After writing about the skill marketplace supply-chain problem, I realized I’d never actually drawn the line between Agent Skills and MCP — two Anthropic-originated standards that launched close together, both went open, and both get mentioned in the same breath constantly, for reasons that make them easy to blur together.
MCP is about reach. As I covered separately, it’s a standard way for an agent to discover and call external tools and data sources — a database, a ticketing system, a search index — regardless of which model is doing the reasoning. It solves the problem of an agent needing to touch something outside its own context window.
A Skill is about know-how. Introduced by Anthropic in October 2025 and published as an open standard two months later, a skill is a folder — typically just a SKILL.md file plus optional supporting scripts — packaging a specific, repeatable workflow: how to fill out this particular kind of form, how this team wants commit messages formatted, the exact steps for a recurring report. An agent only loads a given skill when a task actually matches its domain, instead of every possible instruction sitting permanently in every prompt whether it’s relevant or not. It solves the problem of an agent needing to know how to do something specific, without bloating its baseline context with instructions for a hundred tasks it isn’t currently doing.
The reason they’re easy to conflate: both are just structured files an agent reads and acts on, both spread the same way — publish it, others install it — and both launched within a couple months of each other as part of the same general push toward standardizing how agents extend themselves. It’s genuinely reasonable to hear “a folder that tells the agent what to do” and not immediately know which one someone means.
The practical difference shows up the moment something goes wrong with each. An MCP server that misbehaves is a connection problem — a specific tool call reaching somewhere it shouldn’t, the exact shape of what GhostJacking exploited. A skill that misbehaves is a content problem — the instructions and scripts inside the folder itself have quietly changed since you trusted them, which is precisely the clone-then-poison pattern in the skills.sh case. Different attack surface, different thing to check: for MCP, what a connection can reach; for a skill, whether what’s inside the folder today still matches what you approved when you installed it.
Adopted together, by more than 40 platforms as of mid-2026 including Claude Code, Codex, Cursor, GitHub Copilot, and Gemini CLI, they cover two genuinely separate halves of what makes an agent useful beyond its base training: MCP gets it somewhere, a Skill tells it what to do once it’s there.
