Claude Code Skills vs MCP vs Plugins: How Skills Work and When to Use Each

The Five Extension Types

Claude Code ships with multiple ways to extend its capabilities. Each solves a different problem:

The confusion comes from overlap. A Plugin can contain Skills. A Skill can use MCP tools. Slash Commands were merged into Skills. Understanding when to reach for each one requires understanding what problem you're solving.

Skills: Token-Efficient Expertise

Skills teach Claude how to perform tasks. They're folders containing a SKILL.md file with instructions, plus optional scripts and resources.

How Skills Work

Skills use progressive disclosure to stay efficient:

1. Metadata scan: Claude loads only names and descriptions (~30-50 tokens per skill)
2. Relevance match: If a skill matches the current task, full instructions load
3. Resource loading: Scripts and files load only when executed

This means you can have 100+ skills installed without impacting context. Claude loads what it needs, when it needs it.

# .claude/skills/code-review/SKILL.md

---
name: code-review
description: Security-focused code review following OWASP guidelines
---

When reviewing code:
1. Check for injection vulnerabilities (SQL, XSS, command)
2. Verify authentication and authorization patterns
3. Look for sensitive data exposure
4. Check error handling for information leakage

Flag issues with severity levels: CRITICAL, HIGH, MEDIUM, LOW

When to Use Skills

• You have repeatable procedures that Claude should follow
• Multiple conversations need the same expertise
• You want domain knowledge without burning context
• The knowledge is about how to do something, not access to something

Bundled Skills

Claude Code ships bundled skills such as /doctor, /code-review, /batch, /debug, /loop, and /claude-api. They are prompt-based: each one gives Claude instructions and lets it run the work with its own tools. Turn them off with the disableBundledSkills setting.

How to Create a Claude Code Skill (SKILL.md Reference)

A skill is a directory named after the skill with a SKILL.md file in it. Create the directory, write the frontmatter, and Claude Code picks up the change in the running session.

Where Claude Code Skills Live

When two skills share a name, enterprise wins over personal and personal wins over project. A skill also wins over a .claude/commands/ file of the same name.

SKILL.md Frontmatter Fields

Every field is optional. Write a description anyway, because Claude uses it to decide when the skill applies. The description and when_to_use text share a 1,536-character cap in the skill listing, so put the main use case first.

# .claude/skills/deploy/SKILL.md
---
name: deploy
description: Deploy the application to production
disable-model-invocation: true
---

Deploy $ARGUMENTS to production:

1. Run the test suite
2. Build the application
3. Push to the deployment target
4. Verify the deployment succeeded

Set disable-model-invocation: true on anything with side effects. Claude should never decide to deploy because your code looks ready.

MCP: External Tool Connections

The Model Context Protocol (MCP) is an open standard for connecting LLMs to external tools and data. It's how Claude accesses GitHub, databases, browsers, and APIs.

How MCP Works

MCP servers expose tools through a standardized interface. When you configure an MCP server, Claude gains access to its capabilities as callable functions.

// ~/.claude/settings.json
{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": { "GITHUB_TOKEN": "your-token" }
    },
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/path/to/allowed/dir"]
    }
  }
}

The Token Problem

MCP tool definitions consume context. A five-server setup with 58 tools can use 55,000+ tokens before any conversation starts. GitHub's official MCP alone uses tens of thousands.

Essential MCP Servers

Rather than installing everything, choose 2-3 servers that match your workflow:

• GitHub: Repository management, PRs, issues, commits
• Filesystem: Secure local file operations with permission controls
• Context7: Automatic documentation lookup for any library
• Playwright: Browser automation using accessibility snapshots
• PostgreSQL: Natural language database queries
• Sequential Thinking: Structured problem-solving for complex tasks

When to Use MCP

• You need Claude to access external systems
• Real-time data is required (not just instructions)
• The tool needs to execute actions (not just provide guidance)
• You're integrating with third-party services

Plugins: Shareable Bundles

Plugins package multiple customizations into distributable units. They bundle slash commands, subagents, MCP configurations, hooks, and skills into a single installable package.

Plugin Structure

my-plugin/
├── .claude-plugin/
│   └── plugin.json    # Metadata and configuration
├── commands/          # Slash commands
├── agents/            # Specialized subagents
├── skills/            # Agent skills
├── hooks/             # Event handlers
├── .mcp.json          # MCP server configs
└── README.md

Installing Plugins

Plugins install directly in Claude Code:

# Install from GitHub
/plugin install github.com/username/my-plugin

# List installed plugins
/plugin list

# Disable a plugin
/plugin disable my-plugin

When to Use Plugins

• You want to share a complete workflow with teammates
• Multiple customizations work together as a unit
• You're distributing through a marketplace
• Team standardization is the goal

Hooks: Automated Actions

Hooks execute shell commands at specific moments in Claude's workflow. They're deterministic—when the trigger fires, the hook runs.

Available Hook Points

• PreToolUse: Runs before tool calls, can block them
• PostToolUse: Runs after tool execution
• PermissionRequest: Runs when permission dialogs appear
• SessionStart: Runs at the beginning of each session

// .claude/settings.local.json
{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Edit",
        "command": "npm run lint --fix $FILE"
      }
    ],
    "PostToolUse": [
      {
        "matcher": "Write",
        "command": "./scripts/notify-slack.sh 'File created: $FILE'"
      }
    ]
  }
}

When to Use Hooks

• Enforcing quality gates (lint before edit, test after write)
• Notifications and logging
• Automatic formatting or validation
• Integration with CI/CD pipelines

Slash Commands: Prompt Shortcuts

Slash commands are templates for frequently-used prompts. They've been merged into the Skills system—a file at .claude/commands/review.md creates /review.

# .claude/commands/pr.md

Create a pull request for the current branch.

1. Run git diff against main
2. Summarize all changes
3. Generate a PR title and description
4. Use gh cli to create the PR

Commands vs Skills

The distinction has blurred. Both create /name shortcuts. The difference:

• Commands: Simple prompt templates, always user-invoked
• Skills: Can include scripts, resources, and auto-trigger based on context

For simple shortcuts, use commands. For anything more complex, use skills.

Head-to-Head Comparison

Token Efficiency Comparison

*Tool Search feature reduces MCP overhead by ~85% through on-demand loading.

Recommended Setup

Based on common development workflows, here's what most developers actually need:

Essential MCP Servers (Pick 2-3)

• GitHub: If you use GitHub for version control
• Filesystem: For any local file operations beyond basic editing
• Context7: For automatic documentation lookup
• Playwright: If you do frontend development or testing

Useful Skills

• Project-specific CLAUDE.md: Your coding standards, architecture decisions
• Code review skill: Security checks, style enforcement
• Deploy skill: Your deployment procedure

Practical Hooks

• Pre-commit lint: Auto-fix formatting before commits
• Post-write test: Run relevant tests after file changes

Example Minimal Setup

// ~/.claude/settings.json
{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": { "GITHUB_TOKEN": "$GITHUB_TOKEN" }
    }
  }
}

// .claude/CLAUDE.md (project root)
# Project: My App
- Use TypeScript strict mode
- Prefer functional components
- Run `npm test` before committing

// .claude/skills/deploy/SKILL.md
---
name: deploy
description: Deploy to production following our release process
---
1. Run full test suite
2. Build production bundle
3. Deploy to staging first
4. Run smoke tests
5. Promote to production

Frequently Asked Questions