Reference
AI coding agent extensions: skills, hooks, MCP servers and plugins
Skills, hooks, MCP servers and plugins are how a coding agent is extended, and most of them are files in a repository or a home folder that the agent reads at start-up. This page lists, for Claude Code and Codex, where each extension point is configured, what it can make run, and what the documentation says about approving it. It is a lookup page: it states what we read and observed, and it marks what we did not cover.
What we checked
| Tool | Version | Sources |
|---|---|---|
| Claude Code | 2.1.306 | The MCP, Skills, Hooks and Plugins pages of the official documentation (MCP and Skills read in full; Hooks read through character 200,000 of about 270,000), claude mcp --help, claude plugin --help, and the runs in the MCP note and the file-access guide |
| Codex CLI | 0.163.0 | The official MCP page, codex --help, codex mcp --help |
The checks were done on October 22, 2026. The Codex pages for skills and hooks were not found at the addresses we tried, so those rows say what the help output shows and nothing more. Gemini CLI is not covered here; see the permission reference.
1. The four extension points
| Extension point | Claude Code | Codex CLI |
|---|---|---|
| Skills | A folder with a SKILL.md, in ~/.claude/skills/, in .claude/skills/ of a project, or inside a plugin. The description stays in context; the body loads when the skill runs. | Not documented here: the page was not found. We do not state where or how. |
| Hooks | Handlers that run at lifecycle events such as PreToolUse. Defined in user, project or local settings, managed policy, plugins, and skill or subagent frontmatter. A handler can be a shell command, an HTTP endpoint, an MCP tool call, a prompt or a subagent. | Hooks exist: codex --help lists an option that runs hooks without persisted hook trust and calls it dangerous. We did not read the hooks documentation. |
| MCP servers | Scopes: local (default), project (.mcp.json at the repository root) and user. Added with claude mcp add. | ~/.codex/config.toml, or a project .codex/config.toml for trusted projects only. codex mcp lists, gets, adds and removes servers. |
| Plugins | A directory that bundles skills, agents, hooks and MCP servers, installed from a marketplace or a folder, at user, project or local scope. claude plugin enables, disables and inspects them. | codex plugin is listed as "Manage Codex plugins". We did not read the documentation. |
2. What each one can make run, and who approves it
| Item | Statement | How we know |
|---|---|---|
| A project MCP server in Claude Code | An interactive session asks before using it. In claude -p it loads without asking. claude mcp get and claude mcp list show an unapproved server as pending and do not connect. | Documentation; and in our runs a server started under claude -p and not under mcp get or mcp list |
A skill's allowed-tools | The listed tools run without a permission prompt during the turn in which the skill is invoked. The documentation says to review the field in skills from a repository before you run Claude Code there. | Documentation |
| A skill's shell injection | The !`command` syntax runs a shell command before Claude sees the skill content. A setting, disableSkillShellExecution, blocks it for user, project and plugin skills. | Documentation |
| A hook in Claude Code | A PreToolUse hook can block a call, by exit code 2 or by printing a deny decision. Exit code 2 takes precedence over an allow in the JSON. | Documentation; and a deny from a command hook worked under claude -p in our runs |
| A plugin in Claude Code | An enabled plugin is part of every session: its skills and agents add their names and descriptions to the context, its MCP servers run, its hooks fire. What it runs, it runs as you. | Documentation |
| An MCP server in Codex | Each server can set how its tools are approved: auto, prompt, writes or approve, with a per-tool override. The page does not state the default. | Documentation |
3. Before you run an agent in a repository you did not write
- Look for the files that configure extensions:
.mcp.json,.claude/(settings, skills),.codex/, and a plugin folder. - Read any
command, hook script andallowed-toolsline as code you are about to run. - For Claude Code, prefer
claude mcp getandclaude mcp listto look at servers, because they did not start an unapproved project server in our run. - Remember that in a non-interactive run nobody can approve. Use a disposable environment for unfamiliar repositories.
What this page does not cover
- Codex skills, hooks and plugins beyond what the help output shows.
- Gemini CLI and other agents.
- Subagents, slash commands and the Agent SDK, other than where the pages above mention them.
- The interactive approval prompts. We ran only non-interactive commands.
References
- Claude Code: MCP, Skills, Hooks, Plugins (read October 22, 2026)
- Codex: Model Context Protocol (read October 22, 2026)
- What happens when a project asks your agent to start an MCP server
- How to keep an AI coding agent away from a file
Before you read
- AI coding agents: permission and safety settings — How Claude Code, Codex CLI, and Gemini CLI ask for approval, limit where the agent can act, and switch safety off, compared from each tool's own help and documentation.
Related notes
- What happens when a project asks your agent to start an MCP server — A project file that lists an MCP server is a command. In Claude Code 2.1.306 it started during a non-interactive run before any approval, and a planted tool-description instruction was not followed in six runs. What we tested, and what we did not.
- How to keep an AI coding agent away from a file — An instruction, a permission deny rule and a hook compared on a dummy .env file, 24 runs of Claude Code: what each stopped, which route got around it, and what only an isolated setup can promise.