Combine Skills and MCP to Close the Context Gap
summary
An experiment at Supabase shows agents that get only MCP produce a Postgres view that silently bypasses row level security by omitting security_invoker flag, while the same agent with MCP plus the skill generates safe SQL. Supabase builds an agent skill.md with critical security rules, points to living docs, and prescribes opinionated schema workflows. Evals run across Claude and GPT families in three conditions over six scenarios and unanimously favor skills plus MCP.
AI-written summary · about
chapters (10)
- 0:00MCP and skills intro
- 1:58Agents need guidance
- 3:01What are skills
- 4:53Superbase skill live
- 5:59Writing product skills
- 7:42Agents skip info
- 9:29Opinionated skill design
- 10:53Testing skills with evals
- 13:23Key takeaways
- 14:33Q&A
related talks
20mAI Agent Skills and MCP: Better Together
12mModel Context Protocol (MCP) and agentic skills
26mWho Let the Agent In? Securing MCP Servers in Production
29mMCP Security: Keep Your AI Agents from Spilling the Tea
27mSkills are the New SDKs
44mSupercharging DevOps with MCP (Without Opening a Security Hole)
51mAgentic AI and Model Context Protocol's Security Vulnerabilities
22mSAFE-MCP: A Security Framework for AI+MCP (Model Context Protocol)