Agent skills vs MCP servers vs plugins

The short answer

An agent skill is usually a reusable set of instructions, procedures, examples, and sometimes helper assets that teaches an AI host how to do a kind of work. An MCP server is a running program or remote service that exposes data and actions through the Model Context Protocol. A plugin is usually an installable bundle defined by a particular platform; it may contain skills, tools, connectors, interface components, or an MCP server.

These are layers, not rival standards. A research skill can tell an agent how to form a question, check sources, and write a brief. An analytics MCP server can retrieve the source data. A platform plugin can install the skill and connection together. The confusion begins when marketplaces present all three as interchangeable units called 'tools.'

First, check what the host means

MCP has a public specification that defines protocol messages, lifecycle, capabilities, and transport behavior. 'Skill' and 'plugin' are broader product terms. One host may implement a skill as a folder containing a Markdown instruction file and scripts. Another may use the word for a hosted action. One platform's plugin may be a signed distribution package, while another uses plugin for a legacy API connector.

Before comparing products, inspect their actual contents. Does installation add text instructions, execute local code, register a remote endpoint, request OAuth access, create a user interface, or all of the above? The label says little about the security boundary. Procurement should inventory every component and publisher rather than approving the friendliest marketplace description.

Agent skills: repeatable method and judgment

A good skill captures how a capable practitioner approaches a bounded task. It can define when to use a workflow, what context to collect, which checks to perform, how to format the result, and when to stop for human input. Skills are useful for work where consistency matters: preparing a customer brief, reviewing campaign data, drafting a content outline, or checking a design against a brand system.

Skills are usually lightweight and inspectable. They can often be versioned alongside a team's documents and improved as the process changes. Their limitation is enforcement. A sentence that says 'never send without approval' is guidance to the agent, not an access-control boundary. A skill also cannot retrieve live CRM data unless the host already has an appropriate tool or connection.

• Best at: process, sequencing, quality criteria, vocabulary, templates, and review rules.
• Weak at: guaranteed policy enforcement, live access, durable state, and deterministic side effects.
• Review: instructions, hidden assumptions, referenced scripts, assets, example outputs, and update ownership.

MCP servers: live context and bounded operations

An MCP server gives a compatible host a standard way to discover and call capabilities. It might search a CRM, retrieve an analytics report, read a document, create a task, or query an internal service. Servers can run locally as subprocesses or remotely over HTTP. They may expose tools, resources, prompts, or a combination, and can negotiate capabilities with the client.

The server is an integration surface, not a complete operating procedure. It can tell the model that a tool updates a contact, but it does not know whether the marketing team should update that contact in this situation unless rules are encoded in the server, host, or skill. Its risks come from code execution, credentials, data disclosure, side effects, upstream APIs, and the model's choice of tools.

• Best at: portable access to current systems and structured operations.
• Weak at: supplying a complete business process, resolving bad source data, or guaranteeing good model judgment.
• Review: publisher, endpoint or package, tools, schemas, transport, authentication, scopes, logs, errors, and release process.

Plugins: packaging and product integration

A plugin is most useful as a distribution and lifecycle unit. It can make a capability easier to discover, install, update, and remove in a particular host. It may include skills, an app connector, an MCP server, interface elements, authentication setup, and platform metadata. A strong plugin can also make permissions and approval policy visible in the host's normal settings.

The tradeoff is platform dependence. A plugin built for one host may not transfer to another even when an included MCP endpoint does. Bundling can also obscure provenance: the marketplace publisher, skill author, server operator, and data processor may be different parties. Uninstalling the visible plugin may not revoke an OAuth grant or delete data retained by a remote service, so offboarding must cover each layer.

• Best at: convenient installation, host-specific experience, configuration, and bundled capabilities.
• Weak at: cross-platform portability and transparency when bundles contain several services.
• Review: package contents, requested access, subcomponents, update authority, data processors, and uninstall behavior.

A buyer's comparison

Ask which gap prevents the workflow today. If employees have the right data but produce inconsistent work, start with a skill. If they know the method but manually copy information between an AI assistant and a business system, consider an MCP server. If adoption is blocked by setup and the team wants a supported, integrated experience in one host, a plugin may be the appropriate packaging.

Many useful deployments need two layers. A customer-preparation skill plus a read-only CRM server is stronger than either alone: the skill specifies the evidence and output, while the server retrieves current records. Add a plugin only if its installation, governance, or interface value justifies another dependency.

• Primary asset - skill: instructions and supporting files; MCP server: a protocol endpoint or local process; plugin: an installable host package.
• Typical portability - skill: format-dependent; MCP server: broad among compatible clients; plugin: usually tied to its platform.
• Typical permission - skill: whatever the host already has; MCP server: server and source scopes; plugin: the union of bundled permissions.
• Typical failure - skill: weak or outdated procedure; MCP server: auth, schema, network, or tool error; plugin: install, compatibility, bundle, or lifecycle error.

Example: a weekly marketing performance brief

The skill defines the brief: compare the same complete periods, state metric definitions, separate observation from hypothesis, include source evidence, flag tracking changes, and end with decisions requiring an owner. It may include a template and a checklist for reviewing anomalies. The skill can work with a manual CSV today and a live connector later.

The MCP servers retrieve read-only Google Analytics and advertising data, perhaps plus CRM outcomes. The host controls which tools are enabled and sends results to the model. A plugin could package the skill, connection instructions, a rendered report card, and update management for a particular assistant. The system of record remains authoritative; the generated brief is an interpretation that a marketer reviews.

Common category mistakes

Teams sometimes install a server when the actual problem is process ambiguity. The agent gains access to five systems but no definition of a qualified lead, approved claim, or correct reporting period. The result is faster inconsistency. The reverse mistake is writing elaborate instructions that ask an agent to obey restrictions its credential cannot enforce.

Another mistake is counting bundled components as independent value. A plugin may advertise fifty skills that are minor prompt variations over the same broad connector. A server may expose a long tool list generated directly from an API, leaving the model to navigate overlapping operations. Evaluate whether the package improves a real workflow, not how many items appear after installation.

Govern the layers separately

Version skills like operating procedures. Give them an owner, test representative tasks, and review material changes. Govern MCP servers like integrations and executable software: approve publishers and versions, restrict identities, monitor tools, and test revocation. Govern plugins like distribution bundles: inspect contents, platform permissions, update behavior, and removal.

Then evaluate the assembled system end to end. The safest server can still be used badly by an overbroad skill, and an excellent skill can be undermined by a plugin that silently expands access. Keep an inventory that links the workflow to every component, identity, data class, owner, and review date. Remove layers that do not contribute measurable reliability or usability.