Agent Coach blog

Practical guides for builders and AI agents on choosing, vetting and keeping agent skills and MCP servers, grounded in our own scan data. Published by Avatar 8 LLC.

How to vet an MCP server or agent skill before installing it (checklist)

A 6-step checklist to vet an MCP server or agent skill (SKILL.md) before install, with data from our security scan of 119 skill repos and MCP servers. Published 2026-10-25.

Read the post (markdown: https://upskill.coach/blog/how-to-vet-an-mcp-server-or-agent-skill.md)

How should an AI agent decide which skills and MCP servers to keep or remove?

The 10 rules our coach uses to decide whether an agent's skill or MCP server is permanent, temporary or pending removal, with the evidence each verdict needs and worked examples. Published 2026-10-26.

Read the post (markdown: https://upskill.coach/blog/how-should-an-ai-agent-decide-which-skills-to-keep-or-remove.md)

What skills and MCP servers does a GTM engineer agent actually need?

The six jobs a GTM engineer agent runs and one vetted skill or MCP server for each, from 132 go-to-market, sales and marketing items that passed our security scan, plus what needs owner approval. Published 2026-10-27.

Read the post (markdown: https://upskill.coach/blog/what-skills-and-mcp-servers-does-a-gtm-engineer-agent-need.md)

Which agent skills and MCP servers should you avoid? What 240 rejections taught us

Why we rejected 240 of 292 agent skill and MCP server candidates, by reason: duplicates, non-installable repos, off-job tools, terms-of-service risk, thin evidence, security findings and unattended trading. 189 of them had passed the security scan. Published 2026-10-29.

Read the post (markdown: https://upskill.coach/blog/which-agent-skills-and-mcp-servers-should-you-avoid.md)

How do you give an AI agent access to your CRM safely? HubSpot, Salesforce, Pipedrive and Attio

Five rules for connecting an AI agent to a CRM: its own credential, read-only first, the smallest tool set, owner approval for risky writes, and pinned versions. Compares the 4 HubSpot, Salesforce, Pipedrive and Attio connectors in our catalog, 4 of which passed our security scan. Published 2026-10-30.

Read the post (markdown: https://upskill.coach/blog/how-to-give-an-ai-agent-access-to-your-crm-safely.md)

Agent skills vs MCP servers: what is the difference, and which should your agent use?

A skill adds know-how; an MCP server adds access. When to use each, and what our scan of 39 third-party skills and 32 MCP servers found: 65.6% of MCP servers vs 30.8% of skills had a medium-or-higher finding, and 84.4% vs 33.3% need an API key. Published 2026-11-02.

Read the post (markdown: https://upskill.coach/blog/agent-skills-vs-mcp-servers-which-should-you-use.md)

Which lead research and enrichment tools should a GTM agent use? 13 tools compared

How a GTM engineer agent should find and enrich leads: one finder, one enricher, a cheapest-first waterfall, minimal data sharing and owner approval. Compares 13 tools including Apollo, Clay, Exa, Apify, Firecrawl and Explorium; 11 passed our security scan. Published 2026-11-03.

Read the post (markdown: https://upskill.coach/blog/which-lead-research-and-enrichment-tools-should-a-gtm-agent-use.md)

How should a GTM agent send outbound email safely? Skills, Resend, Instantly and Gmail

How a GTM engineer agent should write and send outbound email: draft first, one writing pack, scoped keys on a venture-owned mailbox, and owner approval before any send. Compares 12 writing, sending and guardrail tools including Resend, Instantly and Gmail; 12 passed our security scan. Published 2026-11-05.

Read the post (markdown: https://upskill.coach/blog/how-should-a-gtm-agent-send-outbound-email-safely.md)

How should a GTM agent book meetings and use calendars safely?

How a GTM engineer agent should book meetings: venture-owned calendar, read-only first, calendar-only scopes, owner approval before invites, and a fixed follow-up cadence. Compares 9 calendar, prep, booking and review tools; 9 passed our security scan. Published 2026-11-06.

Read the post (markdown: https://upskill.coach/blog/how-should-a-gtm-agent-book-meetings-and-use-calendars-safely.md)

How should an AI agent store and use API keys for MCP servers and skills?

Seven rules for agent API keys: owner-created, one per agent, smallest scope, env vars not config, vendor OAuth, minimal environment, revoke on removal. Compares 11 credential patterns from our catalog; 27 of 32 MCP servers need a key. Published 2026-11-09.

Read the post (markdown: https://upskill.coach/blog/how-should-an-ai-agent-store-and-use-api-keys-for-mcp-servers.md)

Should an AI agent trade with real money? Trading and prediction-market tools, paper first

Six rules for a trading agent: read-only data, fee-aware backtests, paper trading on the live API, owner limits with trade-only keys, official clients and calibration against the market. Compares 17 vetted data, backtest, paper, live and measurement tools, and why we rejected 55 of 65 trading candidates. Published 2026-11-10.

Read the post (markdown: https://upskill.coach/blog/should-an-ai-agent-trade-with-real-money.md)

How should an AI agent check its own work before saying "done"?

Seven rules for verifying an agent's work: write the check first, tests that fail without the change, real-browser click-throughs, side-effect checks, live-URL checks after deploy, prompt regression tests and sourced claims. Compares 13 vetted verification tools and why we rejected 12 of 16 fact-checking candidates. Published 2026-11-11.

Read the post (markdown: https://upskill.coach/blog/how-should-an-ai-agent-check-its-own-work-before-saying-done.md)

Can you reuse an agent skill or MCP server? What the licenses say

Using vs copying agent skills and MCP servers: what MIT, Apache, GPL, AGPL, NOASSERTION and no license mean, a 7-step license check, and license counts for 3,290 third-party items in our library (78.4% permissive, 17.8% with no license GitHub can name). Published 2026-11-12.

Read the post (markdown: https://upskill.coach/blog/can-you-reuse-an-agent-skill-or-mcp-server-licenses.md)

Do GitHub stars mean an agent skill or MCP server is safe? What our scan shows

Stars measure attention, not safety. In our scan of 89 third-party skills, MCP servers and repos, items with 10,000+ stars had a high or critical finding 38.9% of the time vs 4.2% under 100 stars, mostly because big projects have more code; what to check instead. Published 2026-11-13.

Read the post (markdown: https://upskill.coach/blog/do-github-stars-mean-an-agent-skill-or-mcp-server-is-safe.md)

More: security research, library, docs.