Agents, MCP servers and skills: what each is and when to use one

Workflow or agent?

Anthropic's engineering team draws a useful line. "Workflows are systems where LLMs and tools are orchestrated through predefined code paths." "Agents, on the other hand, are systems where LLMs dynamically direct their own processes and tool usage."

In plain terms: in a workflow, you decide the steps and the AI does each one. In an agent, the AI decides the steps. Agents are more flexible and harder to predict, so start with a workflow and use an agent only when the steps genuinely can't be known in advance.

MCP: connecting AI tools to other systems

The Model Context Protocol (MCP) is a standard way to connect AI applications to other systems. Its documentation names three parts:

A server can offer three kinds of thing. Tools are "Executable functions that AI applications can invoke to perform actions (e.g., file operations, API calls, database queries)". Resources are "Data sources that provide contextual information to AI applications". Prompts are "Reusable templates that help structure interactions with language models".

The specification is clear about who stays in charge: "For trust & safety and security, there SHOULD always be a human in the loop with the ability to deny tool invocations." Hosts should show confirmation prompts for operations. Those prompts only protect you if you read them.

Skills: packaged know-how

Where MCP connects an AI tool to other systems, a skill teaches it how to do a job. Anthropic's documentation: "Agent Skills are modular capabilities that extend Claude's functionality. Each Skill packages instructions, metadata, and optional resources (scripts, templates) that Claude uses automatically when relevant."

Two details matter in practice. "Every Skill requires a SKILL.md file with YAML frontmatter", which holds its name and description. And "until a Skill is triggered, only its name and description occupy context", so the description decides when it's used. Here's a small one we wrote to show the shape; it's an illustration, not something we've published or tested.

---
name: meeting-actions
description: Turn meeting notes into an action table. Use when the user pastes meeting notes and asks for actions or a summary.
---

# Meeting actions

1. Use only the notes. Never add an action that isn't in them.
2. Make a table: Action | Owner | Due date.
3. If an owner or date isn't stated, write TO CONFIRM. Never guess.
4. After the table, list anything unclear as questions.

The risk to understand: prompt injection

Once an AI tool reads things from outside (web pages, emails, documents) and can take actions, a new risk appears. OWASP lists it first among risks for AI applications: "A Prompt Injection Vulnerability occurs when user prompts alter the LLM's behavior or output in unintended ways." The indirect kind is the one that catches people: it occurs "when an LLM accepts input from external sources, such as websites or files."

The MCP security best practices cover further risks for people building servers, including confused deputy problems, token passthrough and scope minimisation. As a user, the practical rules are: grant the narrowest access that does the job, keep confirmation prompts on for anything that sends, deletes or spends, and only connect servers from sources you trust.

Try it

What to remember

• Workflows follow your steps; agents choose their own. Start with a workflow.
• MCP connects AI tools to systems. Skills teach them how to do a job. Both extend what the tool can do, so both need trust.
• Limit what an agent can do. Instructions alone don't stop prompt injection.
• This lesson is researched from documentation. Tools and the MCP specification change; check the current version before you build on it.