Can an agent load skills directly from an MCP server?
Not yet in any harness. Claude Code has a partial loader behind a feature gate; whether it is turned on for you, and whether the agent uses it, is unknown.
Audited October 17, 2026, Source and documentation review, No runtime tests
What the agent can do
Codex CLI
Claude Code
Cursor Agent
OpenCode
pi
Recognizes MCP skills
Not established
Not established
Not established
Not advertised by this client
Not advertised by this client
Finds available skills
Not established
Implemented behind a feature gate
Not established
Not established
Not established
Looks up a skill by its address
Not established
Recovers listed skills; unlisted lookup unknown
Not established
Not established
Not established
Checks every file’s contents
Not established
Checks SKILL.md; supporting files unknown
Not established
Not established
Not established
Checks every file’s declared size
Not established
Checks SKILL.md; supporting files unknown
Not established
Not established
Not established
Loads the skill for the agent
Not established
Loader exists; agent use unknown
Not established
Not established
Not established
Reads ordinary files through MCP
Yes — file access only
Yes — file access only
Yes — file access only
Yes — file access only
Yes — file access only
Reading a SKILL.md file is only file access. It does not mean the agent discovers it, verifies it, or loads it as a skill. “Not established” means the research has no proof either way.
Codex has a cloud skill framework
Codex can route cloud skill discovery and reads through an injected provider. The public 0.163.0 App Server registers only host and executor providers; it does not register a cloud provider. Other Codex hosts may supply one.
That is not the standard MCP Skills extension. Public Codex source has no MCP-backed provider, and its cloud tests use a fake one, so which hosts supply one, and over which protocol, is unknown. Public provider registration, Cloud discovery path
A separate option: import skills into an OpenAI plugin
OpenAI documents importing skills from an MCP server when the publisher scans a plugin. ChatGPT and Codex then use the packaged copy. They do not fetch those skill files live from the server.
Public 0.163.0 App Server registers executor and host SkillProviders; it does not register a cloud SkillProvider.
Codex has a cloud skill discovery/read/activation framework. It requires both cloud.skills.enabled (default true) and a registered cloud provider.
The concrete MCP-backed cloud provider is absent from the reviewed public release and main trees. Cloud tests use a fake provider.
The MCP resource client is passed into cloud provider list/read contexts; this does not identify the provider wire protocol or establish stable Skills conformance.
The client extension filter excludes Skills, but the stable spec does not require reciprocal client declaration; negotiation remains unestablished.
App Server skills/list is a working-directory skill API, not outbound MCP skills/list. Hosted plugin snapshot import is a separate delivery route.
Unknowns
No host wire exchange or actual model activation was probed.
Custom or proprietary Codex hosts may inject a cloud provider; its protocol, account availability and static-manifest verification are outside the public-source finding.
Cloud catalog contributes to model-visible world state; explicit selected entries load their main prompt via the cloud read context. Public tests exercise this with FakeCloudSkillProvider.
Cache Boundary
Auth/resource generation and per-resource cache identity are implemented; this is not evidence of stable manifest digest/size enforcement.
Missing Implementation
Concrete Mcp Backed Cloud Provider
Not found in the complete public release or main trees; cloud tests explicitly say they run without the concrete MCP-backed provider.
Standard Skills Protocol
No io.modelcontextprotocol/skills or skills/get literals found in public Rust sources. Extension allowlist absence is supplementary and does not prove stable-spec nonconformance.
Other Hosts
Custom hosts can inject providers through public interfaces. Their implementation, wire profile, account availability and conformance cannot be inferred from the default public registration.
Conclusion
Public CLI/App Server assembly does not wire a cloud provider. Codex nevertheless contains a real cloud skill discovery/read/activation framework. Standardized MCP Skills interoperability and proprietary host behavior remain unestablished.
Runtime Probe
not-run
Plugin Import
Support
documented
Surface
OpenAI plugin submission portal Scan Tools
Delivery
submission-time static snapshot
Runtime Fetch
false
Protocol Profile
bounded static subset; docs describe it as draft SEP-2640
Tested
false
Limits
Skills
5
Catalog Pages
10
Files Per Skill
100
Skill Md Bytes
262144
Supporting File Bytes
1048576
Skill Bytes
5242880
Scan Archive Bytes
8388608
Verification
per-resource digest
catalog/frontmatter equality
safe unique paths
import size limits
Stable Manifest Size Verification
not documented; enforcing import limits is separate from comparing manifest size
Decoded embedded JavaScript for gate, manifest parser, loader/cache, failure refresh and generic resource tool; sanitized observations only; no wire/model probe.
Observations
Feature accessor tengu_mcp_skills defaults false; effective rollout and host wire behavior were not inspected.
Loader requires server extension identity and parses required resources manifests with per-file URI, SHA-256 digest and nonnegative integer byte size; dynamic entries are declined.
Manifest validation requires SKILL.md, rejects repeated or out-of-root resource URIs, bounds files to 512 and total declared bytes to 16 MiB.
SKILL.md retrieval is deferred to command invocation. Text is UTF-8 encoded and blobs decoded; exactly one matching resource content item is required.
SKILL.md raw bytes are checked for manifest size and SHA-256; cached bytes are rechecked before reuse. Parsed frontmatter is compared with catalog frontmatter using deep equality.
Failed SKILL.md load calls getMcpSkill for the listed URI; a changed valid entry replaces the served entry and asks the user to invoke again. This is a traced call site, not evidence of arbitrary unlisted URI discovery.
Discovery caps at 100 accepted entries and 20 pages. Commands remain server-qualified and source:mcp; directoryRead capability is carried in mcpResourceRoot.
The inspected generic ReadMcpResource tool returns resources/read text or decoded blobs without manifest verification in that tool body. No traced all-file verification/approval path or end-to-end activation proof was established.
Cursor Agent, documentation review, View evidence
Conditions
Current MCP documentation establishes generic resources, not a version-specific MCP Skills loader.
Unknowns
No host wire exchange or model activation probe was run; source findings do not establish account rollout.