Skills or MCP servers: when you need a server

I keep hearing that you don’t need MCP servers any more, just use skills. For a lot of jobs that’s right, and it’s usually the simpler answer. It stops being enough once more than one person shares the data behind it.

A skill is really just direction: the prompt, the glue code, the bit of knowledge the model should have and the steps it should follow. And it runs right there in the user’s own context with the user’s own credentials. That’s its strength for a single user: nothing to stand up, nothing to authenticate, it uses whatever access you already have. If the job is “teach the agent how to do this thing” or “wire these two commands together”, a skill is the whole answer and a server would be overhead.

But that same property makes a skill the wrong tool as soon as the data is shared. There’s no caller for it to authenticate, only the user it’s running as. Nobody sits in the middle to show the finance team a set of tools while hiding them from everyone else, and nothing keeps an audit trail over the shared data, since no server is logging who did what. All of that needs something between the user and the system, enforcing the rules in one place, and that’s what an MCP server is.

So the line I draw is about where the enforcement has to live. A skill is the right call when it’s direction or local glue and the trust boundary is the user’s own machine. You want a server once access to the data itself has to be governed, when who can do what is a company rule and not a personal choice. The server is what you point to in a security review when someone asks where the check happens, and a skill just leaves you pointing at the user’s laptop, which won’t get you through that review.

They aren’t rivals, and the better setups use both. File delivery is a good example of the two together. A secured MCP server puts the file in S3 and hands back a short-lived signed link. A small skill tells the agent what to do with it: present the link to the user, mention the expiry, and don’t read the bytes back into context.

Skills got genuinely good, and a lot of that is the models catching up. Hand one a short procedure and a couple of scripts, and it follows the steps and calls the right tool for each one, without me wiring the sequence by hand. For a lot of what I build, that makes a skill the first thing I reach for.

But “you just need skills” quietly assumes one user and their own credentials, and that assumption doesn’t survive the data being shared, which is exactly when you need the server.

Update: I wrote up what that server actually looks like: auth, per-group tool access, audit logging, and the rest of what it takes to put an MCP in front of real company data, in Building and securing MCP servers with FastMCP.