Skills over MCP: How to Serve and Check Skill Files

Skills over MCP lets a server share a SKILL.md instruction file and the reference files it uses. A compatible host can find the skill, fetch its files and load the instructions when needed. For example, a release-review skill might tell an assistant which version details to check and include a checklist in a second file.

The extension is released, and SEP-2640 is Final. It uses MCP Resources to deliver files. The host still needs to support Skills explicitly: being able to read a resource does not mean it will recognize or load a skill. Extension overview, release status.

The example below serves two files and checks them with Inspector. One command verifies the original files; a second detects a deliberately changed file. It gives you a way to check file delivery before trying the skill in a host.

When to use Skills, tools, resources or prompts

When to use Skills, tools, resources or prompts comparison table

You want to provide	Use	Example
An operation the caller can invoke	A tool	Look up the team responsible for a service.
Data at a known URI	A resource	Read a release record.
A reusable set of messages	A prompt	Prepare a review request for the user to select.
Instructions with supporting files	A skill	Explain how to review a release and supply its checklist.

A skill can describe when to call a tool, but the tool keeps its own permissions. See tools, resources and prompts for examples of the three core interfaces.

A2A uses the name AgentSkill for capability information in an Agent Card. That tells a caller what an agent can do; the SKILL.md package described here contains instructions and files. The MCP and A2A comparison explains how the protocols use these terms.

Discover the package before reading its files

The server declares resources and the io.modelcontextprotocol/skills extension. A client using Skills also declares its support. It can then:

1. Call skills/list to get the available entries.
2. Call skills/get with a SKILL.md URI to look up or refresh one entry. A complete listing already contains the entry, so this extra call is optional.
3. Call resources/read to fetch the files it needs.

Each entry includes the skill’s frontmatter and a manifest of files, byte sizes and SHA-256 digests. The client can compare a fetched file with that manifest before loading it. Fetching the file alone does not activate the skill; loading and approval happen in the host. The Skills specification also defines an optional directory-reading operation. See server discovery for the capability response.

Client support is a separate question

The official extension matrix, checked on 8 October 2026, marks ChatGPT, fast-agent and MCP Inspector as Partial. Check the documentation for the particular product and account you plan to use. A blank matrix cell does not tell you whether that product has a separate, non-MCP skill feature.

We tested file verification with Inspector 2.10.1. We did not test loading these instructions in ChatGPT or fast-agent. Before using a skill in either host, check how it loads the files, refreshes changed instructions and asks for approval. Inspector’s file checks cannot answer those product-specific questions.

Reproduce the Inspector check

Download skills_server.py and skills_bad_digest.py into the same directory. The first file serves a fictional review-note skill and its checklist. Both files are defined in the Python script; it does not read your filesystem or call an external service.

You need Python and Node 22.19 or newer. We ran the commands on Windows with Python 3.11.9, Node 24.19.0 and Inspector 2.10.1. In the download directory, run:

npx --yes @modelcontextprotocol/inspector@2.10.1 --cli python skills_server.py --protocol-era modern --method skills/list --verify --format json

Inspector should exit with code 0 and report passing checks for both files under skill://review-note/SKILL.md. Look for the file verification results in the JSON output; a list containing the skill name alone would not confirm the hashes.

Then run the altered version:

npx --yes @modelcontextprotocol/inspector@2.10.1 --cli python skills_bad_digest.py --protocol-era modern --method skills/list --verify --format json

This script changes the returned SKILL.md after calculating its manifest. Inspector should reject the mismatch and exit with code 7. Keep the two Python files together: the altered version imports the original server.

Both outcomes were observed in our run and are recorded in the test results. The example tests file retrieval and verification. It does not implement a production service or test whether a model follows the instructions.

For this server, keep --protocol-era modern in the command. Our invocation without it failed with “Required request metadata is missing.” The flag supplied the metadata the server expects. See the Inspector CLI documentation for its protocol modes.

Recognize failures before loading instructions

We also sent requests directly to the example server to check its responses:

Recognize failures before loading instructions comparison table

Request or check	Result	If you get a different result
Discover, list and get the skill	The server declares Skills; list and get return the same entry.	Check the declaration and the skill URI.
Read the two files	Their UTF-8 byte sizes and SHA-256 digests match the manifest.	Compare the returned bytes, including final newlines.
Call a Skills method without declaring client support	Error -32021.	Add the client capability declaration.
Request an unknown skill or file	Error -32602.	Correct the URI or refresh the catalog.
Read the file using only Resources	The content is returned.	Check ordinary resource access separately from skill loading.
Change the file after making its manifest	The digest check fails; Inspector exits 7.	Fetch a consistent entry and file before loading the instructions.

These responses describe the downloadable example. No consumer-host activation test was performed.

A matching digest does not make instructions trustworthy

A SHA-256 digest tells you whether a file matches its manifest. A publisher could provide harmful instructions and a matching digest, so you still need to decide whether to trust the source and allow the requested actions.

The extension identifies a skill by its originating server and URI. Check those as well as its display name, and review tool permissions before loading instructions that call tools. The Skills integrity rules and MCP security guide explain those checks.