Agent Skills vs MCP Servers: Which One When

The one-line split: capability vs method

MCP gives an agent the ability to do something — a live connection to a Kubernetes cluster, a GitHub PR, a Postgres schema, a browser. Skills give an agent the knowledge of how to do something — your incident runbook, your Terraform conventions, your PR review checklist. Sentry's David Cramer has the tightest version: "If skills teach you to cook, MCP provides the instruments that let you do it."

Both shipped as open standards out of the same origin within twelve months. Anthropic created MCP in late 2024 and donated it to the Agentic AI Foundation under the Linux Foundation in December 2025; weeks later it published the Agent Skills spec at agentskills.io (December 18, 2025). OpenAI adopted the SKILL.md format in Codex CLI and ChatGPT, and as of mid-2026 roughly 40 products read it — which is why the two get compared constantly and conflated often. They are not competitors. They answer different questions.

The context math that made this a debate

The original MCP complaint was real: every connected server dumps its full tool catalog into context at session start. A typical five-server enterprise setup — about 58 tools — consumes roughly 55,000 tokens before a single user message (Anthropic's own figures), and the lost-in-the-middle effect means tool-use accuracy degrades noticeably past two or three servers. One developer's 47-tool pipeline measured ~15,000 tokens of definitions alone before any work began.

Skills attacked the same problem from the opposite end with progressive disclosure: at session start the agent reads only each skill's name and description (~100 tokens per skill); when a task matches, it loads the full SKILL.md body (~2,000 tokens median); bundled reference files and scripts load only when a step needs them. Fifty installed skills and you have paid almost nothing until one fires — fifty MCP servers is a context emergency.

A 27x spread between the naive MCP row and metadata-only skills. Fairness note: newer clients defer MCP tool loading until needed and the July 2026 protocol update made the core stateless with cacheable list results — the gap is narrowing. But that is a client optimization layered on the protocol, not a property of it, and the default cost model still favors skills for anything static.

The 3-question decision guide

Two anti-patterns sit on either side. Wrapping static knowledge in an MCP server — a tool that returns your style guide is wasted context; that file should be a skill — and building a bad MCP server in disguise inside a skill: the moment your skill's scripts implement authentication, retries, and paging for a large API, take the existing CLI or server and let the skill describe only the workflow.

One rule most comparisons skip: skills are advice, hooks are enforcement. A skill can say "never run mutations against prod," and the model can ignore it. If a rule must never be broken, that belongs in a hook or a server-side permission — MCP's permission boundary — not in instructions you hope get followed.

Use both at once: the composition pattern

"Use both" is the production default, not a compromise. The standard shape: a skill encodes the procedure and reaches through MCP servers for live data. A canonical incident-response setup reads:

• MCP servers provide read-only access to incidents, logs, and deployments — the capability layer, with auth scoped at the server.
• A skill defines the time window, evidence order, severity rules, missing-data handling, and the report template — the procedure.
• The host retains approval around any follow-up mutation, like creating the postmortem issue.

Remove the MCP servers and the agent knows the procedure but can't see anything. Remove the skill and the agent sees everything but improvises the procedure — improvised incident response by an autonomous agent is how outages become case studies. The composition runs the other direction too, which is the detail most write-ups miss: MCP's own ecosystem now ships skills that build MCP servers. Anthropic's first-party anthropics/skills repo includes an mcp-builder skill (four-phase workflow, SDK references, evaluation guides), and the official claude-plugins-official repo ships an mcp-server-dev plugin whose skills interrogate your use case, pick the deployment shape, and hand off mid-build. Skills became the packaging for protocol-building procedure.

Where VibeFuse lands: both layers on one canvas. Settings → Tools hosts the MCP cards and custom stdio servers exposed to the built-in agents, while SKILL.md skills load the same way they do in Claude Code — and the marketplace sells both asset types, with widgets as the third, demonstrable format (buyers watch a widget run before they pay; a SKILL.md is invisible until loaded).

Security: different threat models, both real

MCP has the more structured story — OAuth-based authorization for remote servers, per-tool permission prompts in clients, and a spec revision explicitly hardening enterprise authorization. Its risk sits in the supply chain (do you trust that third-party server?) and prompt injection arriving through tool results.

Skills are simpler but sharper: a skill can contain scripts the agent executes — code execution on your machine — and because a SKILL.md is just instructions the model follows, a malicious skill is a prompt injection you installed yourself. The ecosystem made this concrete in 2026. Snyk's ToxicSkills audit scanned 3,984 public skills from ClawHub and skills.sh: 13.4% contained critical-level issues and 36% carried detectable prompt injection, with 91% of confirmed malware combining natural-language jailbreaks with shell payloads. Koi Security's ClawHavoc audit found 341 malicious skills in one registry, using typosquatting and credential exfiltration via webhooks; Antiy CERT later attributed 1,184 malicious skills to the campaign. The top skill on ClawHub by downloads is still "Self Improving Agent" at 240K installs — a skill that rewrites its own instructions.

• Read the SKILL.md end to end — including HTML comments and bundled scripts — before installing. Three minutes; it is the whole first layer of defense.
• Scope allowed-tools to what the skill actually needs (Bash(git status *), not Bash(*)). Over-broad grants remove the friction that would otherwise make you look.
• Set disable-model-invocation: true on anything destructive (deploys, cleanup, mass edits) so only a deliberate /command can fire it.
• Pin your sources. First-party orgs and 1K+ install counts beat opaque ZIPs; Air Security documented a researcher-built malicious skill reaching 26,000+ agents through a 36K-star marketplace with stars and scanners clearing it.

The full registry-by-registry safety picture — including which registries scan and which just scrape — is in the agent skills directory comparison. The short version: treat skill installs like package installs, audit before you run, and remember the format's power (arbitrary scripts beside your prompt) is exactly what makes the unreviewed tail dangerous.

Agent Skills vs MCP — FAQ

Explore related AI note taking guides

• AI Note Taker
• AI Meeting Notes
• Transcription Note Taking
• AI Transcription
• Meeting Transcription
• Speech to Text
• Pricing
• All Products
• VocalFuse Product
• VibeFuse Product
• Harness Guide
• Shareable AI Widgets
• Shareable AI Skills