MCP, RAG, and skills solve three different problems
Pull-quote: “Never retrieve anything that has a current value. Retrieval returns a document about the truth; a tool returns the truth.”
Retrieval decides what the model reads, the Model Context Protocol decides how the agent reaches a system, and a skill decides how a task gets done. Three layers, three problems, and each one is useless at the other two jobs. The reason this matters is not taxonomy. It is that confusing any pair produces a specific, diagnosable failure, and teams spend weeks tuning the wrong layer because they never named which layer was broken.
This post is for engineers who have all three in their stack and are not certain which one to reach for next. It defines each in a sentence, then walks the three pairs and names the failure that follows from confusing them in either direction. The definitions come from primary sources: the protocol specification, the skills specification, and the paper that named retrieval-augmented generation. By the end you will be able to place a new requirement in under a minute and recognise all six confusion failures from their symptoms.
What you will be able to do
- Define retrieval, MCP, and agent skills precisely enough to explain each to a sceptical architect.
- Route a new requirement to the right layer using three questions.
- Diagnose all six pair confusions from the symptom rather than from the code.
- Compose all three in one request without any of them doing another’s job.
- Budget the context each layer consumes, since they compete in the same window.
What does each of the three actually do?
Each one answers a different question about a single turn: what should the model read, how does the agent reach a live system, and what is the correct way to perform this task.
Retrieval-augmented generation is a pattern in which the system searches a corpus at query time and conditions the model’s generation on the passages it finds, introduced by Lewis and colleagues in 2020 (arXiv:2005.11401). It is the knowledge layer. Its job is selection: out of ten million tokens of documentation, put the four hundred that answer this question into the window.
The Model Context Protocol is an open standard for connecting AI applications to external systems, maintained at modelcontextprotocol.io with the current specification revision dated 2025-11-25. A client inside a host application connects to servers, and a server exposes three primitives: tools, which the model calls and which can change the world; resources, which are read-only data the application retrieves; and prompts, which are templates the user invokes. It is the access layer. Its job is a stable contract so the agent can reach a system without a bespoke integration for every client.
Agent Skills is an open format in which a folder containing a SKILL.md file packages a procedure an agent loads when a task matches it. The file carries YAML frontmatter with a required name of at most 64 characters and a required description of at most 1,024 characters, followed by Markdown instructions, and may bundle scripts/, references/, and assets/ alongside. The format originated at Anthropic and was published as an open standard in December 2025, with the specification at agentskills.io. It is the procedure layer. Its job is to make the right way to do something reusable instead of re-explained.
Three questions route almost any requirement. Is the answer already written down somewhere? That is retrieval. Does answering require reading or changing a live system? That is a tool, and MCP is how you expose it. Is there a right way to do this that you keep re-explaining to the agent? That is a skill.
What breaks when you confuse retrieval with MCP?
You get stale answers in one direction and a blown context budget in the other, and both failures look like model problems until you check where the bytes came from.
The first direction is indexing a system of record instead of calling it. Someone loads the order table into a vector index nightly because retrieval is the pattern the team already knows. The agent then answers “order 4471 shipped on Tuesday” with total confidence, because that was true when the index was built. Retrieval returns a document about the truth. A tool returns the truth. The rule fits in a review checklist: never retrieve anything that has a current value. Prices, statuses, balances, inventory, permissions, and anything with an updated_at column belong behind a tool call.
The second direction is subtler and more common. You wire up an MCP server, the agent calls a tool, and the tool returns a forty-page policy document as one string. MCP moved the bytes. It did not select them. The relevant clause now sits somewhere in twelve thousand tokens, competing with conversation history, and recall of the middle of that block is worse than recall of either end. Make the tool accept a query and return passages, or treat the document as a corpus and retrieve over it. A tool that returns an unbounded blob has made retrieval your caller’s problem.
What breaks when you confuse MCP with skills?
You add connectivity to fix a procedure problem, or you bury a tool contract inside prose where nothing can validate it.
The first direction is expensive because it feels like progress. The agent completes the task incorrectly, so the team installs three more MCP servers. It now has every tool it could want and still calls them in the wrong order, still skips the approval step, and still cannot reproduce last week’s good run. Adding tools makes it worse, because selection accuracy falls as the catalogue grows and every definition costs tokens on every request, an effect covered in tool design for agents. The identifying symptom: right tools individually, wrong outcome as a sequence.
The second direction is a skill that hardcodes the integration. The SKILL.md says “POST to /v2/claims/{id}/adjudicate with a bearer token from the vault”, welding procedure to transport. It works in one client, breaks silently when the endpoint versions, and validates nothing, because prose has no schema. The division is clean: the tool contract, with its JSON Schema and permission tier, belongs in the MCP server, and the sequence, preconditions, and judgment calls belong in the skill.
One honest caveat. MCP’s prompts primitive and agent skills overlap, because both package reusable instruction. The difference today is control and location: prompts are user-invoked templates served over the wire, while a skill sits on the filesystem and the agent loads it from the description alone. The MCP community has a Skills Over MCP working group, so expect this boundary to move rather than harden.
What breaks when you confuse retrieval with skills?
You put procedure in the knowledge base and get it back in pieces, or you put reference data in a skill and it goes stale.
Putting the runbook in the knowledge base is the more damaging one. A procedure is an ordered whole, and chunking destroys ordering. Retrieval returns steps four, seven, and eleven because those chunks scored highest on similarity, ranked just below a superficially similar incident report from last year, and the model improvises the missing steps with complete fluency. Nothing errors. The output is a plausible procedure that is not your procedure. Retrieval optimises for relevance, and a procedure is not relevant in parts.
The reverse is cheaper but constant. Someone pastes the current fee schedule into a SKILL.md because it was needed once. Skills load whole when activated, so that table enters context every time the skill fires, and it is wrong from the first day the fees change. A skill can point at data instead: “read references/fee-schedule.md before quoting a figure” keeps the pointer in the procedure and the data out of resident context.
How do the three compose in a single request?
They stack in a fixed order: the skill decides the shape of the work, tools fetch live state, retrieval supplies the written knowledge, and the skill’s own rules govern what happens before a write. Here is one turn through a claims agent, with the layer responsible at each point.
- A user asks whether claim 4471 can be approved under the 2026 policy. The claims adjudication skill activates because the request matches its
description, which is the only part of that skill that was resident until now. - The skill’s body enters context and states the order of operations: read the claim, read the member’s coverage, find the governing clauses, check the exclusion list, produce a decision with a citation per clause, and never write without an approval row.
- Two MCP tool calls fetch the live claim record and the current coverage. Both are systems of record, so neither is retrieved.
- Retrieval runs against the policy corpus and returns the two clauses that govern this claim type, with document ids.
- The model produces the decision. The skill’s rule about citations is what makes the output checkable, and the skill’s rule about approval rows is what stops the agent from writing the adjudication itself.
Notice where each failure would land. Retrieve the claim record and you get last night’s status. Skip the skill and the agent produces a decision with no citation and no approval. Put the policy corpus behind a tool that returns everything and you spend the window before you reach step five.
What does each layer cost you in context?
They compete in the same window, and only one of the three is bounded by design. Budgeting them separately is what keeps a long run from degrading in a way that looks like a reasoning failure.
| Layer | What is resident | When it grows | Bounded by |
|---|---|---|---|
| Skill metadata | Name and description of every installed skill, roughly 100 tokens each | Every skill you install | Your install list |
| Skill body | The activated skill only | On activation, then stays | The 500-line guidance in the spec |
| Tool definitions | Every tool exposed in the current phase | Every server you connect | Your allowlist and phase gating |
| Retrieved passages | This turn’s results | Every turn, unpredictably | Only whatever limit you enforce |
Progressive disclosure is why the skills layer stays affordable. An agent loads only the name and description of each installed skill at startup, reads the full SKILL.md body when a task matches, and opens bundled files when the instructions call for them. That three-stage load lets a team keep dozens of skills registered while paying for the few that fire. Tool catalogues have no equivalent by default, which is why phase-based exposure matters, and retrieval has none at all, which is why a per-turn token ceiling is not optional. The accounting is worked through in context engineering as a budget.
Where this goes wrong
Retrieval used as a cache for live data. The symptom is a confidently wrong current value, usually a status or a balance. The cause is indexing a system of record. Move anything with an updated_at column behind a tool call.
A tool that returns an unbounded document. The symptom is context exhaustion on turn three and poor recall of the middle of long inputs. The cause is a tool designed to move bytes rather than answer a question. Give it a query parameter and a result cap.
Servers added to fix sequencing. The symptom is correct individual tool calls in the wrong order, with the approval step missing. The cause is treating a procedure gap as a connectivity gap. Write the skill, and delete tools your trajectories show nobody calls.
Endpoints hardcoded into a skill. The symptom is a skill that works in one client and fails silently after an API version bump. The cause is transport detail living in prose, where no schema validates it. Name the tool in the skill and keep the contract in the server.
A runbook in the vector index. The symptom is a procedure returned out of order with steps missing, and an agent that fills the gaps convincingly. The cause is chunking an ordered whole. Make it a skill.
Reference data pasted into a skill. The symptom is a stale figure quoted with authority, plus context spent on the table every time the skill activates. The cause is data stored where procedure belongs. Keep the pointer, move the data.
Common questions
Do I need all three to build a useful agent?
No. Plenty of production agents use tools and no retrieval, or retrieval and no skills. Add a layer when you can name the failure it fixes: stale answers point at tools, missing knowledge points at retrieval, and a procedure you keep re-explaining points at a skill.
Is MCP required to give an agent tools?
No. MCP is a wire format and a discovery mechanism, and a plain function registry inside your harness works. MCP earns its place when the same tools serve several clients, or when another team owns the server and you want a stable contract between you rather than a shared codebase.
Are agent skills just prompts in a file?
They are prompts in a file with a loading discipline, which turns out to be the whole point. The three-stage load means the agent pays about 100 tokens per installed skill until one matches, and only then reads the body. A prompt library with no discovery metadata and no progressive loading has to be selected by a human or pasted in full.
Can a skill call an MCP tool?
Yes, and that is the intended composition. The skill names which tool to use, in what order, and under what preconditions, while the MCP server owns the argument schema, the permission tier, and the error contract. Keep the sequence in one place and the contract in the other.
How do I tell whether a problem is retrieval or procedure?
Ask whether the correct output is a fact or a sequence. If a knowledgeable colleague would answer by pointing at a document, it is retrieval. If they would answer by walking you through steps in order, with judgment calls between them, it is a skill.
Next steps
Audit one agent against the three questions this week. List everything currently in your vector index and strike out anything with a current value, then list every skill and strike out any reference data inside one. Those two passes usually surface the confusion before you have to reproduce a failure.
Then read tool design for agents, because contract quality in the access layer decides whether the other two ever get a chance. For a scoped MCP configuration with allowlists and a test step before you trust a server, connecting MCP servers to Hermes Agent safely shows the whole file. If the failure you are chasing is retrieval quality rather than layer confusion, agent memory architecture covers semantic, procedural, and episodic memory.
We publish what we test in the open in AI Fieldwork, including the scoping decisions behind the MCP surfaces we run in production, where a short allowlist has consistently beaten a server exposing everything it has.