Skills over MCP

Status in the 2026-07-28 spec: extension (official, io.modelcontextprotocol/skills)

Skills over MCP is an official MCP extension that lets a server share "skills" with AI apps. A skill is a folder of instructions, with a SKILL.md file and optional supporting files, that teaches an AI agent how to do a specific job. The extension defines how a client finds those skills, checks them and loads them only when needed.

The Skills extension overview says the proposal behind it, SEP-2640, is Final, and that "SDK and host support is still being implemented." This page explains how it works as of October 2026.

Why Skills over MCP exists

An MCP server gives an AI tools. It does not, by itself, teach the AI the best way to combine them. Skills fill that gap with written workflows, such as a code review checklist or a document processing routine.

The overview says serving skills over MCP "keeps those instructions with the service they describe." When the service changes, the instructions can change with it. Clients load only names and descriptions up front, then fetch the full instructions when a skill is actually used.

Skills follow the open Agent Skills specification. The MCP extension adds discovery and retrieval over the protocol.

How it works

1. The server declares support

Servers must declare both the resources capability and the extension in their server/discover response:

{
  "capabilities": {
    "resources": {},
    "extensions": {
      "io.modelcontextprotocol/skills": {
        "directoryRead": true
      }
    }
  }
}

directoryRead is optional and defaults to false. When true, the server supports listing a skill folder with resources/directory/read.

2. The client lists or looks up skills

skills/list returns entries with three fields: the uri of the skill's SKILL.md, all of its YAML frontmatter (including name and description), and a resources manifest. It supports pagination and caching hints. skills/get fetches one entry by URI, including skills that do not appear in a listing.

A manifest entry looks like this, from the spec:

{
  "uri": "skill://code-review/references/checklist.md",
  "digest": "sha256:dbab2de7bf7db9cc95cb6ce681c3690b26184db39f75b958a0287ca6d9e24e20",
  "size": 65
}

3. The host approves and loads

The host, or the user, picks a skill. If approval is required, the host asks the user. It then reads SKILL.md with resources/read, checks its size, digest and frontmatter, and only then loads it into the model's context. Supporting files are fetched the same way, one at a time, when the skill needs them.

The overview stresses that reading SKILL.md "does not itself activate a skill." Activation goes through the host's skill-loading path, with verification and approval.

Built-in safety rules

The extension's rules are strict, because skill text steers what an AI agent does. For skills with a manifest, hosts must:

• Read only files listed in the retained manifest.
• Verify each file's byte size and SHA-256 digest before use.
• Compare SKILL.md frontmatter field by field with the listed entry.

Approval is tied to the full set of files and digests. The spec says "A changed, added, or removed file revokes that approval," and the host must ask again.

Hosts must also:

• Stop same-named skills from silently replacing one another.
• Tag loaded content with the server it came from.
• "Treat skill content as untrusted input." Running code or granting extra tool permissions, such as allowed-tools, needs explicit approval per skill.
• Not fetch skill files ahead of need, including on connection, listing or approval.

The overview adds a caution: digests prove a file matches the server's manifest, "not trust in its content." A skill can still contain harmful instructions. That is why the tool poisoning and prompt injection risks apply here too.

Servers should not exceed 512 files or 16 MiB per skill, and hosts must support skills up to those limits.

What changed across spec versions

Skills over MCP is new. It does not appear in the 2025-11-25 core spec.

These dates come from the Skills Over MCP Working Group page and the 2026-07-28 changelog. The working group maintains the ext-skills repository. For how extensions work in general, see how MCP extensions work.

Client support

The extension support matrix, read on 28 October 2026, marked the mcpc command-line client as supporting Skills. ChatGPT, fast-agent and MCP Inspector were marked "Partial." No other client in the matrix showed Skills support. Treat it as an early-stage extension.

Common mistakes

• Partial manifests. Servers must list SKILL.md and every supporting file, with digests computed from the bytes actually served.
• Splitting a manifest across pages. Each skill entry is atomic and must not be split.
• A folder name that does not match name. The final segment of the skill's directory path must match the name in its frontmatter.
• Hosts caching files where tools can edit them. Disk caches must be immutable or re-verified on every access.
• Trusting a skill because the digest matches. A matching digest only proves consistency with the server.
• Assuming wide client support. As of October 2026, support is limited.

Next step

Skills, Apps and Tasks are the three headline extensions. For the business view of all three, read MCP Apps, Tasks and Skills explained. To see where they fit in the protocol, browse the MCP specification reference.

Frequently asked questions