Agent skills vs MCP servers: what is the difference, and which should your agent use?

Short answer: a skill teaches your agent how to do a job; an MCP server gives it access to a system it cannot otherwise reach. Add a skill when the agent already has the access but does the work badly. Add an MCP server when it needs to read or change something outside its sandbox, like a CRM, a browser or a database. When you need both, use the MCP server for access and a skill for the procedure. In our catalog the two also differ in risk and cost: 21 of 31 (67.7%) third-party MCP servers had a medium-or-higher automated security finding, against 10 of 33 (30.3%) skills, and 26 of 31 (83.9%) MCP servers need an API key or account, against 12 of 33 (36.4%) skills.

Of the 198 public posts about skills and MCP servers we collected on 2026-10-25 (X, Reddit and Hacker News), 39 mention both in the same post.

The difference in one table

	Agent skill	MCP server
What it is	A folder with a SKILL.md of instructions, sometimes with scripts and reference files	A program that exposes tools (and sometimes resources and prompts) over the Model Context Protocol
What it adds	Know-how: a procedure, a checklist, house rules, a way to use a tool well	Access: actions on an outside system, often signed in as an account
Where it runs	Inside the agent: the model reads it; any scripts run with the agent's own permissions	As a separate process on your machine, or as a remote service you connect to by URL
When the model sees it	Name and description up front; the full file only when a task calls for it	Tool names and descriptions for each connected server, usually for the whole session
How you install it	Copy the folder or run an installer such as `npx skills add owner/repo`	Add it to the client's MCP config, e.g. `claude mcp add` with a command or a URL
What can go wrong	Instructions that redirect the agent (prompt injection); bundled scripts that read secrets	Vulnerable dependencies; tool descriptions that inject instructions; broad account access; server code you cannot inspect if it is remote

What our catalog data shows

The comparison below covers the third-party items in our reviewed catalog: 33 skills and 31 MCP servers, each statically scanned at a pinned commit between 2026-10-17 and 2026-10-31. Our own house items (9 skills from Avatar 8 LLC) are left out. Numbers come from the build of 2026-11-02; method and raw aggregates are on the security research page.

	Skills (33)	MCP servers (31)
Any medium-or-higher automated finding	10 of 33 (30.3%)	21 of 31 (67.7%)
High or critical automated finding	2 of 33 (6.1%)	5 of 31 (16.1%)
No finding at all	14 of 33 (42.4%)	5 of 31 (16.1%)
Risky or known-vulnerable dependency (medium+)	4 of 33 (12.1%)	16 of 31 (51.6%)
Credential read plus network call in one file (medium+)	2 of 33 (6.1%)	8 of 31 (25.8%)
Prompt-injection-like text in agent-facing files (medium+)	2 of 33 (6.1%)	5 of 31 (16.1%)
Committed secret-like strings (medium+)	4 of 33 (12.1%)	6 of 31 (19.4%)
Files scanned per repo, average	289	479
Agent-facing files per repo, average	56	18
Automated verdict: pass / review / reject	29 / 3 / 1	23 / 7 / 1
Verdict after reading the flagged lines: pass / review	33 / 0	28 / 3
Needs an API key or account	12 of 33 (36.4%)	26 of 31 (83.9%)
Free outright (no key, no paid tier)	21 of 33 (63.6%)	5 of 31 (16.1%)
Installs as a remote URL	0 of 33 (0%)	11 of 31 (35.5%)

What we read from this:

MCP servers are bigger programs, so they carry more code risk. The average MCP repo had 479 files to scan, against 289 for a skill repo, and most of the gap in findings is dependencies: 16 of 31 (51.6%) MCP servers were flagged for a risky or known-vulnerable dependency, against 4 of 33 (12.1%) skills.
Skills are mostly text the agent obeys, so read them like code. Skill repos had on average 56 agent-facing files (SKILL.md, AGENTS.md, prompts, rules) each, against 18 for MCP repos. Prompt-injection-like text was rare in both groups. Many flagged lines we read were documentation about attacks or test fixtures, not live instructions.
Flags are where to look, not verdicts. After reading every high or critical line, all 33 skills and 28 of 31 MCP servers passed; 3 MCP servers stay at review. The one automated reject in each group passed after a line-by-line read: in both, the critical flag was documentation telling the agent to send the user's own key or secret to the vendor's own API.
MCP servers usually come with an account. 26 of 31 (83.9%) need a key or account and only 5 of 31 (16.1%) are free outright, so adding one is also a decision about cost and whose credentials the agent holds.
A remote MCP server is partly unscannable. 11 of 31 (35.5%) of the MCP servers install as a URL. We scanned their public repos, but a static scan cannot see what runs on the vendor's machine.

Caveats: the catalog is curated, not a random sample, and 33 and 31 are small groups, so treat the differences as directional. For skill collections the scan covers the whole repo, not only the skill you install. Across the wider library there are 1,381 third-party skills and 870 MCP servers, and 1,200 and 800 of them respectively have not been scanned yet.

Which one should your agent use?

Ask what is actually missing.

The agent cannot reach the system at all (your CRM, a logged-in browser, a database, a payment account): add an MCP server, or a CLI the agent can already run. Prefer the vendor's official server, give it its own limited credential, and start read-only where the server allows it; Supabase MCP (official), for example, takes a read_only=true flag in its URL.
The agent can reach it but does the job badly (wrong order of steps, skips checks, ignores house style): add a skill. Superpowers (obra) and Matt Pocock Skills (handoff, research, grill-me) are free skills in our catalog that change how an agent plans, verifies and hands off work, with no new access.
It needs both: add the MCP server for access and a skill for the procedure, and give the agent no more tools than the procedure uses. Stripe AI (official MCP + skills) pairs a remote MCP server with installable skills, and classifier.dev (Jev) does the same with an MCP server and a skill (it is still at review in our catalog, so check its page first).
The agent already has a working CLI for the job: a skill that documents the CLI may beat another MCP server, and keeps the tool list short.

Either way, have the owner approve anything that runs code, needs a key or spends money, pin the version you reviewed, and remove what does not help (keep-or-remove rules). Our vetting checklist covers both kinds.

What builders are saying

From the public posts we collected on 2026-10-25:

"MCP was clear to me: it's a useful thing that lets you give an LLM access to a database or to Figma. The only downside is that, to avoid spending too many tokens, it's better not to connect 30 MCP servers at once." (u/ievkz on Reddit, in a post titled "I Thought SKILLs Were a Waste of Tokens Until I Wrote My Own")
"If you include a SKILL.md for the MCP (or just dump it into the prompt) it's not a problem." (teravor on Hacker News, on agents that lack training data for a niche tool)
A thread on progressive disclosure of MCP servers through skills: it "seems to work fine. But it doesn't feel like it should work, and the idea is too simple." (mimo25 on Hacker News)

These are quotes; we have not tested their claims.

What we have not measured

We have no outcome data comparing skills and MCP servers on the same task: there are not yet enough check-ins from outside agents to report success rates, time saved or token use by kind. The numbers above cover scan results, cost and install method only.

Let a coach pick for you

Agent Coach looks at what your agent is trying to do, recommends vetted skills and MCP servers for the gaps, checks in daily on what the agent used, and says what to keep or remove. It is free. REST and MCP details are in the developer docs. Paste one line into your agent:

Read https://upskill.coach/start and follow it.

FAQ

What is the difference between an agent skill and an MCP server?

An agent skill is a folder with a SKILL.md file of instructions (sometimes with scripts) that teaches an agent how to do a task; the agent loads it when a task needs it. An MCP server is a program that gives the agent tools, such as reading a CRM, driving a browser or querying a database, over the Model Context Protocol. A skill adds know-how. An MCP server adds access.

Should I use a skill or an MCP server?

Use a skill when the agent can already reach what it needs (files, a shell, a CLI, a public API) but does the job badly or inconsistently. Use an MCP server when the agent needs to reach a system it cannot otherwise reach, or needs an account login handled for it. If you need both, add the MCP server for access and a skill that says how to use it.

Are agent skills safer than MCP servers?

In our scan, skills were flagged less often: 10 of 33 (30.3%) third-party skills in our catalog had a medium-or-higher automated finding, against 21 of 31 (67.7%) MCP servers. That is not the same as safe. A skill is text your agent follows, so one bad line can redirect it, and many skills ship scripts that run with the agent's access.

Do MCP servers need API keys?

Most do. 26 of 31 (83.9%) MCP servers in our catalog need an API key or account, against 12 of 33 (36.4%) skills. 5 of 31 (16.1%) MCP servers are free outright; the rest are freemium, key-based or paid.

Can a skill use an MCP server?

Yes. A skill can tell the agent when to call which MCP tool, in what order and what to check afterwards. Some vendors ship both: Stripe AI (official MCP + skills) and classifier.dev (Jev) in our catalog each pair a remote MCP server with an installable skill; the second is still at review.

Do skills or MCP servers use more context tokens?

Skills are designed for progressive disclosure: the agent sees a short name and description up front and reads the full SKILL.md only when a task calls for it. MCP clients typically give the model the tool definitions of every connected server, so a long list of servers costs context on every turn. We have not measured token use ourselves.

Questions or corrections: ops@avatar33.com.