AI skills and MCP tools solve different problems. A skill packages instructions and supporting files for how an agent should approach a task. An MCP tool exposes an operation the agent can invoke. Jarvis Skill Gateway governs private skill content and its distribution; Jarvis MCP Gateway governs discovery and live tool access.
That distinction matters when choosing a platform. A team may need consistent review instructions, controlled access to a ticketing system, or both. Approving the instructions does not automatically authorize the ticket operation.
Choose the layer that matches the problem
The Agent Skills format packages a SKILL.md file with optional scripts, references and assets. Skills can therefore contain executable material, not just prose. Review the whole package before distributing it. Our checklist in is it safe to use public agent skills shows what to look for. Both Cursor and Claude Code read this format, so skills are the part of a Cursor setup most likely to carry over; our guide to what maps from Cursor to Claude Code covers the rest. For the file’s required fields and the folders each client scans, see SKILL.md explained.
The MCP architecture defines tools as executable functions offered through a client-server protocol. MCP also supports resources and prompts; it is broader than tools alone. This comparison focuses on reusable skill packages versus invoking a live tool.
| Team need | Better starting point | What still needs a separate control |
|---|---|---|
| Developers follow the same incident-review method | A reviewed skill with instructions and a report template | Quality checks and safe execution of any bundled scripts |
| The assistant reads current incident records | An MCP tool connected to the incident system | Caller identity and access to those records |
| The assistant changes incident status | A write-capable MCP tool with explicit permissions | Approval requirements and business-system authorization |
| The assistant delegates to a specialist agent | An agent integration, such as A2A | Target-agent access, task handling and result review |
An agent-to-agent, or A2A, integration introduces another executing agent. It is not simply a downloaded skill or a renamed database tool. Jarvis’s Agent Gateway addresses that separate access path.
Is a skill registry the same as an MCP registry?
No. A skill registry stores SKILL.md packages: instructions and their supporting files, delivered to coding clients. An MCP registry catalogs servers that expose tools an agent can call. One organization can hold both, but they have different lifecycles and access controls. A skill is reviewed and installed, and it carries no authorization. A tool runs against a live system under an identity and policy. For how an MCP catalog models servers, see enterprise MCP registry architecture.
What does Jarvis provide for each layer?
The Skill Gateway documentation describes private skill resources, authoring through the Registry UI or API, and permissions for viewing, editing, deleting and sharing. Skill Gateway supports GitHub, GitLab and other Git providers. Repository import is read-only and one-way into Registry; Registry does not push edits back to the source. The published GitHub connection setup is a provider-specific example.
Jarvis skills support Claude Code, Codex, Cursor and GitHub Copilot. The AI Skills CLI has claude, codex and copilot modes for personal or project environments. Cursor reads compatible skill directories, including .claude/skills/, and can use content delivered into that layout without a separate cursor mode. Registry manages content and access; verify the complete installed package in each intended client.
For live operations, Jarvis uses two authorization layers: roles define application capabilities, and resource ACLs define access to a particular registered server. Both must allow the protected request. The team still verifies which downstream identity is used and what business operations and records it can access.
A server owner’s disabledTools list applies server-wide to normal discovery and execute_tool. It does not provide different read/write tool grants for each user, and the transparent proxy does not enforce that list. Test the connection route your clients actually use.
| Requirement | Supplied Jarvis capability | Team’s implementation responsibility |
|---|---|---|
| Keep internal skills private | Skill resources with access controls | Decide owners, reviewers and permitted users |
| Reuse approved content across supported clients | Access-aware CLI sync | Choose project/personal scope and a sync schedule |
| Connect to existing business operations | Registered MCP servers behind a gateway | Supply or configure the relevant tool integration |
| Control access to registered servers | Application-role capabilities and resource ACLs | Verify both layers, the connection route and downstream operation/record permissions |
For organizational rollout and maintenance, see private skill management. Here, the decision is which layer performs which job.
The shared skill library guide supplies release, client-adapter and installation tests across Claude Code, Codex and Cursor. For a catalog that also holds live agent services, compare AI agent registries and skill registries before choosing the record model.
Does controlling distribution also control execution?
No. Distribution decides which skill files a developer can retrieve and which managed copies sync. Execution is a separate boundary. When a skill’s instructions call a tool, the call still needs the caller’s identity, the server’s access controls and permission on the downstream system. Each of those layers must allow the request, and an approved skill cannot grant any of them. Keep the two boundaries in separate tests: distribution and sync on one side, runtime tool access on the other.
Example: prepare an incident review without closing the incident
In an illustrative workflow, an engineer asks an AI coding assistant to draft a post-incident review. A private skill supplies the review headings, the team’s severity definitions and a rule to label unknown facts. A registered MCP tool retrieves incident records using an identity with downstream read permission. The incident system also supports status changes, but this identity has no downstream write permission.
The skill helps organize the work. The search tool supplies current evidence. Jarvis’s application capabilities and server ACL determine access to the registered server. The incident system determines which records and actions the configured identity may access.
Now test a deliberate conflict: the skill or the user asks the assistant to close the incident. The incident system’s configured permission should deny that write even if the assistant attempts it. A skill instruction to avoid closing the incident cannot establish this boundary. For an Entra-based rollout, use the two-role MCP access-control test for server access, then verify downstream read/write permissions separately. A server-wide tool switch alone does not prove per-user action separation.
This is also why instructions, credentials and authorization should not be bundled together. A skill should not distribute shared secrets as a shortcut to making its example work.
Check the two lifecycles separately
Skill content changes and runtime access changes are different events. Before rollout, test both:
- Change a skill: sync again and confirm the intended managed files reach each supported client. Check how local edits or naming collisions are handled.
- Remove skill access: check Registry visibility and the next managed sync. Do not assume that already-read content or independent file copies can be recalled immediately.
- Remove runtime access: revoke the relevant server grant or downstream permission, attempt the affected operation again and inspect the actual connection route and result.
- Check the completed work: compare the incident-review draft with the source records. A successful sync or an allowed tool call does not establish answer accuracy.
A successful sync updates the CLI-managed files to match the developer’s current Registry access. Choose how often developers sync; a failed or offline sync has not updated that copy. Separately, check where the coding client sends its context. Hosting Registry privately does not determine where the connected model processes that material.
For the execution boundary beneath a skill, MCP vs function calling follows one operation from model request to server result. The per-user MCP access-control guide explains which permissions must hold even when the instructions request an action. Keep the approved server release in a private MCP registry.
Bring one skill and one tool to the demo
Start with Skill Gateway when the immediate problem is distributing maintained instructions privately. Start with MCP Gateway when the problem is controlled access to business operations. Evaluate both when a repeatable method needs current company data or actions.
Request a Jarvis demo using one representative skill, one MCP server and two users. Ask to see content delivery, permitted/denied server access and downstream operation permissions separately, then test the combined workflow before expanding it.
References
- Agent Skills format overview
- MCP architecture and tools
- Jarvis Skill Gateway documentation
- Jarvis AI Skills CLI documentation
- Cursor skill directories and compatibility
- Jarvis application capabilities and resource ACLs
- Jarvis tool-enablement contract and connection-route limits
- Jarvis MCP Gateway
AI Skills and MCP Tool Questions
Can Jarvis govern both skills and MCP tools?
Yes. Skill Gateway manages private skill content and access-aware distribution. For live MCP access, Jarvis requires the relevant application capabilities and permission on the registered server. Downstream permissions still govern business operations and records. The two layers need separate configuration and tests.
Does an approved skill authorize the tools it mentions?
No. A skill can describe an operation, but tool execution still needs the appropriate identity, gateway policy and downstream-system permissions.
Which clients receive skills through the Jarvis CLI?
Jarvis supports skills for Claude Code, Codex, Cursor and GitHub Copilot. The CLI has claude, codex and copilot modes for personal or project environments. Cursor can discover packages delivered into compatible directories such as .claude/skills/. Verify loading in your chosen client; there is no separate cursor mode.
Does Registry write skill changes back to the Git source?
No. Skill Gateway supports GitHub, GitLab and other Git providers, but repository import is read-only and runs one way into Registry. Registry edits are not automatically written back to the source repository. The published GitHub setup is one provider-specific example.
