Agent Capabilities and the Tool Supply Chain
Agents gain capabilities through MCP servers, skills, plugins, extensions, packages and SaaS connectors. Each behaves differently at install, at execution and at review. Here's the taxonomy, and why allow-listing alone doesn't govern it.