MCP vs Skills
An MCP server and an agent skill solve different problems and aren't competing standards, even though they're routinely compared as if they were. An MCP server is a live process that gives an agent access to external tools and data over a protocol. A skill is a static folder of instructions the agent reads on demand — no server, no connection, no external access of its own.
What’s the actual difference?
The cleanest way to see it: an MCP server gives an agent reach, a skill gives an agent judgment.
| MCP server | Skill | |
|---|---|---|
| What it is | A live client-server process speaking a defined protocol (JSON-RPC) | A folder on disk — SKILL.md plus optional scripts, references, assets |
| What it gives the agent | Access to a tool or data source it doesn’t already have | Instructions for how to use what it already has |
| Runtime | Long-lived process; holds a connection open | Read on demand; nothing running between uses |
| Invocation | Typed, schema-validated tool calls the agent fills in | Natural-language instructions the agent interprets |
| Scales across agents by | One server, many agents connect to it — solves the N×M integration problem | Copying the folder — each agent needs its own copy loaded |
| Own permissions? | Yes — has its own auth, own credentials, own access | No — can only direct whatever tools and permissions the agent already has |
When should you use a skill instead of an MCP server?
Use a skill when the agent already has everything it needs and the gap is knowing how to use it well — a repeatable procedure, a house style, a checklist. Use an MCP server when the agent needs to reach something it can’t otherwise touch — a database, a ticketing system, a live API. Most real agentic workflows need both: an MCP server for the reach, a skill for the judgment about how to use that reach correctly. Every credible technical comparison of the two lands on this same point — they compose, they don’t compete.
The security distinction most comparisons get wrong
The common shorthand is: MCP servers are the bigger risk because they’re infrastructure with their own access, and skills are lower-risk because a skill is “just a text file” a human can review. That’s true as far as it goes, and it’s also not the distinction that actually matters for security review.
The real difference is what a security check can see before something executes — and that has nothing to do with whether a server is involved.
An MCP call fills in a name and a defined set of arguments before it executes: send this message, to this channel. A check can read that and decide in the moment. A skill load goes through a similar call, so it isn’t invisible either — but that call only shows that a file is being opened. What’s written inside the file, and what it directs the agent to do once loaded, goes unread by that same check. The instructions can steer the agent’s behavior from that point on without ever producing a second, inspectable action.
This is why “just a text file” undersells the risk rather than describing it accurately. A malicious skill called Clawsights, documented by Datadog Security Labs, used a skill feature called dynamic context to run a shell command the moment the skill loaded — before the model itself ever reasoned about the file’s contents, and before a human reviewer’s earlier read of that same file would have shown anything wrong, because the payload wasn’t in the file at read time. The server-vs-no-server framing misses this entirely: the exposure isn’t about infrastructure, it’s about the gap between when something is reviewed and when it runs.
Common questions
Is a skill less risky than an MCP server?
Not straightforwardly. A skill can't reach anything the agent doesn't already have access to, which does bound its blast radius. But "lower risk because it's just a text file" isn't accurate — a skill's actual instructions aren't inspectable by an automated check the way an MCP call's arguments are, and a skill can execute code at load time before a human or the model has reasoned about its contents.
Can a skill call an MCP server?
Yes, and this is one of the more common real patterns — a skill's instructions can direct the agent to use an MCP server it already has access to, applying judgment about when and how, while the MCP server itself handles the actual external connection.
Are MCP and skills going to merge into one standard?
Not currently, though the boundary is being actively discussed — a proposal (SEP-2076) to define Agent Skills as a first-class MCP primitive was raised and closed without merging. Worth rechecking this entry if that changes.
