Skip to content
Stoa Labs

Research · Area 02 of 07

Agent Extensibility & Tooling

Agents are only as capable as the skills, tools, and delegation structures around them, and published capabilities often weaken under measurement: 2026 research found most published skills do not help and a meaningful share actively hurt.

Stoa Labs studies how agents acquire capabilities (Agent Skills, MCP, subagents, and code execution) and how those capabilities should be evaluated, secured, and governed: what an extension lets a capability access, what authority it receives, how quality is measured, and which limits the runtime must enforce.

The layer platform vendors are least incentivized to own is independent, cross-vendor evaluation and trust, and that is where our work sits.

01 · Definition

How agents acquire capabilities

Agents acquire capabilities through the skills that give them procedural knowledge, the protocols that connect them to external systems, the subagents they delegate to, and the command lines and code they execute. In 2026 this became a first-class engineering discipline with its own standards, benchmarks, and open research problems. The field has converged on a layered mental model of the agent tooling surface.

  • Tools and function calling. The base primitive: the model emits a structured call, the harness executes it. Universal, but the thing you want to avoid loading naively at scale.
  • MCP (Model Context Protocol). The de facto standard wire protocol for connecting agents to external systems, now under vendor-neutral foundation governance.
  • Agent Skills. A packaging format (a folder with a SKILL.md file) that gives an agent procedural knowledge and workflows, loaded via progressive disclosure. The framing that stuck: MCP gave agents hands, skills give them judgment.
  • Subagents. Separate agent instances spawned by an orchestrator, each with isolated context, tools, and objective. The unit of parallelism and context isolation.
  • CLIs and code execution. Agents calling ordinary command-line tools, or writing code that calls tools ("code mode"), as an alternative to protocol-mediated calls.

The shared design principle across all of it is progressive disclosure: load names and descriptions first, full detail only on demand.

02 · Why it matters

Context, quality, and trust

  • Context is the scarce resource, and naive tooling wastes it. Loading tool definitions and intermediate results into context does not scale: Anthropic documented a case going from 150,000 tokens of tool definitions to about 2,000 by switching to code execution with on-demand loading, and Cloudflare showed a large API that would consume more than a full context window as naive tool definitions. This is the difference between an agent working and not working, and everything in this area is downstream of it.
  • Standardization moved the value up-stack. MCP now sits under the Linux Foundation’s Agentic AI Foundation, and Agent Skills is a cross-vendor open standard adopted by roughly 40 platforms including direct competitors. When the substrate is standardized, differentiation moves to quality, evaluation, curation, security, and orchestration, which is favorable terrain for a specialist without a platform.
  • The quality problem is unsolved and measurable. The most important empirical finding of 2026: most published skills do not help, and roughly a quarter actively hurt performance. The market is shifting from volume to trust, and whoever can reliably produce, evaluate, and improve capability packages holds defensible value.
  • Extensibility gates enterprise adoption. The bottleneck for organizations deploying agents is not model quality but safe, governable, discoverable connectivity and capability packaging.

03 · Sub-areas

Five sub-areas, one discipline

  1. Agent Skills. The SKILL.md standard and ecosystem: authoring practices, marketplaces and registries, and vertical skill libraries.
  2. Skill optimization and evaluation. The area’s research core: evaluating skills against metrics, benchmarking, detecting negative transfer, and closing the loop between evaluation and skill rewriting so skills improve iteratively and, where safe, recursively.
  3. MCP. Servers, the registry, spec evolution, and the newer surfaces: MCP Apps (interactive UI over MCP, production-ready) and MCP Tasks (async long-running work, redesigned and less mature).
  4. Subagents. Coordination patterns (generator-verifier, orchestrator-subagent, agent teams, message bus, shared state), when multi-agent beats single-agent, and orchestration quality.
  5. CLIs and code mode. Designing CLI tools for agent consumption, the CLI vs MCP decision, and code execution as the token-efficient resolution of both.

04 · Open questions

What we are trying to find out

Exploration-mode questions: pursued to learn something, allowed to not pan out.

  • Can skill evaluation work without deterministic verifiers? LLM judges asked which skill performs better score near random (46.4%), and textual plausibility is divorced from utility. What actually predicts skill quality is under-tooled.
  • Can the gated eval-rewrite loop (proven in benchmark settings by Microsoft’s SkillOpt, +17.6 points average, but dependent on held-out validators) be made cheap and reliable on representative Stoa-owned, public, licensed, or independently synthetic workloads?
  • How do we detect and prevent negative transfer, where an installed skill silently degrades performance, before deployment?
  • Where is the decision boundary for code mode: when does writing code to call tools beat direct tool calls, and when is the sandbox overhead not worth it?
  • How should information flow through subagent orchestration to avoid the orchestrator information bottleneck, and how do we attribute outcomes to agents and decisions?

05 · Directions

What this work could become

Candidate development directions, not commitments or year-one programs.

  • Skill evaluation and optimization tooling (the spearhead). Domain-specific verifiers, a gated optimization harness, regression and negative-transfer detection, and benchmark-style scorecards. The research proves the loop closes; nobody has productized it for real domains.
  • Vertical skill libraries with measured quality. Curated, evaluated, security-scanned skills built from public, licensed, commissioned, or independently developed domain material. Benchmark evidence shows vertical depth beats horizontal breadth, with the largest gains in specialized domains.
  • Tooling architecture practice. Code mode adoption, context budget engineering, and subagent orchestration design as reusable reference architectures.
  • Skill and MCP security analysis. With 36% of tested skills carrying injection vulnerabilities and tool-poisoning attacks succeeding at over 60% against many agents, permission and security analysis may become a concrete module inside an agent security assessment when the named workflow uses these surfaces.

06 · Boundaries

What we deliberately avoid

Competing on catalog size or generic MCP-server building, both commoditizing fast. The layer vendors are least incentivized to solve is independent, cross-vendor evaluation, curation, and trust, and that is where we sit.

07 · Landscape · 2026-07

The landscape, July 2026

Anthropic donated MCP to the Linux Foundation’s new Agentic AI Foundation in December 2025, co-founded with Block and OpenAI. The MCP 2026-07-28 spec revision (release candidate locked in May) is the biggest since launch: a stateless core, a first-class extensions framework, six auth-hardening proposals, and a formal deprecation policy, with breaking changes.

MCP Apps is production-ready across Claude, ChatGPT, Goose, and VS Code; MCP Tasks was demoted from experimental core to an extension and redesigned after production problems, so Apps is currently the more mature surface. Agent Skills is a genuine cross-vendor standard (about 40 platforms, with OpenAI having shipped a near-identical format independently), while marketplaces hold hundreds of thousands of mostly low-quality skills.

The 2026 research cluster (SkillsBench, SkillLens, SkillOpt and successors) established skill evaluation and self-improvement as a distinct subfield: curated skills add real points, bloated ones subtract, and only validator-gated self-editing works. Code mode resolved the CLI vs MCP debate in practice: CLIs for general development work, MCP (often via code execution) for specialized and compliance-sensitive integrations.

Landscape notes are dated on purpose. This layer moves monthly, and we treat any claim older than a quarter as due for reverification.

08 · Sources

Selected sources

  • Agent Skills specification (agentskills.io) and Anthropic’s skills ecosystem
  • SkillOpt (arXiv 2605.23904), SkillLens (arXiv 2605.23899), SkillsBench (arXiv 2602.12670)
  • MCP 2026-07-28 release candidate and the Agentic AI Foundation announcement
  • Anthropic, "Code execution with MCP"; Cloudflare, "Code Mode"
  • Claude, "Multi-agent coordination patterns"
  • Snyk ToxicSkills research; MCPTox benchmark; June 2026 government CSI on MCP security

Where this work goes

This research supplies the methods behind our tooling, skills, and agent security services.

Tooling, Skills & Agent Security, the service All research areas