skills/ai-platform/api-vs-mcp-decision/SKILL.md
Decide when to call a service via direct API/CLI vs. spinning up an MCP server, based on token cost, scope of use, and integration complexity.
npx skillsauth add bereniketech/claude_kit api-vs-mcp-decisionInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
| Dimension | MCP Server | Direct API / CLI | |-----------|-----------|-----------------| | Token cost | High — full tool schema loads every session | Low — only the call you make | | Discovery | Claude sees all available tools | Claude only does what you wire up | | Flexibility | Any operation the server exposes | Only the endpoints you hardcode | | Setup cost | One-time install, reusable | Per-task wiring | | Best for | Multi-operation workflows, unknown scope | Single known operation, token-tight sessions |
Rule: If you'll use only one endpoint from a service in a given project, use a direct API call. MCP is for breadth of access, not depth.
Do you know exactly which operation you need?
├── Yes → Will you call it more than 3 times per session?
│ ├── No → Direct API call (hardcoded endpoint)
│ └── Yes → Do you need more than 2 operations from this service?
│ ├── No → Direct API helper function
│ └── Yes → MCP server
└── No → MCP server (let Claude discover available tools)
bq query, gh pr list)For a scoped operation, write a small wrapper rather than loading the MCP server:
# Instead of: load full Notion MCP → browse → find → read
import requests
def read_notion_db(db_id: str, token: str) -> list:
headers = {"Authorization": f"Bearer {token}", "Notion-Version": "2022-06-28"}
r = requests.post(f"https://api.notion.com/v1/databases/{db_id}/query", headers=headers)
return r.json().get("results", [])
Rule: One function, one service, one purpose. No MCP overhead for a single known query.
Each MCP server loaded adds roughly:
With 10 MCP servers enabled: up to 30,000 tokens consumed before the first message. Keep active MCPs ≤ 5 for token-sensitive work.
testing
AUTHORIZED USE ONLY: This skill contains dual-use security techniques. Before proceeding with any bypass or analysis: > 1.
testing
Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.
development
Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C/C++/Rust code handling secrets, keys, passwords, or other sensitive data.
development
Comprehensive guide to auditing web content against WCAG 2.2 guidelines with actionable remediation strategies.