Governance: answer first
Mistral’s announcement connects versioned Studio skills to execution through MCP servers. That reduces copy drift, but the skill, server, tools, credentials, source systems, and actions still need separate authorization.
Review five layers
| Layer | Question |
|---|---|
| Asset | Which immutable skill version, owner, purpose, and label? |
| MCP server | Which endpoint, authentication, transport, tools, and schema? |
| Source system | Which account, data, scopes, rate limits, and terms? |
| Runtime | Which model, agent, workspace, environment, and approval policy? |
| Action | Which reads, writes, messages, spend, or irreversible effects are allowed? |
Start with non-sensitive data, read-only tools, least privilege, and explicit confirmation for consequential actions. Re-authorize whenever scope, data, purpose, destination, account, or cost changes.
MCP testing checklist
Test discovery, authentication failure, denied tool, invalid input, rate limit, timeout, partial result, duplicate request, retry, idempotency, cancellation, audit, and offboarding. Confirm that logs do not leak credentials or sensitive payloads.
Frequently asked questions
Does a versioned skill prevent prompt injection?
No. Treat external content and tool output as untrusted, constrain actions, validate inputs and outputs, and require confirmation where impact matters.
Can one connector account serve every user?
Only if the identity and authorization model explicitly permits it. Automated work should use a scoped user or service account, not impersonate the author.
Where should runtime evidence be reviewed?
Use the Observability and lineage guide.
Official sources
Source check: August 5, 2026.