Blog · Agents
Skills, plugins and tool servers (MCP) in plain English
Skills, plugins and tool servers are the three common ways to extend what an AI agent can do. A skill is a set of written instructions for a task, a tool server is a small program that gives the agent new actions through a standard called MCP, and a plugin is a package that bundles such things for easy installation.
The names overlap and different products use them slightly differently, so this guide explains each in plain terms, how they fit together, and what to check before adding one.
Start with tools
An AI model can only produce text. To do anything else, the program around it offers tools: named actions with a description and a list of inputs, such as "read a file" or "search issues". The model asks for a tool by writing a structured request. The program carries it out and hands back the result. This loop is what makes something an agent, as covered in what an AI agent is.
Every agent ships with some tools built in. Skills, plugins and tool servers are ways of adding to what it knows and what it can do without rebuilding the agent itself.
Tool servers and MCP
A tool server is a separate program that offers tools to an agent. The agent connects, asks what is available, and receives a list with descriptions. From then on the model can call those tools like any built-in one.
MCP stands for Model Context Protocol. It is an open standard that defines how an agent and a tool server talk to each other. Before a shared standard, every connection between an AI application and an outside system had to be written specially for that application. With one, a tool server written once can work with any agent that speaks the protocol. A common comparison is a universal plug: the device and the socket can come from different makers.
An MCP server can offer three kinds of thing:
- Tools: actions the model can call, such as creating a ticket or querying a database.
- Resources: data the application can read, such as files or records.
- Prompts: ready-made templates a user can choose.
In practice, tools are the part most people meet first.
Servers run in one of two ways. A local server is a program on your own computer, started by the agent application and spoken to directly. It can reach whatever that program can reach on your machine. A remote server runs elsewhere and is reached over the network, usually with a sign-in step so it acts with your permissions in that service.
Skills
A skill is know-how rather than a new ability. In its common form it is a folder containing a Markdown file of instructions, with a short name and description at the top, and sometimes supporting scripts or reference files.
The agent keeps only the short descriptions in view. When a task matches one, it reads the full instructions and follows them. This matters because a model's working context is limited. Loading every procedure all the time would crowd out the actual work, so skills are loaded only when needed.
A skill might describe how your team writes release notes, the steps to produce a spreadsheet in a house format, or how to run and interpret a particular test suite. A skill adds no new abilities by itself. It tells the agent how to use the tools it already has. If it includes scripts, the agent runs them with its ordinary command tool.
Plugins
Plugin is the loosest of the three terms. It generally means an installable package that extends an agent application, and what is inside depends on the product. A plugin may bundle several skills, the settings for one or more tool servers, custom commands, and sometimes small programs that run at set moments in the agent's work.
Think of a plugin as the box that things arrive in. When assessing one, look at what is in the box, because the contents decide what it can do.
How they compare
| Skill | Tool server | Plugin | |
|---|---|---|---|
| What it is | Written instructions, sometimes with scripts | A program offering tools over MCP | A package of extensions |
| What it adds | Knowledge of how to do a task | New actions and data | Whatever it bundles |
| Runs code? | Only if it includes scripts the agent runs | Yes, it is a program | Depends on contents |
| Typical example | "How we write a changelog" | A connection to an issue tracker | A bundle for one kind of work |
A useful way to remember it: a tool server is a new pair of hands, a skill is a page in the handbook, and a plugin is a kit containing either or both.
The risks
Extending an agent is like installing software, because that is what it is.
Code from strangers. A local tool server is a program running on your computer with your user's permissions. A malicious or careless one can read files or send data elsewhere. Install only from sources you trust and, where you can, read the code.
Instructions are an attack surface. The model reads tool descriptions and skill text and tends to follow them. A description could contain hidden instructions, such as telling the agent to pass certain data to another tool. This is a form of prompt injection. Text that a tool returns, such as a web page or a ticket, can carry the same kind of instruction.
Too much authority. A tool server signed in to your account can usually do whatever you can do there. If a read-only option exists and is enough, use it.
Silent updates. An extension that was safe when you reviewed it may change later. Pinning a version means you run the code you checked until you decide to move.
Clutter. Every connected tool adds descriptions to the model's context. Dozens of tools can make an agent slower and worse at choosing the right one.
Practical rules
- Give each agent only what its job needs. A coding agent rarely needs your mailbox.
- Prefer well-known, maintained sources, and pin versions.
- Read what you install. Skills are plain text, so this takes minutes.
- Keep approval steps on actions that send, delete, pay or publish. See designing approvals people do not skip.
- Remove what you no longer use.
- Know where any credentials are stored. See where your AI keys and logins should live.
Where Prism fits
In Prism Desktop, each agent gets only the skills, plugins and tool servers you choose. For Claude Code and Codex there is a "bare mode" that keeps your sign-in and leaves your personal setup behind. The Store offers skills, plugins and tool servers with pinned versions and a consent step before install, and an install is one of the decisions a person approves. More on the approach is on the security page.