What Is an AI Agent? Skills, MCP, and Harnesses Explained
AI agents are all the rage now. You may have feeds of people talking about them already and how all of them are enabling and automating things while your ChatGPT or Claude window seems a bit lacklustre. If that describes where you are and if you want a little bit more illumination into the concept, you’ve come to the right place. Through this series, of which this is post number one, we will try to demystify and clarify concepts that have become commonspeak but have yet to be properly contextualised within the context of a standard user.
What is an agent (and how is it different from a chatbot)?
To begin with, and to keep a throughline of pharma in this first post, we’ll take a parallel with a Clinical Research Coordinator (CRC). A CRC doesn’t just answer questions. The job is to take a data package from the CRO, check it against the CDISC guidelines and protocols, flag discrepancies, notify the right people, log what is found and wait for the resolution before moving forward. It is not a one-and-done. That is how agents work. They do not do one single thing. They are experts at a set of steps and can identify the right course of action. In contrast, a chatbot takes a question and returns a response. There is no orientation towards achieving a goal.
And that is how we can put things for now: chatbots answer questions while AI agents achieve goals.
And to add, imagine if the CRC’s job turned from all those roles to just monitoring an agent working towards the same goals, always watching for new data being dropped into the SFTP server. That is how powerful these things are and can be for any role in any pharma organisation.
What is a skill?
If the agent is the coordinator, her skills are the specific things she is trained to do: read a SAP, apply a CDISC mapping, fill out a deviation form. Skills are the packaged capabilities you give an agent so it can do actual work. In simpler terms, a skill is a set of tools and prompts, a defined module the agent can call: “read this file,” “run this validation check,” “send this notification,” “query this database.” You can give an agent one skill or many. The agent decides which to use based on the task. This is what makes agents composable. You build skills once, and any agent that needs them can use them. A skill for checking CDISC conformance does not need to be rebuilt every time a new project comes along. You hand the agent the skill, and it knows how to use it.
What is MCP?
Just like your email works on an agreed upon standard and just like websites all serve on all web browsers, AI agents now have an agreed upon protocol or set of rules too. That protocol is Model Context Protocol (MCP), which is a sort of contract that the data presented will always look a certain way no matter which service provides it to an AI tool. It is the standard that lets an agent connect to your data and tools. If a skill is a thing an agent can do, MCP is the layer that lets the agent actually reach your systems to do it.
The coordinator analogy holds here too. A study coordinator can only do their job if she can access the trial management system, the document repository, the lab results, and the notification system. MCP is the universal adapter that makes those connections possible, regardless of what those systems actually are. Without MCP, an agent is isolated. It can reason about things, but it cannot touch anything. With MCP, the agent can reach into your EDC, your document store, your data pipeline, or your notification system and do actual work.
The important thing for pharma teams is that MCP connections are defined and controlled. You decide what the agent can see and touch. You do not hand the agent the keys to everything. You configure the connections it needs, and it operates within those boundaries. It is strictly on a need-to-know basis: as it should be.
What is a harness?
The harness is the system that makes agents reliable enough to trust in a regulated environment. A single agent interaction is interesting. A harness that runs agents repeatedly, handles failures, keeps audit records, and enforces rules is what makes that interesting thing production-ready. Think of the harness as the clinical operations infrastructure around the coordinator. They can do their job, but they operate inside a system: there are SOPs that govern their process, logs that record what she did, escalation paths when something goes wrong, and controls that prevent them from going off-script. Without that structure, their individual capability does not add up to a reliable process.
A harness does the same for agents. It runs the agent, monitors what happens, retries when something fails, logs every step, and enforces the rules you have set. When you are asking whether AI is appropriate in a regulated workflow, you are really asking whether the harness around the agent is sufficient. It is not the agents that are secure inherently; it is the harness around them that enforces said security.
Putting it together
| Term | What it is |
|---|---|
| Agent | Software that takes actions toward a goal |
| Skill | A packaged capability the agent can use |
| MCP | The protocol that connects the agent to your systems |
| Harness | The infrastructure that makes agents reliable |
A useful agent in pharma is all four working together. The agent has a goal. It has skills that let it do specific things. It has MCP connections that let it reach your actual systems. And it runs inside a harness that makes the whole thing auditable and trustworthy.
