Skills, Plugins, and Shell Commands: The Agent Attack Surface MCP Doesn’t Cover

A lot of the agent security conversation has narrowed around the Model Context Protocol, or MCP. The attention makes sense. MCP is an open standard that gives an agent one common way to connect to external tools and services, and that shared interface creates a clearer place to think about permissions, routing, and enforcement.

The problem is that MCP only represents one part of the tool environment agents use in practice.

Enterprise agents are built with many different kinds of tools and knowledge sources. Some use MCP servers, like a GitHub server for managing issues and pull requests. Others call APIs directly, like calling Stripe to issue a refund. Other tools are hard-coded, wired straight into the agent, like a shell or terminal command that lets it run things directly on the machine. Browser extensions or plugins, like a Chrome extension, and direct connections to SaaS applications operate alongside agents, while other tools retrieve context from databases or documents. Still others operate through skills that package several capabilities behind a single interface.

In this guide, you will get a clear picture of the different kinds of tools your agents use, why the broader risk reaches well past MCP, and the three foundational principles for governing the whole toolset.

What you will take away

• A working map of the tool types your agents use, and why each one changes what an agent can see and do
• Why a changing toolset is normal for agents, and what that means for governance built around fixed manifests
• Three foundational principles for governing the whole agentic toolset, not only the traffic that passes through a gateway