MCP vs Skills: When to Use Each, Govern Both

MCP vs skills is a choice about what an AI agent is missing. An MCP server gives it a live connection to another system, such as a database, a ticket tracker or a SaaS API, through tools it can call. A skill gives it a procedure. Anthropic calls them Agent Skills and most people say Claude skills: a folder holding a SKILL.md file, often with scripts, that the agent loads only when a task calls for it. Most teams end up with both.

In March, our CEO Mokhtar Bacha argued that the MCP vs CLI debate was about adapters. Skills vs MCP is the same argument one layer up, except that a skill can ship code.

MCP vs skills: what actually differs

The two formats differ in where they run and whose access they use. An MCP server is a separate process the agent calls over JSON-RPC, and it can hold its own credentials and sign each user in. A skill is a set of files the agent reads into its own context, so it acts with whatever the agent already has: the user’s shell, files and network.

The network row is the one comparisons get wrong most often. Claude skills vs MCP write-ups sometimes describe a skill as static text that can’t make a call on its own, and that’s true on the Claude API, where Anthropic’s Agent Skills docs say skills run in a sandboxed container with no network access. In Claude Code, the same page says skills “have the same network access as any other program on the user’s computer”. A skill’s scripts run through bash, and only their output enters the model’s context, so the code itself can do a lot without the model ever reading it.

What are Claude skills (Agent Skills)?

Claude skills are folders of instructions, scripts and resources that Claude loads when a task needs them. Anthropic launched them as Agent Skills in October 2025¹ for Claude apps, Claude Code and the API. Each skill has a SKILL.md file whose YAML frontmatter holds a name and a description, and the description is what the agent reads to decide whether the skill applies. Loading happens in stages, which Anthropic calls progressive disclosure. At startup the agent sees only each skill’s name and description, about 100 tokens per skill. When a task matches, it reads the body of SKILL.md, which the docs put at under 5k tokens. Reference files come in only when the instructions point to them, so most of a skill never sits in the context window. Scripts don’t have to come in at all: Claude executes them and reads what they print.

In December 2025 Anthropic published the format as an open standard, and on October 22, 2026 it donated Agent Skills to the Agentic AI Foundation, the Linux Foundation fund that already hosts MCP.² The announcement counts more than 70 agent platforms that have integrated the standard, including ChatGPT, Cursor, GitHub Copilot and VS Code, with 1 million skills published and nearly 280 million installed.

Those are Anthropic’s figures; we have no independent count.

Where MCP fits

Anthropic open-sourced the Model Context Protocol in November 2024.³ Hosts such as Claude Code run MCP clients that send JSON-RPC to servers, locally over stdio or remotely over Streamable HTTP, and servers offer tools, resources and prompts. The spec calls tools “model-controlled”: the model decides when to call them. MCP moved to the Agentic AI Foundation in December 2025.⁴ In production the hard part is identity, meaning which person a tool call speaks for, and our MCP gateway page covers how we handle it.

Skills vs MCP: when should you use each?

Most skill vs MCP decisions come down to access. Use a skill when the agent can already reach what it needs and is missing the procedure. Use an MCP server when it needs a system it can’t reach today, or when each call has to carry a user’s identity and land in an audit log. When a job needs a procedure and authenticated calls, use both: the skill describes the workflow, and the MCP server makes the calls.

Anthropic’s engineering post on skills frames the third row the same way.⁵

One pattern we’d avoid is a skill whose script carries an API key so the agent can call a service directly. It works, and it leaves a long-lived credential in a folder that gets copied between laptops and repositories, outside any sign-in. When a workflow needs a credential, put an MCP server or a proxy that injects the credential in front of the service, and let the skill describe the steps.

Skills vs MCP security: two supply chains

In a study accepted to USENIX Security 2026, Liu et al. collected 98,380 skills from two community registries and confirmed 157 as malicious, with 632 vulnerabilities across 13 attack techniques.⁶ The two dominant strategies were credential theft through remote code execution, and adversarial instructions hidden in a skill’s documentation. More than half of the confirmed cases came from one actor impersonating known brands with templated skills.

The registries removed all 157 after disclosure.

Snyk’s ToxicSkills research, published February 5, 2026, scanned 3,984 skills from ClawHub and skills.sh. It found 534 (13.4%) with at least one critical issue, and human review confirmed 76 malicious payloads.⁷ Snyk sells a scanner, so read that as vendor research. Both studies point at the property Anthropic’s docs warn about: a skill runs with the agent’s permissions, and “a malicious Skill can direct Claude to call tools or run code in ways that don’t match the Skill’s stated purpose”. Anthropic’s advice for skills that touch sensitive systems is to “treat like installing software”.

MCP has the same problem from the other side. The spec says tools “represent arbitrary code execution and must be treated with appropriate caution”, and that “MCP itself cannot enforce these security principles at the protocol level”. The OWASP MCP Top 10, still in beta, lists tool poisoning (MCP03), software supply chain attacks (MCP04) and shadow MCP servers (MCP09). Paul Yoo’s post on the permission pitfall of MCP walks through a GitHub MCP prompt injection and why the token’s own scopes weren’t fine-grained enough to stop it.

The two supply chains now overlap. SEP-2640, the Skills Extension, had Final status when we read it in November 2026. It lets an MCP server serve skills as resources under a skill:// URI scheme, requires hosts to “treat MCP-served skill content as untrusted model input”, and makes them keep track of which server each skill came from. A skill pulled from a connected server brings the server’s trust problem along with its own. The approved list that agentic supply chain guidance asks for (MCP servers, skills and AI tools, with who may use each) now has to cover both, and it has to be enforced somewhere the agent can’t edit.

Neither supply chain has a review step by default: nobody files a ticket to drop a folder into ~/.claude/skills/ or add a server to an agent’s config.

Where we put the control

Formal is a proxy, so we look at where each format turns into traffic. MCP calls are JSON-RPC requests to a server. Skills travel inside the LLM requests the agent sends to its model provider: Claude Code’s requests list the skills available to the agent and carry the instructions of the ones it loaded. That’s how Formal’s AI usage pages count “a load for each request that carries a skill’s instructions”. Formal Endpoint in Transparent Mode, on macOS and Linux, intercepts both kinds of traffic from known agents and the processes they start, with a network rule whose last stage is technology in ["mcp", "llm"].

From that traffic, the Shadow AI queue lists MCP servers that have no Formal resource, refreshed every 15 minutes, and the skills Claude Code lists as available or loaded, refreshed every 24 hours and marked Loaded or On device. Approved items go in the Catalog: Add Skill takes a SKILL.md, and access controls set who can use each skill and, for MCP servers, which tools. The full walkthrough is on our shadow AI detection page.

For everything outside the Catalog, Guardrails has one setting for unknown MCP servers and one for unknown skills: allow and monitor, or block. Blocking unknown skills generates this policy, from the Guardrails docs:

package formal.v2

import future.keywords.if
import future.keywords.in

unknown_skill := {
  "approvedSkills": ["code-review", "release-notes"],
  "blockMessage": "This skill is not approved by your organization.",
}

request := {
  "action": "block",
  "type": "block_with_formal_message",
  "reason": unknown_skill.blockMessage,
} if {
  input.resource.technology == "llm"
  some skill in input.llm.loaded_skills
  not skill.name in unknown_skill.approvedSkills
}

approvedSkills holds the managed skills in your Catalog, and Formal refreshes it when someone with the Policies permission opens the Catalog, Shadow AI or the AI Guardrails recipe. Approved MCP servers run through the MCP gateway, which adds the upstream credential, blocks tools/call requests for tools outside a user’s list, and logs every tool call.

Skill detection, the Skills usage page and the unknown-skill guardrail cover Claude Code traffic only, so skills that other agents load don’t appear. Formal names a skill after the folder that holds its SKILL.md, and the guardrail allows or blocks by that name; it doesn’t read the instructions or the scripts. A blocked skill shows Formal’s standard block message, while a blocked MCP call gets a list of approved servers to use instead. A script that reads ~/.aws/credentials is invisible to a network proxy until it sends something. And the gateway only sees remote MCP servers: a local server that a client starts over stdio talks to it through stdin and stdout and never touches the network. Our Claude Code security page lists the other policies that apply to Claude Code’s traffic.

Frequently asked questions

Are skills better than MCP?

For procedures, often: a skill needs no server and costs little context until a task uses it. The agent skills vs MCP choice flips when a call must carry a person’s identity or be allowed tool by tool.

Can a skill use an MCP server?

Yes. Its instructions can name the MCP tools to call and the order. The calls still go to the server under the server’s authorization, and a gateway still checks each one.

What is a SKILL.md file?

It’s the one required file in a skill folder: Markdown instructions after a block of YAML frontmatter. Anthropic’s docs limit name to 64 characters of lowercase letters, numbers and hyphens, with the reserved words “anthropic” and “claude” not allowed, and description to 1,024 characters. The description should say what the skill does and when to use it.

Where are Claude skills stored?

In Claude Code, personal skills live in ~/.claude/skills/ and project skills in .claude/skills/, and plugins can share more. On the Claude API, custom skills are uploaded through /v1/skills and shared across the workspace; in claude.ai they’re uploaded as zip files. Custom skills don’t sync between these surfaces. Claude Code skills are the ones Formal detects today.

Do skills work outside Claude?

Yes. Cursor, for example, loads skills from .agents/skills/, .cursor/skills/ and their home-directory equivalents, per its skills docs. A skill in a shared directory such as ~/.agents/skills/ is picked up by every agent that reads it, scripts included.

Which uses less context, skills or MCP?

Context cost is the most common argument in skills vs MCP comparisons. Anthropic’s docs put a skill at about 100 tokens until it triggers. For MCP, the cost depends on how many tools a server lists and how long their descriptions and input schemas are, and we haven’t found a primary source with a number worth quoting. Measure it on your own clients before deciding on that basis.

How do you block an unapproved skill?

Claude Enterprise can scan custom skills uploaded in claude.ai and Claude Cowork, though Anthropic’s docs say the scan doesn’t cover skills uploaded through the Skills API or the Claude Console. Formal’s unknown-skill guardrail blocks LLM requests that load a skill outside your approved list, in Claude Code traffic, wherever the skill was installed from.

Skills made agents easier to teach. The security work is where our March post left it: decide which bytes an agent may send, for which person, and enforce that outside the agent.

If you’re rolling out Claude Code and want to see the Shadow AI queue and these guardrails on your own traffic, talk to us.

Get a demo ›

1 Anthropic, Introducing Agent Skills (October 16, 2025). An update dated December 18, 2025 added the open standard.

2 Anthropic, Donating Agent Skills to the Agentic AI Foundation (October 22, 2026).

3 Anthropic, Introducing the Model Context Protocol (November 25, 2024).

4 Anthropic, Donating the Model Context Protocol and establishing the Agentic AI Foundation (December 9, 2025).

5 Anthropic, Equipping agents for the real world with Agent Skills (October 2025).

6 Liu et al., Detecting and Understanding Malicious Agent Skills in the Wild, accepted to the 35th USENIX Security Symposium (2026).

7 Snyk, “ToxicSkills” (February 5, 2026). Numbers from the article body; Snyk sells a scanner for agent skills.