Execution and isolation

Every call to a tool from one of your MCP servers, and every skill script, runs in a runtime. The endpoint your agent connects to runs neither. This page follows one call from the agent to the target system.

A tool call, step by step

1. The agent calls a tool on the Skilder MCP endpoint. Its credential resolves to one user and one workspace.
2. The endpoint checks the session and sends the call over the message bus.
3. The runtime assigned to that workspace picks the call up and matches it against the tools it holds.
4. The runtime invokes the target MCP server or runs the script, and returns the result on the bus.
5. The control plane records the call in Activity with its status, timing and payloads.

A workspace runs on one runtime, and a shared runtime serves several workspaces. Every call carries the workspace it was issued for. The runtime serves a tool only when the MCP server behind it belongs to that workspace.

Script containment

A skill script runs in its own process, inside the runtime container. The runtime bounds it:

• Its code is written into a temporary directory created for that execution and deleted when it ends.
• Its environment is built from an allowlist. The runtime's own key is not in it.
• It stops at 30 seconds, and at 5 minutes for a script that keeps calling back into Skilder.
• Its output is capped at 10 MB.

Credentials

The control plane holds the credentials of your MCP servers and delivers them to the runtime that runs the server. Skilder never puts them in a tool definition or a tool result. They never reach the agent or the model behind it.

When the control plane acts on your behalf, it mints a short-lived signed assertion, not a lasting credential. Skilder never stores it. Membership is checked again on every connection, so a member who loses access is refused.

Where a runtime runs

A runtime is a container. Skilder operates shared and dedicated runtimes in its cloud.

A runtime can also run on infrastructure you operate. It connects out to the control plane over the message bus. The systems it reaches never need to accept an inbound connection from Skilder.

Next

• Security and data, for identity, encryption and hosting.