A skill is a packaged workflow, the third building block of an MCP-first system (Prompts / Workflows). It guides an agent through a multi-step process without requiring it to click through interfaces.
The following example skills operate the MCP server itself: creating, controlling, and auditing it. Crucially: these skills follow the same rules they enforce. Every risky step carries a risk level, write and critical steps are behind a confirmation gate, and every action produces an audit event.
Create
mcp.scaffold_server Bootstraps a capability-first MCP server: domain actions first, typed schemas, policy engine, risk metadata, and audit, before any interface is built.
trigger "Create an MCP server for …" Create
Ablauf
- Model domain actions, business logic stays in the domain, not in the server. Low
- Generate typed input, output, and error schemas for each action. Low
- Assign a risk level and confirmation policy to each tool. Medium
- Wire up the policy engine (can(user, action, resource, context)) and audit events. Medium
- Generate server as an adapter: discovery, schema exposure, policy checks, audit logging. High
- Register write and critical tools only after explicit approval. Critical ⏸ Freigabe
capability.add Adds a new capability according to the tool contract standard. Nothing is registered without a complete contract.
trigger "Add a tool/resource for …" Create
Ablauf
- Clarify user intent and category; check existing capability as a template. Low
- Define input/output/error schema and required scopes. Low
- Set risk level, side effects, and audit event. Medium
- Determine confirmation policy (autonomous, confirmation, step-up, four-eyes, not for AI). Medium
- Provide a dry-run mode for risky tools. Medium
- Register capability and enable it in discovery. High ⏸ Freigabe
Control
mcp.control_visibility Controls tool visibility per user, client, tenant, role, and scope, already at discovery, not only at call time.
trigger "Which tools may agent X see?" Control
Ablauf
- Resolve identity and context: user, MCP client, agent identity, tenant. Low
- Calculate effective permissions (user + agent + client trust + resource sensitivity). Low
- Filter tool list to allowed capabilities; do not deliver forbidden tools at all. Medium
- Adjust confirmation policies per role. High ⏸ Freigabe
mcp.connect_client Connects an MCP client in a controlled way: OAuth 2.1 authorization code with PKCE, allowlist, short tokens, refresh rotation.
trigger "Connect client … to the MCP server" Control
Ablauf
- Check client against the allowlist; validate redirect URIs. Medium
- Set up OAuth 2.1 + PKCE, configure short access token lifetimes. High
- Grant minimal scopes (least privilege), enable refresh rotation. High
- Activate client, with admin step-up auth. Critical ⏸ Freigabe
Audit
mcp.audit_trail Read-only review: reads audit trail and risk coverage, runs through the MCP-first checklist, and reports gaps. Changes nothing.
trigger "Audit the MCP server against MCP-first" Audit
Ablauf
- Read capability inventory and their risk levels. Low
- Check audit events for completeness and redaction of sensitive inputs. Low
- Flag tools without risk classification or confirmation policy. Low
- Cross-check forbidden-for-AI capabilities against actual visibility. Low
- Output findings as a structured report, no write action. Low
mcp.harden_security Checks and increases protection: protection classes, step-up coverage, redaction, rate limits, and prompt injection protection. Changes require approval.
trigger "Harden the security of the MCP server" Audit
Ablauf
- Check sensitive areas and protection classes per resource/tool. Low
- Verify step-up auth for critical tools; propose missing ones. Medium
- Check redaction rules and context filtering for AI access. Medium
- Evaluate rate limits and prompt injection protection. High
- Apply policy changes, with admin approval (four-eyes). Critical ⏸ Freigabe
Build capabilities once. Expose them everywhere, including the skills that operate the server itself.