SkillHub MCP

What SkillHub exposes over MCP

Approved Skills can appear as MCP tools with names, descriptions, schemas, permissions, and runtime status.

Metadata discovery

Agents can inspect tool metadata before selecting a Skill, reducing blind prompt-only execution.

Runtime invocation boundary

MCP invocation still resolves through project policy, approval state, rate limits, and call permissions and logs.

Permission and policy checks

High-risk permissions, billing preview gates, and restricted states must remain visible before invocation.

REST vs MCP

REST is direct and simple for backends. MCP is stronger when an Agent client needs dynamic tool discovery and structured tool calls.

When MCP is the right choice

Use MCP when an Agent workbench needs to list approved Skills, understand schemas, and call tools dynamically during a task.

• Good fit: internal agent workbenches, coding copilots, research agents, support copilots, and operator consoles.
• Use REST instead when the caller is a predictable backend job or a fixed product workflow.
• Do not expose private credentials or unreviewed Skills through MCP metadata.

Configuration shape

A typical MCP setup points the Agent client at a SkillHub endpoint and passes a project-scoped credential from a trusted configuration store.

• Keep Project Keys outside public browser bundles and prompt text.
• Scope the key to the project and approved Skills needed by the Agent.
• Name tools clearly so the Agent can choose by business task, not vague internal labels.

Call logs

MCP calls should remain auditable. Operators need to see which Agent called which Skill, which policy allowed it, and what result or failure was returned.

• Track tool name, project, caller, timestamp, policy decision, and invocation id.
• Surface policy blocks and permission warnings to the human operator.
• Keep sensitive payload fields redacted in logs and support reports.