Investigate: Script execution over MCP — resources vs. execute_script tool and sandbox model

[olaservo]

Background

Skills today are primarily framed as context (instructions, workflows, reference docs) — but real-world skills often include or reference executable content (scripts, templates, automation). The question is: what's the right MCP mechanism for this?

Questions to investigate

1. Resources vs. tools for scripts: Should executable scripts associated with a skill be delivered as resources (read-only content the agent interprets and runs locally) or exposed via a dedicated tool (e.g., execute_script) that the server runs on behalf of the agent?

2. Execution environment: If the server exposes an execute_script tool, where does execution happen? Options include:

   • Server-side sandbox (server manages execution environment)
   • Client-side sandbox (server delivers script, client executes in a controlled environment)
   • Delegated to an external execution service

3. Trust and security model: Script execution raises trust questions beyond passive skill content. What guardrails are needed?

   • Should skill metadata declare that a skill includes executable content (vs. instruction-only)?
   • How does the user/host consent to execution vs. just reading instructions?
   • How does this interact with MCP's existing trust model (server trust)?

4. Relationship to Sampling with Tools: The "Skills via Sampling" variant (Approach 3 in the repo) proposes execute_script as a tool visible only during a sampling request. What are the tradeoffs vs. exposing it as a regular tool?

5. Scope boundary — skills vs. tools: Is script execution part of the skill itself, or is it a tool that a skill references? This connects to the broader question of whether skills are purely context/instructions or can include executable behavior.

6. Existing patterns in the wild: How do current implementations turning MCP into executable code handle this today? What can we learn from their approaches?

Acceptance Criteria

• Analysis of at least 3 possible execution models (server-side, client-side, hybrid) with tradeoffs
• Security/trust considerations documented
• Survey of how existing implementations handle script-bearing skills
• Recommendation on whether this should be addressed in a MCP Skills Convention v0.1 or deferred
• Findings added to docs/open-questions.md or a dedicated analysis document