Agent Skills vs MCP: knowledge in context, or capability over a wire?

An Agent Skill is a package of knowledge and procedure — typically a SKILL.md plus supporting files — that gets loaded into the model’s context to shape how it behaves: when to do something, the steps, the conventions, the examples. It is declarative and static: it ships as files and teaches. MCP (the Model Context Protocol) is a client-server protocol that exposes tools, resources and prompts from an external server to the agent at runtime. It is imperative and live: it does not teach the agent anything, it grants it the ability to call real systems.

Both claim portability, but they mean different things. A Skill is just files, so it travels anywhere a host is willing to read skill files — copy the folder and it works, with nothing to run. MCP’s portability is protocol portability: a growing ecosystem of dozens of MCP-capable hosts (on the order of forty and climbing) can talk to any compliant server, so one server you write is reusable across all of them. The catch is that "reusable" still means each host has to be pointed at the server, given credentials, and trusted.

So the two portabilities trade against each other. Skills have zero operational surface — but they cannot do anything on their own. MCP servers do real work and are write-once, reuse-everywhere at the protocol level — but every deployment carries a running service, its uptime, and its auth. Skills spread like documents; MCP spreads like infrastructure.

The framing as rivals falls apart the moment you build something real, because the best pattern uses both. A Skill supplies the judgment — when this situation arises, here is the procedure — and inside that procedure it tells the agent to call a specific MCP tool to actually touch the world. The Skill is the playbook; the MCP tool is the move. Neither replaces the other: a tool with no guidance gets misused, and guidance with no tool cannot act.

The costs stack the same way. A Skill spends context tokens for as long as it is loaded, so an overlong Skill crowds out the task; an MCP tool spends schema tokens to advertise itself plus a network round-trip each call, and adds a real attack surface — a compromised or hostile server, or content it returns, can try to steer the agent. Designing well means keeping Skills tight and scoped, and treating every MCP server as untrusted input at the boundary.

You want an agent that triages incidents. The Skill encodes the runbook: how to classify severity, which signals to check first, the escalation ladder, the tone for a status update. That is pure knowledge — it belongs in context, ships as files, and applies the same way everywhere the agent runs. None of it requires a running service.

But triage means touching live systems: query the metrics store, read recent deploys, open or update a ticket, post to the incident channel. Each of those is an MCP tool — a live capability the agent calls at runtime through a server you wired up once and reuse across every agent and host. The Skill tells it which tool to reach for and when; MCP is how it actually reaches. Rip out the Skill and the agent flails with powerful tools; rip out MCP and the agent knows exactly what to do and cannot do any of it.