Can an agent load skills directly from an MCP server?
No complete implementation was verified in this audit. Claude Code has a partial loader behind a feature gate; its availability and actual agent use were not tested.
Audited October 14, 2026 · Source and documentation review · No runtime tests
Reading a SKILL.md file is only file access. It does not mean the agent discovers it, verifies it, or loads it as a skill. “Not established” means the research has no proof either way.
A separate option: import skills into an OpenAI plugin
OpenAI documents importing skills from an MCP server when the publisher scans a plugin. ChatGPT and Codex then use the packaged copy. They do not fetch those skill files live from the server.
Changing the skill requires another scan and plugin submission. This import workflow was not tested in this audit. Read the import documentation
Versions and evidence
Codex CLI · 0.162.1 · View evidence
- Conditions
- Known extension allowlist excludes Skills; generic resources API is a separate capability
- App Server skills/list is not MCP Skills discovery
- Native resource-read labels refer only to generic MCP file access, not skill discovery or activation
- OpenAI plugin portal can import an MCP skill snapshot according to documentation; this does not establish live Skills extension support in Codex CLI
- Unknowns
- Host wire exchange, effective feature rollout and actual model activation were not probed.
- Details
- Source Revision
- 092d3acd6bec3e3a14bdc7e7a2810ab628ab759d
- Wire Probe
- not-run
- Audit Boundary
- Audited On
- 2026-10-14
- Wire Probe
- not-run
- Activation Probe
- not-run
- Default Meaning
- Preferred registry variant; does not mean the feature is enabled
- Plugin Import
- Support
- documented
- Surface
- OpenAI plugin submission portal Scan Tools
- Delivery
- submission-time static snapshot
- Runtime Fetch
- false
- Protocol Profile
- bounded static subset; docs describe it as draft SEP-2640
- Tested
- false
- Limits
- Skills
- 5
- Catalog Pages
- 10
- Files Per Skill
- 100
- Skill Md Bytes
- 262144
- Supporting File Bytes
- 1048576
- Skill Bytes
- 5242880
- Scan Archive Bytes
- 8388608
- Verification
- per-resource digest
- catalog/frontmatter equality
- safe unique paths
- import size limits
- Stable Manifest Size Verification
- not documented; enforcing import limits is separate from comparing manifest size
Claude Code · 2.1.296 · View evidence
- Conditions
- tengu_mcp_skills feature gate defaults false; effective rollout not inspected
- Server must advertise resources and the extension
- Loader reads optional top-level digest, not stable resources manifest
- Activation is command-construction source evidence, not an observed model run
- Native resource-read labels refer only to generic MCP file access, not skill discovery or activation
- skills/get helper exists; loader use and wire behavior remain unverified
- Unknowns
- Host wire exchange, effective feature rollout and actual model activation were not probed.
- Details
- Source Revision
- Not specified
- Wire Probe
- not-run
- Bundle
- Version
- 2.1.296
- Sha256
- c9b5341637becbd423ddffc5b254afb645682a3868cb708bbc6cc0e7bb419937
- Bytes
- 240664432
- Markers
- Gate
- 195222586
- List Request
- 224261236
- Get Request
- 224261355
- Fetcher
- 228849353
- Cache Hit
- 228852745
- Command
- 228855679
- Observations
- Feature gate tengu_mcp_skills still defaults false; effective account rollout not read.
- Connection paths condition discovery on the feature gate and resources; fetcher requires server extension identity.
- List parser retains frontmatter, uri and optional top-level digest; loader does not consume stable per-file resources manifest.
- A skills/get request helper is exported; no getMcpSkill call was found in decoded source strings, and the inspected loader calls listMcpSkillPage only. This is helper implementation evidence, not an exercised retrieval path.
- Discovery still caps at 100 valid entries and 20 pages, eagerly reading SKILL.md on cache misses.
- Fresh reads verify a valid optional top-level SHA-256 digest; cache hits reuse text without rehash in the inspected loader.
- No per-file manifest byte-size or digest enforcement and no field-by-field catalog/frontmatter comparison in the inspected loader.
- Constructs server-qualified source:mcp skill commands and a resource root; ignores hooks and allowed-tools grants.
- Request Helper Calls Found
- 0
- Inspection Boundary
- Decoded embedded JavaScript for gate, request wrappers, loader/cache and connection call sites; no proprietary source copied into repository.
- Audit Boundary
- Audited On
- 2026-10-14
- Wire Probe
- not-run
- Activation Probe
- not-run
- Default Meaning
- Preferred registry variant; does not mean the feature is enabled
Cursor Agent · documentation review · View evidence
- Conditions
- Documentation does not establish extension stages or a client version
- Native resource-read labels refer only to generic MCP file access, not skill discovery or activation
- Unknowns
- Host wire exchange, effective feature rollout and actual model activation were not probed.
- Details
- Source Revision
- Not specified
- Wire Probe
- not-run
- Audit Boundary
- Audited On
- 2026-10-14
- Wire Probe
- not-run
- Activation Probe
- not-run
- Default Meaning
- Preferred registry variant; does not mean the feature is enabled
pi · 1.2.0 · View evidence
- Conditions
- Built-in runtime passes roots, not a Skills extension capability
- Built-in v1.2.0 accepts base protocols only through 2025-11-25; custom SDK capabilities are outside this contract
- Native resource-read labels refer only to generic MCP file access, not skill discovery or activation
- Unknowns
- Host wire exchange, effective feature rollout and actual model activation were not probed.
- Details
- Source Revision
- 06a466935536f8c9bcacb2d5efc0fc021be1bdff
- Wire Probe
- not-run
- Audit Boundary
- Audited On
- 2026-10-14
- Wire Probe
- not-run
- Activation Probe
- not-run
- Default Meaning
- Preferred registry variant; does not mean the feature is enabled