Agent skills vs MCP servers: knowledge vs tools, and when you need both
MCP gives an agent tools and data through a running server. A skill gives it a procedure through a text file. Cost, latency, security, portability, and a decision table for choosing, plus how the two compose in Claude Code, Cursor, and Codex.
Contents
Both of these extend an AI agent, both are open standards, and both are things you install. That is where the similarity ends. An MCP server is a process. It runs, speaks the Model Context Protocol over stdio or HTTP, and hands the agent a list of tools it can call and resources it can read. An agent skill is a file. It sits in a directory, costs about a hundred tokens until needed, and tells the agent how to do a task using tools it already has.
The confusion comes from the fact that both make the agent better at a task. The distinction that resolves it: MCP changes what the agent can do. A skill changes how well it does it. This article covers cost, security, portability, and composition, and ends with a decision table.
What each one is, precisely
MCP (Model Context Protocol) defines three primitives a server can expose:
- Tools: actions the agent chooses to invoke, like
create_issueorquery_database. Each comes with a JSON schema that the agent sees in context. - Resources: data the agent can read, addressed by URI, similar to GET endpoints.
- Prompts: reusable templates that the client can surface as slash commands.
The server runs as a separate process (or remote endpoint) that the agent’s host connects to. When it is connected, its tool schemas are part of every request.
An agent skill is a directory with a SKILL.md:
release-notes/
├── SKILL.md # frontmatter (name, description) + instructions
├── scripts/ # optional executable helpers
├── references/ # optional docs loaded on demand
└── assets/ # optional templatesAt startup the agent reads only the name and description of every skill. When a request matches, it loads the body and follows it, running scripts or reading references as the body directs. The same file works across Claude Code, Cursor, Codex, GitHub Copilot, and 60+ other agents because the format is an open specification.
The core distinction, with examples
| You want the agent to… | Needs MCP? | Needs a skill? |
|---|---|---|
| Query your Postgres database | Yes: it has no database tool | Optional: a skill can encode your schema conventions and safe-query rules |
| Review a pull request against your team’s checklist | Only if it cannot already read the PR (a GitHub MCP server or gh in the shell) | Yes: the checklist is the skill |
Generate a .docx with your letterhead | No: it can run a script | Yes: the procedure plus the template in assets/ |
| Post to Slack | Yes: it has no Slack tool | Optional: a skill for message formatting rules |
| Follow your deployment runbook | No: it already has a shell | Yes, manual-only: the runbook is the skill |
| Search 25,000 community skills | Yes, or a CLI in the shell | No |
The pattern: if the agent physically cannot reach a system, that is MCP’s job (or a built-in tool). If it can reach the system but does not know your procedure, that is a skill’s job. Most real tasks need one MCP connection and one skill.
Cost: tokens, latency, and setup
| Dimension | Skill | MCP server |
|---|---|---|
| Idle context cost | About 100 tokens per skill (name + description) | Every connected server’s full tool schemas, on every request. A server with 20 tools can cost 1,500 or more tokens |
| Active cost | The body, once, when used (recommended under 5,000 tokens) | Each tool call’s input and output |
| Latency | None beyond reading a file | Process startup, network round trips per call |
| Setup | Copy a folder, or one CLI command | Install the server, configure the host, often supply credentials |
| Runtime dependency | None | The server must be running and reachable |
| Works offline | Yes, unless the skill’s scripts need network | Only for local servers |
Codex publishes a cap that makes the skill side concrete: the skill list gets at most 2% of the context window or 8,000 characters. MCP schemas have no such cap in most hosts, which is why people with a dozen MCP servers connected notice their context filling up before they type anything.
Security: what can go wrong with each
MCP risks. The server runs code on your machine or has credentials to a remote system. A malicious or compromised server can exfiltrate data through a tool call, return tool results that contain prompt injection, or expose a tool whose description misleads the agent. Mitigations: run servers you trust, scope credentials narrowly, and review tool descriptions.
Skill risks. A skill is instructions the agent will follow, so a malicious skill can tell the agent to ignore other instructions, hide actions, or run a bundled script that does something other than what the body claims. Claude Code adds a specific edge: the allowed-tools frontmatter field pre-approves tools for the skill’s turn even in an untrusted folder, so a repository skill can grant itself broad Bash access. Mitigations: read the skill and its companion files before installing, check scripts/, and prefer registries that review submissions. Every public skill on SkillMD passes a safety review that covers the full bundle, not just SKILL.md, and shows a capabilities summary on the listing.
Neither is inherently safer. MCP has a bigger blast radius (live credentials); skills have a lower review bar (they look like documentation).
Portability
| Dimension | Skill | MCP server |
|---|---|---|
| Format standard | Agent Skills spec (agentskills.io) | Model Context Protocol |
| Host support | 60+ agents read SKILL.md | Most major agents support MCP clients |
| Config location | A directory per agent | Host-specific config (.mcp.json, settings.json, config.toml) |
| Install one, use everywhere | Yes, with a CLI that writes to each agent’s directory | Configure per host |
| Version control | Commit the folder | Commit the config; the server is a dependency |
Skills win on portability because there is nothing to run. An MCP server is portable in the sense that any MCP client can connect to it, but each host wants its own configuration.
How they compose
The two are designed to be layered, and each ecosystem has a hook for it.
Claude Code. A skill’s body can tell the agent to use a specific MCP tool. A skill with context: fork can run as a subagent with MCP tools available. Plugins bundle skills together with .mcp.json server definitions, so installing one plugin gives the agent both the capability and the procedure. SkillMD’s own hosted MCP server is an example of MCP serving skills: connect it once and ask the agent to find and install a skill in plain language.
claude mcp add skillmds -- npx -y skillmdsCodex. A skill folder can include agents/openai.yaml with a dependencies.tools block listing the MCP servers the skill expects. Codex can then tell you what is missing instead of failing mid-task.
Cursor. Skills and MCP servers are configured separately, and a skill body references MCP tools by name. Cursor’s paths frontmatter lets you scope a skill to the part of the repo where the MCP-backed workflow applies.
A concrete composed example: a pr-review skill (the checklist, the severity rubric, the tone for comments) plus a GitHub MCP server (read the diff, read the discussion, post the review). Remove the skill and the agent reviews inconsistently. Remove the MCP server and the agent has to shell out to gh, which a skill can also teach it to do.
MCP prompts vs skills
MCP servers can expose prompts, and hosts often surface them as slash commands. This is the one place the two standards overlap, so it is worth being precise about the difference:
| MCP prompt | Skill | |
|---|---|---|
| Triggered by description automatically | No | Yes |
| Can bundle scripts and reference files | No | Yes |
| Requires a running server | Yes | No |
| Can take arguments | Yes, typed | Yes ($ARGUMENTS in Claude Code, free text elsewhere) |
| Portable across hosts without config | No | Yes |
If you find yourself writing an MCP server whose only job is to expose prompts, you are building a skill with extra steps.
Decision table
| Situation | Choose |
|---|---|
| The agent cannot reach the system at all | MCP (or a built-in tool) |
| The agent can reach it but does the task inconsistently | Skill |
| You want the same behavior in Claude Code, Cursor, and Codex | Skill, with MCP only where a capability is missing |
| The task needs live credentials | MCP for the connection, skill for the procedure |
| The task is a runbook with side effects | Manual-only skill |
| You need reusable reference material (schemas, style guides) | Skill with a references/ folder |
| You are distributing a full workflow to a team | Plugin (Claude Code) or a skill plus a documented MCP dependency |
| Context is tight and the agent already has a shell | Skill that drives CLI tools, instead of a new MCP server |
Further reading
Frequently asked questions
What is the difference between an agent skill and an MCP server?
An MCP server is a running process that gives an agent tools (actions) and resources (data) over the Model Context Protocol. A skill is a SKILL.md text file that gives the agent instructions for a task, loaded when relevant. MCP adds capabilities; skills add know-how. They are complementary.
Can a skill replace an MCP server?
Only when the agent already has the capability and just needs to be told how to use it. A skill can teach the agent to run gh or curl from its existing shell tool. It cannot give the agent access to a system it has no tool for; that requires MCP or a built-in tool.
Can an MCP server replace a skill?
Partly. MCP servers can expose prompts, which are reusable templates. But MCP prompts are not loaded by description, cannot bundle scripts and reference files, and require the server to be running. For procedures and reference material, a skill is cheaper and more portable.
Do skills and MCP work together?
Yes, and the combination is the common case. A code-review skill describes what a thorough review covers; a GitHub MCP server lets the agent read the pull request. Codex skills can even declare MCP dependencies in agents/openai.yaml so the agent knows what must be connected.
Which is cheaper in tokens, a skill or an MCP server?
A skill costs about 100 tokens per skill at startup and its body only when used. An MCP server's tool schemas are loaded into context for every request while the server is connected, often hundreds to thousands of tokens per server. Skills are almost always cheaper when the agent already has the underlying tools.