Published October 25, 2026 (IST) by the AgentStack News Desk. Facts were checked against the v2.4.0 release notes, the SEP-2640 pull request, the Model Context Protocol skills extension documentation, and our own tests of the release on October 25.
Version 2.4.0 of the Model Context Protocol (MCP) TypeScript software development kit (SDK), released October 23, 2026, lets an MCP server publish a folder of Agent Skills and lets a client list, read, and verify them. It is the first TypeScript release to ship the skills extension.
The feature is called Skills over MCP and comes from Specification Enhancement Proposal (SEP) 2640, which the MCP project merged on September 13, 2026. A server calls loadSkills() and skills.attach(), and a host reads each skill through a new SkillsClient class that checks its size and hash before the agent sees it.
We pointed the 2.4.0 loader at 56 published skills from Google and Anthropic. It served 49 and skipped 7 over frontmatter rules, and the client rejected every altered file we sent through it. This report follows our editorial standards.
TL;DR
- What shipped: MCP TypeScript SDK 2.4.0 on October 23, 2026, with Skills over MCP from SEP-2640 in the server and client packages.
- How it works: a server serves each skill folder as skill:// resources, and the host checks every file against the size and SHA-256 hash in a manifest.
- Our load test: the loader served 31 of 37 Google Data Agent Kit skills and 18 of 19 Anthropic skills, skipping 7 over frontmatter rules.
- Our tamper test: SkillsClient rejected 31 of 31 files with an appended line and 25 of 25 files where one word was swapped at equal length.
- The gap: a host that calls resources/read directly gets altered text with no check, so verification depends on using the client helper.
- What to do: run your skills through loadSkills() before publishing, read them only through SkillsClient, and pin the servers you trust.
What the MCP TypeScript SDK 2.4.0 Release Adds
The 2.4.0 release updates the client, server, core, server-legacy, and codemod packages to 2.4.0, with the Node.js adapter at 2.1.2. Skills over MCP is the headline addition and works on both the 2025-11-25 and 2026-07-28 protocol versions, per the release notes. The skills.attach() call is marked experimental and may change in a minor release.
| Piece | Package | What it does |
|---|---|---|
| loadSkills(folder) | @modelcontextprotocol/server | Reads a folder of skills once at start-up, validates each SKILL.md, and builds a catalog of names, descriptions, and file digests |
| skills.attach(server) | @modelcontextprotocol/server | Registers the catalog on an McpServer so it answers skills/list and serves each file as a skill:// resource |
| SkillsClient | @modelcontextprotocol/client | Lists skills, fetches a SKILL.md or another file, and verifies size, hash, and frontmatter before returning it |
| SKILL_LIMITS | @modelcontextprotocol/core | Caps each skill at 512 files and 16 MiB in total |
The same release carries three upgrade notes. A tool that puts the x-mcp-header annotation on a number parameter is now rejected, as the 2026-07-28 specification requires. Structured output built with z.object().meta() is no longer wrapped in a result field on 2025-11-25 connections, and the bundled JSON Schema validator now refuses an invalid URI scheme in an id or ref.
Other additions include an opt-in scope parameter on OAuth token refresh, aimed at Microsoft Entra ID, which rejects a refresh without one. The version 1 to version 2 upgrade guide also ships as an installable agent skill. Our MCP explainer covers how servers, clients, and resources fit together.
What SEP-2640 Defines for Skills Over MCP
SEP-2640 is an Extensions Track proposal that defines a skill:// resource convention for serving Agent Skills over MCP, under the extension identifier io.modelcontextprotocol/skills. The pull request was opened on April 23, 2026 and merged on September 13 after 54 commits. The documentation lists the extension as Final.
The Skills Over MCP Working Group developed the proposal. Its description lists reference implementations in the Python, C#, and Go SDKs, host prototypes in gemini-cli, fast-agent, goose, codex, and Claude Code, and the GitHub MCP Server, along with conformance tests. TypeScript now joins that set with a released package.
A skill follows the Agent Skills specification: a folder with a SKILL.md file whose frontmatter holds a name and a description of 1 to 1,024 characters, plus optional metadata that maps strings to strings. Our Agentic AI Foundation coverage explains how the Agent Skills format moved to open governance earlier this year.
How Hosts Must Verify Skill Files
The skills extension documentation puts the integrity burden on the host. Hosts must restrict reads to files in the manifest, verify each file’s size, SHA-256 hash, and frontmatter, and must not use content that fails. They must not fetch files ahead of need and must treat all skill content as untrusted input.
The documentation is plain about the limit of those checks: “Digests establish consistency with the server’s manifest, not trust in its content.” A server can publish a harmful skill with a perfect hash. The check only catches a file that changed between the manifest and the read, so trust in the server itself still has to come from somewhere else.
What Happened When We Loaded 56 Published Skills
We installed the 2.4.0 server and client packages on October 25, 2026 and served two public skill sets over standard input and output on an 8 vCPU Intel Xeon machine with Node.js 20.19.2. The sets were Google’s Data Agent Kit plugin at commit 9a49a83, with 37 skills, and the anthropics/skills repository at commit dbd4588, with 19.
The loader skipped 6 of the 37 Google skills and 1 of the 19 Anthropic skills, each with a warning and no error. Four Google skills use a list of tags inside metadata, which breaks the string to string rule. Two others write their description as a multi-line quoted string, which is valid in the frontmatter format but which the SDK parser rejected.
The Anthropic skill that was skipped, claude-api, has a description of 1,077 characters, 53 over the 1,024 limit. After we flattened the Google tags into strings and rewrote the two descriptions on one line, all 37 Google skills loaded and verified. A server operator would only see the skips in the server log, since the client simply receives a shorter list.
| Measure | Google Data Agent Kit | Anthropic skills |
|---|---|---|
| Skills in folder | 37 | 19 |
| Skills served | 31 | 18 |
| Catalog load time | 64 to 103 ms | 135 ms |
| skills/list response | 45,055 bytes | 70,319 bytes |
| SKILL.md bodies of served skills | 312,102 bytes | 183,608 bytes |
| SKILL.md reads verified | 31 of 31 | 18 of 18 |
The list response stays small next to the skills themselves. For Google’s served set, the catalog of names, descriptions, and digests came to 45,055 bytes, against 312,102 bytes of SKILL.md text. The full Google folder holds 184 files and 2.3 MB, and none of that moves until a host asks for a specific file.
Reads were quick. A verified SKILL.md read took a median of about 2.1 to 2.7 ms and a 95th percentile of about 3.7 to 4.3 ms across our runs. The first skills/list call on a 2026-07-28 connection took 313 to 376 ms and later calls took 3 to 5 ms, a start-up cost we did not trace to its cause.
What Our Tamper Test Caught and Missed
We wrote a server that lies. It advertised the honest manifest for the 31 Google skills, then served altered bytes when a file was read. In one run it appended a line telling the agent to fetch a remote script. In a second it swapped the word MUST for MAY, padded so the byte count stayed the same.
SkillsClient rejected all 31 appended files on size and all 25 swapped files on the SHA-256 digest. The other 6 skills had no MUST to swap and arrived unchanged. When we edited a file on disk after the catalog loaded, the honest server refused to serve it and reported that the file had changed since loading.
The gap sits one layer down. A host that skips SkillsClient and calls resources/read on the same skill:// address received the injected line with no warning, because verification lives in the client helper and the protocol call itself carries none. Custom hosts and agent frameworks that wire resources by hand need the helper, or their own copy of its checks.
That matches the pattern in our coverage of MCP tool security bugs and FastMCP client advisories: the protocol defines the safe path, and each host has to take it. Teams that pull skills from third-party servers should also read our LiteLLM supply chain report, since a skill is instructions an agent will follow.
What It Means for Teams Shipping Agent Skills
For teams that already keep skills in a repository, 2.4.0 turns a folder into a network service with one function call, and it puts a catalog of a few kilobytes per skill in front of the model. The MCP servers many teams run today can add skills next to their tools without a separate distribution channel.
The frontmatter rules are the first practical hurdle. Seven of 56 published skills from two large vendors failed them, and the failure is quiet on the client side. Any skill set headed for MCP distribution should go through loadSkills() in a test before release, with the server warnings treated as build errors.
Trust is the second. A matching digest proves a file is the one the manifest named, and says nothing about whether its instructions are safe. Teams should decide which servers may supply skills, route them through the MCP gateways or MCP security tools they already use, and log which skill versions each agent loaded.
Four Steps to Take Before Serving Skills Over MCP
These steps follow from the release notes, the extension documentation, and our two tests. They apply to teams that publish skills, teams that build hosts which read them, and platform teams that approve which MCP servers an agent may connect to, and each one can run in a test environment first.
- Lint your skills: load the folder with loadSkills() and fail the build on any warning, with metadata values as plain strings and descriptions of 1,024 characters or fewer.
- Read through SkillsClient: make sure your host fetches skill files only through the client helper or code that checks size, hash, and frontmatter the same way.
- Pin your servers: allow skills only from servers you control or have reviewed, since a correct digest says nothing about a harmful instruction.
- Track what loaded: record skill names and digests per session so you can trace behavior back to a version, and keep your MCP hosting logs long enough to compare.
Frequently Asked Questions
What is Skills over MCP?
Skills over MCP is an extension of the Model Context Protocol, defined in SEP-2640, that lets a server publish Agent Skills as skill:// resources. A host lists the skills, reads a SKILL.md file when it needs one, and checks each file against a manifest of sizes and SHA-256 hashes before giving it to the agent.
Which MCP TypeScript SDK version supports skills?
Version 2.4.0, released on October 23, 2026, is the first TypeScript release with Skills over MCP. Servers use loadSkills() and skills.attach() from the server package, and hosts use SkillsClient from the client package. It works on the 2025-11-25 and 2026-07-28 protocol versions, and the attach call is still marked experimental and may change.
Why would loadSkills() skip a skill?
In our tests, the loader skipped skills whose frontmatter broke the Agent Skills rules or that its parser rejected. Causes included list values inside metadata, a description longer than 1,024 characters, and a description written as a multi-line quoted string. Each skip produced a server warning, and the client simply received a shorter list.
Does SkillsClient stop a malicious skill?
It stops a skill whose content changed after the manifest was built. In our test it rejected every appended or swapped file. It cannot judge the instructions themselves, and the documentation says digests establish consistency with the manifest, not trust. A harmful skill with a correct hash passes, so server trust still matters.
Is Skills over MCP available outside TypeScript?
Yes. The SEP-2640 pull request lists reference implementations in the Python, C#, and Go SDKs, host prototypes in gemini-cli, fast-agent, goose, codex, and Claude Code, and support in the GitHub MCP Server. The documentation lists the extension as Final, maintained by the Skills Over MCP Working Group, with conformance tests in the project repository.
The Bottom Line
The 2.4.0 release makes skills a first-class MCP resource in TypeScript, and in our tests its client checks caught every altered file we sent. The weak points were quiet frontmatter skips on the server and hosts that bypass the client helper, and both are fixable before a skill reaches production.
We will update this story as hosts ship Skills over MCP outside prototypes. Send corrections through our contact page.
Related coverage: Model Context Protocol, Agentic AI Foundation adds four projects, MCP servers, MCP security tools, and MCP tool security bugs.