MCP and Agent Skills in the AAIF: What Google’s Open Standards Update Means

Google Open Source published its discussion of MCP and Agent Skills on November 11, 2026. The story is about how two existing standards fit together under vendor-neutral governance. An agent can load a playbook for a task, then use Model Context Protocol (MCP) to call the tools the playbook describes. Anthropic announced its Agent Skills contribution to the Linux Foundation’s Agentic AI Foundation (AAIF) on October 22.

What did Google actually say?

Google’s article describes the development of portable agent workflows and draws on its experience with MCP Toolbox for Databases. It explains why agent developers need both a way to reach live systems and a way to give agents procedural knowledge. AAIF provides a vendor-neutral home for collaborative standards work. Its governance role does not confer access to an organization’s tools, data, or credentials.

Read the Google Open Source article and the Linux Foundation announcement.

MCP, Agent Skills and AAIF compared

Layer	What it supplies	What the application must still enforce
Agent Skills	Task instructions, references and optional scripts	Review of skill provenance and permission to run scripts
MCP	Client-server protocol for discovering and invoking supported capabilities	Authentication, authorization, input checks and audit policy
MCP Toolbox for Databases	A way to expose configured database tools through MCP	Least-privilege database access, tenant isolation and query limits
AAIF	Governance and a shared venue for open standards	Compatibility tests for each client, server and deployment

A skill can tell an agent to check order history before proposing a support response. The MCP client is the part of the host that connects to the MCP server and requests a permitted operation. The server implements or forwards that operation and the backend enforces its own data policy. Keeping the workflow and execution boundaries explicit makes it easier to change the host or the tools independently.

Agent workflow and tool access.

What changes compared with a proprietary integration?

A team using a private connector often implements an adapter and embeds detailed procedures in each host’s prompts. That can be a good fit for a single environment. When several hosts need the same operation, the team must maintain their schemas and instructions consistently. Shared protocols can reduce duplicated adapter work when the clients support the same features. A skill package can keep a procedure in version control and let a compatible host load instructions when needed.

Portability still has limits. Different clients can expose different authorization, transport and skill-loading controls. Treat a client swap like a dependency upgrade. Check the same tools, arguments, error paths and approvals in the replacement host.

An ASP.NET Core design to try

Imagine a support agent helping with delayed orders. Give the host a reviewed order-triage skill. Expose a narrow order lookup through an MCP server. Use the caller identity to constrain the returned records. If you also expose a cancellation operation, enforce the necessary approval and policy in the application before it mutates an order. A prompt asking the model to request approval is useful guidance. The server must independently enforce the rule.

The MCP specification describes protocol behavior, and the MCP Toolbox repository documents the database integration. If you are new to C# servers, start with ASP.NET PB’s MCP server guide.

What should teams test?

• Confirm the client can discover the expected tools and that unauthorized identities cannot call them.
• Verify that the server derives tenant scope from trusted identity. Treat model-supplied tenant IDs as untrusted input.
• Treat tool responses, documents and skills as potentially untrusted. Review embedded scripts and protect against instructions that request unrelated data or actions.
• Apply limits to query duration and returned rows. Use sanitized fixtures and test server errors, cancellation, and audit events.

FAQ

Did Google launch MCP or Agent Skills in November? The November 11 article discusses the existing standards. The Linux Foundation announced the Agent Skills contribution on October 22.

Can an Agent Skill grant database access? Access comes from the deployed server’s configuration and authorization policy. A skill supplies procedural instructions.

Do you need Toolbox to use MCP in .NET? Toolbox is one integration choice. A .NET application can also use the official MCP C# SDK to implement its own host or server.