Extending the agent: skills, hooks and MCP 🔌

Every coding agent has a baseline capability: read files, execute commands, search code. But real projects need more: connecting to an issue tracker, querying a database, running automatic security checks. Skills, hooks, and MCP are the three ways to extend the agent. The risk is bloating the context with too many extensions, turning a lean tool into a token-consuming machine that adds no value.

The more extensions you activate, the more context you consume. The more context you consume, the less the model understands.

The three extension mechanisms 🔧

Skills 🧩

A skill is a SKILL.md file with specialized instructions that the agent loads when it detects a relevant task. It is the lightest mechanism: no network overhead, no server to start.

Typical structure:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

---
name: security-audit
description: Run security audit on code
globs: ["*.go", "*.ts"]
alwaysApply: false
---
## Instructions
1. Scan for hardcoded secrets
2. Verify OWASP patterns
3. Generate tabular report

When to use them:

• Project-specific rules (style, patterns, conventions)
• Recurring workflows (audit, generation, deployment)
• Knowledge bases the agent should consult

When to avoid them:

• Generic instructions that belong in AGENTS.md
• Skills that require access to external resources (use MCP)
• More than 5-6 active skills simultaneously

Deterministic hooks ⚙️

Hooks are callbacks that execute before or after agent actions. They are deterministic: they do not depend on the model, but on encoded logic. They are the most reliable security mechanism.

Example: PreToolUse hook that blocks git push

1
2
3
4
5

{
  "hook": "PreToolUse",
  "matcher": "bash",
  "command": "echo \"$INPUT\" | grep -q 'git push' && echo 'BLOCKED: git push requires manual approval' && exit 1"
}

Hook lifecycle:

When to use them:

• Blocking operations that should never be automated (git push, deploy, delete)
• Injecting minimal diff rules
• Logging all agent actions for audit trail

When to avoid them:

• Logic that depends on model context (use skills)
• Hooks that require access to external networks (use MCP)

MCP (Model Context Protocol) 🌐

MCP is the open standard for connecting the agent to external data sources and ecosystems. It is the most powerful and heaviest mechanism: each MCP server adds context overhead (500-1000 tokens per exposed tool).

What MCP can do:

• Query SQL/NoSQL databases
• Read/write issues on Jira, GitHub Issues
• Access internal documentation (Confluence, Notion)
• Run end-to-end tests on headless browsers
• Integrate cloud services (AWS, GCP, Azure)

Configuration example:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": { "GITHUB_TOKEN": "..." }
    },
    "postgres": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-postgres"],
      "env": { "DATABASE_URL": "..." }
    }
  }
}

Golden rule: 3-5 active servers. Each server adds tools to the agent’s availability, but every tool consumes context tokens. With 10+ active MCP servers, the agent has so many tools that the model struggles to pick the right one.

Comparative table 📊

How to choose the right mechanism 🧠

    flowchart TD
    A[Need to extend the agent] --> B{External resources needed?}
    B --> Yes --> C[MCP]
    B --> No --> D{Must be deterministic?}
    D --> Yes --> E[Hook]
    D --> No --> F{Have specialized instructions?}
    F --> Yes --> G[Skill]
    F --> No --> H[Use AGENTS.md]
  

Anti-patterns 🚫

• Too many MCP servers — 10+ active servers = saturated context, confused choices, wasted tokens. Keep 3-5.
• Duplicate skills — do not create a skill for what AGENTS.md already does. Unify.
• Hardcoded hooks — do not put conditional logic in hooks. If it depends on context, it is a skill.
• MCP for everything — do not use MCP for local operations. If the file is in the repository, read it directly.
• Neglected security — every MCP server is an attack surface. Validate, pin versions, limit permissions.

Extension security 🔒

Every extension you add to the agent is a potential attack surface. OWASP LLM05 and LLM06 classify supply chain vulnerabilities and excessive agency as critical risks.

Security checklist:

• MCP servers from verified sources (official npm, official GitHub)
• Pinned versions (no latest in production)
• Minimum permissions (read-only where possible)
• No secrets in hook source code
• Periodic audit of installed extensions
• .ignore excluding sensitive files from session

Periodic verification 🔄

Standards evolve rapidly. AGENTS.md, skills, and MCP change frequently. Schedule a semi-annual check of:

• MCP specification updates
• New hook capabilities in your tool
• Obsolete skills to remove
• Compromised or deprecated MCP servers

Series references 📚

• Configuring the repository — AGENTS.md, .ignore, base configuration
• Security and code audit — MCP integration security
• Surviving sessions — context management and compaction