Every agent user hits the same moment. The agent gets a job slightly outside its habits and fumbles it. You open a directory to fix that, and the directory hands you a choice it does not help you make: install an MCP server, or install a skill?
They look like the same kind of thing. They are not. Picking the wrong one is how you end up with an agent that has forty new abilities and still does the original job badly.
The short version: an MCP server gives the agent a new capability. A skill gives it know-how. One is plumbing, the other is training.
What a skill actually is
A skill is a folder. At its centre sits a file called SKILL.md: a name, a short description, and instructions written in plain language. When the agent sees a task that matches the description, it loads those instructions and follows them. A good code review skill is a patient reviewer standing behind the agent, telling it what to check and in what order.
Nothing about that runs on your machine by itself. There is no server, no port, no background process. You can read the whole thing before you install it, top to bottom, in a few minutes. If you would not paste those instructions into the chat yourself, do not install the skill. That is the entire security review, and for most skills it is enough.
The skills worth having are opinionated. "Here is exactly how I want this job done" ages far better than "here are some tips".
What an MCP server actually is
An MCP server is code that runs. It connects the agent to something live: a database, your calendar, a ticket queue, a browser. When the agent calls one of its tools, real code executes, with your privileges, against a real system.
That is a different kind of trust. A skill can only be wrong. An MCP server can be wrong and then do something about it.
Since the 2026-07-28 spec, the protocol core is stateless and a remote server is an ordinary HTTP workload, which makes hosted servers much easier to run well. It does not change what a server is: a programme you have decided to trust. So the review is different too. You check who maintains it, trace the install path to the code that will actually run, and give it the smallest access that still does the job.
So which one is missing?
Ask what the failure looked like.
→ If the agent cannot reach the thing, that is a capability gap. Your database, your calendar, your Linear board. Only an MCP server closes it.
→ If the agent can reach everything it needs and still does the job badly, that is a know-how gap. A skill closes it. No server will.
→ If it is both, install in that order: capability first, then the skill that teaches the agent to use it well.
The most common mistake is treating a know-how problem as a capability problem. The agent writes a weak report, so it gets three more tools. Now it writes a weak report with access to your production database. More capability makes an under-instructed agent more dangerous, not more competent.
They now travel together
One more thing worth knowing. Agent Plugins 1.0, published in August 2026, packages skills and MCP servers into a single folder with a small manifest, so an extension written once can be loaded by more than one agent client. Expect to see more of these bundles.
Read them the same way you would read the parts. The spec's security model is containment of files inside the package, not a sandbox. An MCP server entry inside a plugin is still a command running on your machine with your privileges. A standard for packaging is not a standard for trust.
Where I look
This is why we built the Radar the way we did. The skills directory lists skills, custom GPTs and Gems by the job you need done, and the MCP directory does the same for servers, with each install path traced to the code you will actually run. Every entry is hand-checked and every claim carries a dated source, because "popular this week" is not a reason to hand something your credentials.
My honest view: start with skills. They are cheaper to trust, easier to remove, and far more often the real gap. Add servers only where there is a system the agent truly cannot reach, and review those like the running code they are.
Also on the Kapyn Journal: How to choose an MCP server in 2026 without giving your AI agent too much access.
Top comments (1)
Some comments may only be visible to logged-in visitors. Sign in to view all comments.