AI Agent Tool Interfaces: MCP, Function Calling, CLI, Skills
Use function calling when one application exposes a small typed tool set to one model API. Use Model Context Protocol (MCP) when several compatible clients should discover and call a reusable server. Use a CLI when a stable command already exists and text or files are an acceptable boundary. Use a skill when reusable instructions, scripts, and references should teach an agent how to perform a workflow.
These interfaces can compose. A skill may tell an agent when to call an MCP tool, an MCP server may wrap a CLI, and a model may select the call through function calling. The security boundary still belongs to the harness and runtime, not to the interface description.
Last reviewed: 2026-08-10. The comparison favors schema clarity, reuse across clients, transport and deployment cost, least privilege, observability, and maintenance ownership.
Decision table
| Need | Best starting point | Main caution |
|---|---|---|
| Small typed tool set inside one application | Function calling | A valid schema does not authorize the action or make arguments safe. |
| Reusable tools across compatible clients | MCP tools | Server identity, credentials, tool changes, and returned content need separate controls. |
| Existing developer or operations command | CLI | Text parsing, shell injection, environment state, and broad credentials can make the boundary fragile. |
| Reusable workflow instructions and assets | Agent Skills | Instructions can guide tool use but do not provide a transport or permission boundary. |
| Stable in-process logic | Typed function or library API | Do not add a protocol when one codebase owns both sides. |
Function calling
Function calling gives the model named operations with structured arguments. It fits a product-owned harness where tools, policy checks, credentials, and execution live in one application. Keep schemas narrow, validate every argument, and evaluate both tool selection and the resulting side effect.
MCP
MCP separates clients from reusable servers and standardizes discovery and invocation. It is useful when the same integration should work across several compatible agents or applications. MCP does not decide whether a tool call is allowed. Authenticate the server, scope tokens, review tool-definition changes, isolate untrusted servers, and treat results as untrusted input.
CLI tools
A CLI is often the shortest path to mature capabilities such as Git, package managers, cloud tooling, and build systems. Prefer structured output, explicit working directories, non-interactive flags, bounded timeouts, and narrowly scoped credentials. Avoid constructing shell strings from untrusted text.
Skills
A skill packages procedural instructions and may include scripts, references, or templates. It is useful when the hard part is knowing the workflow, not creating a new remote tool. Keep the skill small enough to review, pin external assumptions, and make destructive or external actions explicit.
Selection checklist
- Who owns the client, interface, and implementation?
- Must several clients reuse it?
- Is the input schema narrow and versioned?
- Where are authorization and approval enforced?
- Can untrusted content reach credentials or network egress?
- Are calls, arguments, results, and policy decisions traceable?
- Can a typed library call solve the problem with less surface area?
Deeper reading
- AI Agent Tool Use compares MCP, CLI, skills, code execution, and agent-computer interfaces in depth.
- MCP Server Tutorial builds a typed server and tests it before model integration.
- AI Agent Security covers the controls around every interface.