Agent tool discovery and skills are reshaping MCP governance

At a glance

What this is: This analysis argues that MCP tool sprawl and ad hoc knowledge injection are becoming governance problems as agents scale across enterprise tools and context.

Why it matters: IAM, NHI, and agentic AI teams need to treat tool discovery and skill loading as governance surfaces, not just usability features, because they shape what agents can see and do.

Context

MCP has moved from a protocol question to an operational governance question. Once agents can reach more tools and more enterprise context, the problem is no longer only whether access is granted, but how the agent discovers, interprets, and chooses among those tools at runtime.

That shift matters for identity governance because tool exposure, knowledge packaging, and task scoping now affect both non-human identity control and agent behaviour. The article frames Anthropic’s tool discovery and Agent Skills work as responses to context overload, but the deeper issue is that enterprises are trying to govern agent action with mechanisms that were not built for dynamic tool choice.

The result is a new control surface around discovery, not just authorization. Security teams that already manage service accounts, secrets, and workload identity now need to ask how much enterprise knowledge should be preloaded, how much should be discovered on demand, and what evidence remains for review after an agent acts.

Key questions

Q: What breaks when agents are given too many MCP tools at once?

A: Agents can lose the ability to choose the right tool cleanly, especially when tool definitions, parameters, and response formats all enter the prompt at once. The result is context pressure, more invocation errors, and more retries, which makes both execution quality and governance visibility worse. The practical fix is to reduce default tool exposure and load capabilities only when they are relevant.

Q: Why does deferred tool discovery change the governance model for agents?

A: Because the agent’s effective capability set is no longer fixed at session start. Discovery mechanisms decide which tools are surfaced, so authorisation now depends on ranking logic, context triggers, and loading rules as well as access grants. That means teams have to govern tool selection as part of the control model, not treat it as a harmless optimisation.

Q: How should organisations govern agent skills in enterprise environments?

A: Treat skills as reusable knowledge packages that need classification, scope limits, and review just like other non-human identity assets. The important decision is not only what the agent can do, but what enterprise context it should be allowed to load in the first place. Skills should be segmented by task and sensitivity so that broad organisational knowledge is not exposed by default.

Q: How do tool discovery and skills affect access review for AI agents?

A: They make review harder if the organisation only tracks static entitlements. An agent may discover tools or load skills only when a task requires them, so the reviewable state shifts from provisioned access to runtime exposure. Security teams should therefore validate both the baseline entitlement and the discovery path that makes additional capability available.

Technical breakdown

Why MCP tool sprawl breaks agent context

MCP lets agents discover and use external tools through a standard interface, but every tool definition consumes context when it is loaded. The article’s example shows the problem clearly: five common servers already expose dozens of tools and tens of thousands of tokens before the task even begins. That creates a scaling issue where the model must reason across too many tool names, parameters, and response shapes at once. The result is not just slower prompting. It is weaker tool selection, more invocation errors, and more retries, all of which increase operational noise and make governance harder to observe.

Practical implication: Treat tool inventory size as a governance input and limit default exposure to the smallest viable tool set.

How deferred tool discovery changes agent behaviour

Deferred tool discovery moves from static loading to selective retrieval. Instead of pushing every tool description into the agent’s context, the client can mark tools so they are fetched only when a likely match appears. In practical terms, that means the agent sees less upfront metadata and resolves candidate tools only as needed. This improves efficiency, but it also changes how access is evaluated because the agent’s apparent capability set is no longer fixed at session start. Governance now has to account for discovery rules, ranking logic, and the trust placed in a tool-selection step that sits between user intent and actual execution.

Practical implication: Review discovery logic as part of authorisation design, not as a separate usability layer.

What Agent Skills mean for enterprise knowledge control

Agent Skills are a file-based way to package organisational knowledge so an agent can load only the skill fragments relevant to the task. The short skill description is always present, while deeper instructions, scripts, or reference material are loaded on demand. That reduces prompt bloat and keeps task-specific context closer to the work. It also introduces a new governance question: which enterprise knowledge is safe to expose as reusable agent context, and which material should stay outside the agent’s discovery path because it is too sensitive, too broad, or too easy to misuse. Skills are therefore a control pattern, not just a convenience feature.

Practical implication: Classify skills by sensitivity and task scope before making them discoverable to production agents.

NHI Mgmt Group analysis

Tool discovery is becoming an identity governance control surface: The article shows that MCP governance is no longer only about who can connect to what, but about what an agent can discover, rank, and select at runtime. That means tool exposure now affects operational identity behaviour, not just interface design. The practical consequence is that discovery logic must be treated as part of the access model.

Context overload creates a governance blind spot, not just a UX problem: When agents are given large tool catalogs, the failure mode is not simply slower prompting. The agent can mis-select tools, misuse parameters, and drift into repeated retries that obscure auditability. That makes tool sprawl an identity operations issue because the control plane no longer matches how work is actually executed.

Skill packaging formalises enterprise knowledge into reusable agent context: Agent Skills turn scattered organisational know-how into modular context the agent can load only when relevant. This is useful, but it also means enterprises are creating a second policy layer for knowledge exposure alongside authorisation. The implication is that knowledge governance and identity governance are now coupled.

Access review assumes a stable entitlement set, and that assumption weakens when tools are discovered on demand: The standing access model was designed for actors whose effective privilege set is known at provision time. That assumption becomes less reliable when an agent can surface new tools mid-task through discovery and skill loading. The implication is that practitioners must rethink where the reviewable state actually lives.

Runtime provenance matters as much as runtime permission: Once tools and skills are fetched selectively, teams need to know not only whether access was allowed, but which discovered capability was presented to the agent and why. That is a governance traceability problem as much as a security problem. Practitioners should expect evidence requirements to move closer to tool selection and context loading.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• Read next: MCP Security Guide

What this signals

Tool discovery governance will become a baseline control: As agents move from static tool lists to on-demand discovery, teams will need to govern not just permissions but selection pathways. That changes the shape of audit evidence because the important question becomes which tools were surfaced to the agent and why, not only whether access existed.

The same pattern will apply to enterprise knowledge packaging. Skills reduce prompt bloat, but they also create a new layer of context management that sits between identity policy and runtime behaviour. Programmes that already struggle with NHI sprawl should expect the same operational pressure to appear in agent skill libraries.

The most important shift is conceptual: review cycles built for stable entitlements will not fully explain dynamically discovered capabilities. If your programme cannot tell when a tool or skill entered the agent’s context, it cannot fully explain the agent’s action path.

For practitioners

• Inventory agent-facing tools Map every MCP server and exposed tool that can enter an agent workflow, then flag which ones are always loaded and which can be deferred or hidden.
• Set discovery boundaries Define which tools may be discoverable by default, which require explicit task context, and which should never be surfaced to general-purpose agents.
• Separate skills by sensitivity Create a review process for skill directories so that operational scripts, brand guidance, and other enterprise context are grouped by sensitivity and task scope.
• Track selection evidence Log which tool was discovered, why it was ranked above alternatives, and what context fragments were loaded before execution.

Key takeaways

• MCP tool discovery is shifting governance attention from static access lists to runtime capability selection and context loading.
• Agent Skills reduce prompt overload, but they also formalise enterprise knowledge as a governed input to agent behaviour.
• Teams that only review baseline entitlements will miss the discovery path that makes extra tools and skills available to agents.

Key terms

• MCP Tool Discovery: The process by which an MCP server or proxy exposes available tools to a caller. If discovery is not filtered by principal and context, it can reveal capabilities that the identity is not actually authorised to use, creating an exposure before execution begins.
• Agent Skill: A reusable package of task-specific knowledge and procedures that an autonomous agent can load when needed. In practice, it separates general awareness from operational detail, which makes enterprise context easier to govern than a single oversized prompt.
• Context Overload: A condition where an agent receives too many tool definitions, instructions, or knowledge sources to reason effectively. The result is higher token usage, weaker tool selection, and a greater chance that the agent will choose the wrong action or misapply a valid one.
• Runtime exposure management: A security approach that prioritises what is actually exploitable in live environments rather than treating every finding as equally urgent. It combines runtime context, asset criticality, and control enforcement so teams can focus on exposure that changes production risk.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.