Skills vs MCP vs Hooks: Choosing the Right Harness Component
Skills vs MCP vs hooks compared — what each harness component does, when to use which, and how they compose. A decision guide for agent builders: knowledge goes in skills, external access goes through MCP, guarantees go in hooks.
Every agent builder eventually asks the same question: should this be a skill, an MCP server, or a hook? The three are the most-confused components of the agent harness, and picking wrong costs you either reliability or portability. Here's the decision guide.
The One-Table Answer
| Skills | MCP | Hooks | |
|---|---|---|---|
| What it is | Folder of instructions + scripts, loaded on demand | Protocol server exposing tools/resources | Script that fires on lifecycle events |
| Carries | Knowledge & procedure | External access | Guarantees |
| Execution | Model reads and follows | Model calls typed tools | Runs deterministically, model can't skip |
| Reliability | Probabilistic (model-followed) | Structured (typed calls) | Deterministic (always fires) |
| Portability | High — open SKILL.md standard, works across runtimes | High — open protocol, any MCP client | Low — runtime-specific config |
| Best for | How-to knowledge: workflows, conventions, domain procedure | Databases, browsers, SaaS APIs, anything outside the repo | Lint gates, test gates, commit rules, audit logging |
The mnemonic: knowledge goes in skills, access goes through MCP, guarantees go in hooks.
Skills: The Procedure Layer
A skill is the answer to "the agent doesn't know how we do this." Code-review procedure, TDD discipline, your team's API conventions, how to build a slide deck — packaged as a folder with a SKILL.md entry point, loaded only when relevant (which keeps context lean).
Use a skill when:
- The capability is knowledge or method, not system access
- You want it portable across Claude Code, Codex CLI, and other SKILL.md runtimes
- It should be versioned, reviewed, and shared like code
The ecosystem is deep here — Anthropic's official skills for documents and testing, Superpowers for engineering methodology, and a 30,000+ skill directory covering almost every workflow.
MCP: The Access Layer
MCP (Model Context Protocol) is the answer to "the agent can't reach the thing." A Postgres server, a headless browser, your issue tracker, a design tool — an MCP server exposes them as typed, permissioned tools.
Use MCP when:
- The capability is access to an external system
- You need structured inputs/outputs, not free-form text
- Permissions should be scoped per connection
The classic confusion: teams write a skill that says "curl this API with these headers" when an MCP server would give typed calls and centralized auth. Rule: if it has credentials, it wants to be MCP.
Hooks: The Guarantee Layer
A hook is the answer to "the agent sometimes forgets to." Hooks run deterministically on lifecycle events — before/after tool calls, on session start, on stop — and the model cannot decline them.
Use a hook when:
- The rule is non-negotiable: block commits with failing tests, run the formatter after every edit, log every command
- You'd otherwise write "always" or "never" in a prompt
- Compliance must be 100%, not 95%
This is the core harness engineering move: converting probabilistic prompt-following into deterministic enforcement.
How They Compose
Real harnesses use all three on the same workflow. A code-review setup, for example:
- Skill teaches the review procedure — severity levels, what to check, how to report (code-review skills)
- MCP gives access to the PR — diff, comments, CI status
- Hook guarantees the gate — no merge while review findings are unresolved
Remove any leg and the stool falls: no skill → shallow reviews; no MCP → blind reviews; no hook → optional reviews.
Collections increasingly ship the full triad. Everything Claude Code is the reference example — skills, hooks, sub-agents, and commands designed to work as one harness rather than as loose parts.
Decision Flowchart
Is it knowledge/procedure? → Skill
Is it access to an external system? → MCP server
Must it happen every single time? → Hook
Is it a person-shaped role (reviewer,
researcher) with its own context? → Sub-agent
When something seems to fit two: split it. "Query the analytics DB and follow our reporting format" = an MCP server (access) + a skill (format).
Go deeper: Harness Engineering: The Complete Guide · Are Skills a bigger deal than MCP? · Browse skills by use case