MCP Protocol Gets Skills: Standardized Agent Workflows Now Built-In

The Model Context Protocol (MCP) has merged the Skills extension (SEP-2640, finalized 2026-09-13), adding a third capability layer that standardizes how agents execute reusable workflows. Previously MCP offered only tools (what an agent can do) and resources (what an agent can access). The missing piece was a standard way to describe how to combine tools and resources into a complete task — knowledge that lived in scattered docs, READMEs, and prompt files without a distributable, verifiable format.

Three New Protocol Methods

All three methods build on the existing Resources primitive; no new transport mechanism was invented.

skills/list — Enumerates every skill the server exposes. Each entry includes its URI, full frontmatter, and a complete file manifest with SHA-256 digests and byte sizes. A single call builds a registry without fetching each SKILL.md individually. Servers may return an empty or partial list.

skills/get — Retrieves a single skill entry by URI. Used primarily to refresh an entry after a digest mismatch or to fetch skills omitted from a partial list response.

resources/directory/read (optional) — Lists the immediate children of a directory (non-recursive). Enables scenarios where a skill instruction references a directory (e.g., "pick a template from templates/").

Skill Entry Structure

A skill entry is a JSON object with three top-level fields:

{
  "uri": "skill://pdf-processing/SKILL.md",
  "frontmatter": {
    "name": "pdf-processing",
    "description": "Extract, fill, and assemble PDF documents"
  },
  "resources": [
    {
      "uri": "skill://pdf-processing/SKILL.md",
      "digest": "sha256:99b7...",
      "size": 151
    },
    {
      "uri": "skill://pdf-processing/templates/invoice.md",
      "digest": "sha256:61f4...",
      "size": 29
    }
  ]
}

URI convention: skill://<skill-path>/<file-path> where the final segment must equal the skill name. An optional organizational prefix is allowed (e.g., skill://acme/billing/refunds/SKILL.md where acme/billing is the prefix and refunds is the name). The skill:// scheme is not mandatory; a skill is identified by its presence in the listing or via skills/get. The true identifier is "server identity + URI", so two servers can host skills with the same name.

Frontmatter is the complete YAML front matter serialized as JSON, with no field stripping. name and description are always present; extra fields pass through unchanged.

Resources is either a full file-manifest array (each with URI, digest, size) or the string "dynamic" for skills whose files are generated on demand and lack stable digests.

Directory Browsing

A directory read response looks like:

{
  "uri": "skill://pdf-processing/templates/regional",
  "name": "regional",
  "mimeType": "inode/directory"
}

Subdirectories carry mimeType: "inode/directory"; the client calls the method again to drill down. File contents are still fetched via the existing resources/read — this is only the transport layer. Reading a file does not activate the skill; activation follows the host's own skill-loading path, which verifies digests, checks approvals, and records provenance. Every file read is validated against the manifest's digest and size; a mismatch causes rejection, a refresh of the entry, and re-approval. Digests prove consistency between manifest and content, not a security boundary.

Security Constraints

Skills entering the model context must be tagged with their server origin.

Cross-origin resource reads are prohibited.

No implicit execution of local code.

Name collisions must not silently replace existing skills.

Per-skill limits: 512 files or 16 MiB.

Server Capability Declaration

Servers advertise the extension in their capabilities object:

{
  "capabilities": {
    "resources": {},
    "extensions": {
      "io.modelcontextprotocol/skills": {
        "directoryRead": true
      }
    }
  }
}

Declaring the extension implies implementation of skills/list and skills/get. directoryRead defaults to false.

Core Logic and Benefits

The upgrade's core logic: Resources already expose files at file granularity. Skills add a structured index on top, plus digest verification and approval binding. No new transport layer was invented, turning "teaching an agent how to use tools" from ad-hoc practice into a protocol-standardized capability.

Local skills offer offline use, fast loading, and no network dependency — especially valuable for heavy local file operations and shell integration. However, hosting skills in the cloud via MCP, managed and distributed alongside tools and resources by a single server, simplifies the consumer experience: connect to one server, and skills arrive with tools, eliminating separate discovery, installation, and update steps.

For teams, the advantage is direct: an administrator updates a skill once, and the entire team receives the new version on next connection — no manual file replacement notifications needed. The same benefit applies to individuals, avoiding duplicate installations and version drift across multiple agent runtimes. The article cites Tokenbank (an open-source AI resource leasing project) as an early explorer of this pattern, using MCP bridging to inject AI resources into agents on demand.

References

Extension repository: https://github.com/modelcontextprotocol/ext-skills

Tokenbank project: https://github.com/wink-run/tokenbank