex toward long-running projects that preserve context, manage complex workflows, and resume across sessions. The technical lesson is that continuity cannot live only in a bigger prompt. It needs workspace state: files, task decomposition, evidence, approvals, and next actions that survive interruption. (Source)

The Thread

The throughline is that agent capability is becoming inventory. Pydantic wants the framework to decide when a capability loads. Cursor wants teams to install and scope skills, plugins, MCPs, hooks, and subagents. Claude Code is tightening the credentials and model-policy boundary around command execution. Vercel and Modal are doing the same lower in the stack, hiding provider churn and draft-model complexity behind runtime interfaces. The model still matters, but the product surface is shifting toward the catalog that says what the model is allowed to know, call, and keep using.

Predictions

New predictions:

I predict: By 2026-09-30, at least two major coding-agent runtimes or frameworks among Cursor, Claude Code, Codex, Pydantic AI, and Vercel AI SDK will expose team- or workspace-level capability catalogs with install, disable, and audit controls rather than treating skills and tools as project files or prompt text. (Confidence: medium; Check by: 2026-09-30)

Generated: 2026-06-24 03:39 EDT