A skill records a reusable method for doing work. Model Context Protocol, or MCP, gives an AI application a standard way to access tools, information and reusable prompts from connected systems. People supply the business rules and decide which actions are permitted. (Agent Skills specification; MCP architecture.)
A skill records how the work should be done
Under the Agent Skills specification, a skill is a folder containing a SKILL.md file. That file holds identifying information and written instructions; the folder can also include reference documents, templates and scripts. This gives a team somewhere to record procedural knowledge: the steps, checks and exceptions that shape a useful result. (Agent Skills specification.)
For a business workflow, start with the standard the reviewer expects. Specify which inputs to use, how to handle conflicting evidence, what the finished handoff contains and when to ask a person. The team must supply its own rules for interpreting those records and deciding what happens next.
MCP makes capabilities available to the application
An MCP server is a program that makes particular capabilities available to an AI application. It can run locally or remotely. The application connects to discover and use what the server provides. (MCP architecture.)
Tools perform operations, including searches and record updates. A tool can therefore retrieve information as well as change something. Resources supply material for context, such as document contents. Prompts provide reusable instruction templates. These are different ways a server can support the work; an implementation need not provide every kind. (MCP tools, resources and server concepts.)
That includes some overlap with a skill: a prompt can contain directions, and a resource can contain a procedure. The distinction is between packaging a reusable method as a skill and providing capabilities through MCP. The team still needs to decide where its authoritative procedure lives.
Plugins can package these pieces together. For one platform-specific example, Claude Code supports skills and MCP server configurations within a plugin. (Claude Code plugin reference.) See plugins versus SKILL.md files for the packaging decision.
Illustration: a weekly account handoff using files
Consider an invented distributor preparing its weekly customer-account handoff. The account manager supplies a customer relationship management (CRM) export, a support-ticket export, relevant correspondence and the previous handoff. The chosen AI application supports the skill and can read these files directly. This design needs no MCP connection: the inputs are already available, and the skill format does not require MCP. (Agent Skills specification.)
The skill instructs the AI to compare the records, identify changes since the previous handoff and draft an account brief. Each open item needs its source, current owner and next action. Missing owners stay visible as questions. The output records the exports' dates so the reviewer knows the period covered.
The support export marks an issue closed, while a later customer email says the problem persists. The distributor's rule requires the account manager to resolve that discrepancy before calling the issue settled. The draft should show both records and ask for a decision. The files supply the evidence; the skill supplies the rule for handling it.
Illustration: adding live access to the same handoff
Suppose the distributor later configures compatible MCP servers with permitted access to its CRM and support system. The AI application could retrieve account records through the available tools instead of relying on those exports. The skill would need instructions matching those tools and identifying which records to request. This is a proposed design, not a tested integration.
The handoff still needs the distributor's rule for unresolved issues. A newly retrieved ticket might show that an issue has reopened, but it cannot establish an unrecorded customer conversation. The draft should identify the records retrieved, their dates and any unavailable information. The account manager checks the conflicts, resolves disputed items and approves the handoff before it goes to the next team.
Set the action boundary alongside the instructions
Live access does not itself grant business approval to change records or contact customers. Define permitted reads separately from updates and outbound messages. The MCP tools specification calls for access controls and recommends human control over tool use, while leaving the interaction design to implementations. Check the actual workspace and connection; a standard protocol does not mean identical approval behavior everywhere. (MCP tools specification.)
Enforce those limits in the application, MCP server and underlying business system. Writing “read only” in a skill does not revoke an update tool. Start with narrowly scoped access and check which records each user can reach. (MCP scope minimization)
Retrieved records can also contain prompt injection: content that tries to redirect the AI from the user's task. Read access plus a separate sending tool can expose confidential information even when the source connection cannot modify records. Review the combined access and the approval path; the security guide develops those checks.
Start with a useful handoff and its reviewer. Write down the method, identify the necessary evidence and choose how to obtain it. Supplied files may be sufficient. Add a live connection when the job calls for it, keeping the business rules and the person's decision visible in the finished work.