The Claude Customization Stack: MCP vs Skills vs Plugins

In about fourteen months, Anthropic shipped three different ways to customize and extend what Claude can do. MCP arrived in November 2024. Skills came in October 2025. Plugins landed January 30, 2026, and promptly wiped $285 billion off software stocks.

Even people who work with Claude every day are mixing these three things up, and I get it. The names are vague, the capabilities overlap, and there’s no clean comparison chart anywhere. I spent some time trying to understand what each one actually does, when you’d want to use it, and where the lines blur.

This is the first post in a three-part series. This one is a basic overview, if you are already familiar with MCP, Skills and Plugins, feel free to skip it. The next two posts go deeper on the security side of things.

MCP: The Plumbing

The Model Context Protocol is an open standard for connecting AI models to external systems. The analogy I keep coming across is USB-C. Build the connector once and it works across Claude, ChatGPT, Gemini, or anything else that speaks the protocol.

The architecture is straightforward. You have a host application (like Claude Desktop), an MCP client inside that host, and MCP servers that expose tools, resources, and prompts. When the client starts up, it connects to whatever servers you’ve configured and asks “what can you do?” Each server responds with its capabilities, and the AI can use them during your conversation.

Under the hood, MCP runs on JSON-RPC 2.0 and borrows ideas from the Language Server Protocol that powers code editors. If you’ve ever installed a VS Code extension that gives your editor support for a new language, you’ve used something conceptually similar.

Adoption happened fast. OpenAI picked it up in March 2025. Google DeepMind followed in April. At the end of 2025, Anthropic donated MCP to the Agentic AI Foundation under the Linux Foundation, co-founded with Block and OpenAI. There are now thousands of community-built MCP servers and official SDKs for every major programming language.

The important thing about MCP is that it’s vendor-neutral. When you build or install an MCP server for Postgres, you’re not locked into Claude. That same server works with any compliant client. This is what makes it plumbing. It’s infrastructure that everything else builds on.

When you’d use it: Any time your AI needs to reach out to a live system. Querying a database, reading files from Google Drive, posting to Slack, interacting with GitHub, pulling data from a CRM. If it involves a real-time connection to something external, MCP is the layer that makes it happen.

Skills: The Knowledge

Skills are folders of instructions that teach Claude how to do specific things. Each one has a SKILL.md file with some YAML metadata and markdown instructions, and can optionally include scripts, reference documents, and template files. Anthropic describes them as “onboarding guides,” which is actually a pretty good way to think about it. You’re writing the documentation you’d give a new hire who needs to learn your team’s processes.

The interesting part is how they load. So that it doesn’t take up your whole context window, Claude only reads the metadata (the name and a short description) at start time. When Claude determines a Skill is relevant to what you’re asking, it loads the full instructions on demand. If the Skill has reference files or scripts, those get pulled in only when needed. This is called progressive disclosure, and it means you can have dozens of Skills installed without burning through your context window.

Skills can also include executable code. If a task is better handled by running a Python script than by having Claude generate tokens, the Skill can bundle that script and Claude will run it directly. The PDF skill, for example, includes pre-written Python for extracting form fields rather than having Claude figure it out from scratch every time.

Anthropic ships pre-built Skills for common document tasks (Word, Excel, PowerPoint, PDF) and a growing set of others. You can create your own too. It’s just a folder with a markdown file and whatever supporting materials you want.

When you’d use it: Any time you want Claude to follow a specific process or apply knowledge it wouldn’t otherwise have. Your company’s code review standards, your brand guidelines, your deployment checklist, your negotiation playbook. Anything you’d otherwise find yourself pasting into every conversation.

Plugins: The Package

Plugins are the latest thing, shipped with Claude Cowork on January 30, 2026. They bundle Skills, MCP connectors, slash commands, and sub-agents into a single installable unit designed for specific job functions.

If Skills are onboarding guides and MCP is plumbing, Plugins are the finished product you hand to a team. A legal plugin might include a Skill with your NDA review playbook, MCP connectors to your document management system, slash commands like /triage-nda and /review-contract, and instructions for how Claude should handle different risk levels. A sales plugin might connect to your CRM via MCP, include Skills for your prospecting workflow, and expose commands for research and follow-up drafting.

Anthropic released some starter plugins covering legal, sales, finance, data analysis, marketing, biology, and a few utility functions. They’re all on GitHub as markdown and scripts. No compiled code, no build steps. The idea is that anyone can fork one, customize it, or build their own from scratch.

When you’d use it: When you need to hand a non-technical team a complete, ready-to-go workflow. The legal team doesn’t want to configure MCP connectors and write SKILL.md files. They want to install one thing and have /review-contract work against their playbook. Plugins are the distribution format.

How They Layer

These three aren’t competing options. They’re layers in a stack.

MCP is the transport. It handles the connection between Claude and external systems. Skills are the instructions. They tell Claude how to do things. Plugins are the product. They package both together with commands and sub-agents into something that feels like installing an app.

A Plugin might include two MCP connectors (one for your document store, one for Slack), a Skill with your team’s review process, and three slash commands. Under the hood it’s all working together. MCP handles the data flow, the Skill provides the methodology, and the Plugin wraps it all in something a non-developer can install and use.

There’s overlap in the middle, too. Skills can reference MCP servers. MCP servers can be built using Skills (there’s literally an mcp-builder Skill for this). You can use Skills without MCP if you don’t need external connections. And you can use MCP without Skills if you just need raw tool access.

Here’s a quick way to think about it:

Need a live connection to an external system? MCP.
Need Claude to follow your specific process or conventions? Skill.
Need to hand a team a turnkey specialist workflow? Plugin.
Need all of the above in one installable package? Plugin (which bundles the others).

What I’m Not Covering Here

Security. Each of these layers introduces distinct attack surfaces, and the research from the last year is worth paying attention to. MCP has documented tool poisoning attacks, rug pulls, and cross-server exploitation. Skills inject instructions directly into Claude’s system prompt, which is prompt injection by design. Plugins inherit all of it while adding Cowork’s file system access and internet connectivity to the mix.

I’m covering MCP security in the next post and Plugin/Skill security in the one after that. If you’re evaluating any of this for production use, the security picture matters at least as much as the feature set.

Where This Is Headed

The customization stack moved fast, but it’s still early. Plugins are weeks old. Cowork is in research preview. The MCP spec just got major updates in November 2025 with async operations, server identity, and a community registry. Skill sharing across orgs is still being built out.

What’s clear is that Anthropic is building toward a world where Claude isn’t just a model you chat with. They would like it to be an agent you equip. MCP gives it hands to reach external systems. Skills give it expertise. Plugins give it a job description.

The question I keep coming back to is the same one I had after watching Claude run a pen test: the capabilities are impressive, but are we building the governance and security frameworks to match? Fourteen months of shipping new extensibility features is a lot. The security research is just now catching up.