MCP, Skills, Hooks & Harnesses Explained for AppSec

* Agentic development terms include agent, harness, hook, skill, plugin, and MCP server.
* A model is the AI at the center of an agent, typically an LLM that reads context and requests tool calls.
* A harness runs in the environment, calls the model, and executes tool calls within set limits, containing state like context management, the agent loop, guardrails, and a tool executor.
* An agent is the whole system: model, harness, configuration, and tools working together toward a goal.
* Tools are how an agent acts; some are built into the harness, others come via MCP servers.
* MCP is a standard for agents to connect to external tools, data, and services.
* Rules files and skills are plain-language instructions that shape the agent's planning and coding.
* Hooks are code that runs at set moments in an agent's lifecycle, acting as control points between intention and action.
* Plugins bundle skills, hooks, MCP configuration, and subagents into an installable package.
* The harness holds credentials and permissions, thus defining the blast radius.

The narrative establishes a shift where abstract technological terms are colliding with concrete security requirements, creating friction in architectural planning. The central tension lies between the emergent, opaque nature of agentic systems—which execute code with real-world permissions through orchestrated actions—and the necessity for deterministic, auditable security governance. The components themselves create layers of potential risk: the model’s susceptibility to prompt injection dictates input security; the harness defines execution boundaries and permission scope; tools mediated by MCP servers introduce external dependencies; rules and skills offer contextual guidance that is inherently mutable; and hooks represent the critical enforcement point where abstract policy translates into concrete, verifiable denial or allowance. This structure implies a failure mode if control is not centralized; for instance, if a skill can be introduced from an untrusted source, or if a hook configuration is circumvented, the system's intended security posture dissolves. The move to defining these terms explicitly suggests that managing this complexity requires mapping abstract capabilities (like agentic workflow) onto concrete control mechanisms (like hooks and plugins) to establish accountability across the entire lifecycle, moving beyond simply assessing the AI output to governing the operational environment it inhabits.
Bridge Questions: How can organizations design a governance framework where rules and skills are automatically validated against hook policies before any agent action is permitted? What metrics are necessary to assess the risk introduced by unverified plugins or remote MCP server connections? If hooks fail open, what is the minimum required system state that must remain locked down to prevent uncontrolled execution?