Truth in IT
    • Sign In
    • Register
        • Videos
        • Channels
        • Pages
        • Galleries
        • News
        • Events
        • All
Truth in IT Truth in IT
  • Data Management ▼
    • Converged Infrastructure
    • DevOps
    • Networking
    • Storage
    • Virtualization
  • Cybersecurity ▼
    • Application Security
    • Backup & Recovery
    • Data Security
    • Identity & Access Management (IAM)
    • Zero Trust
    • Compliance & GRC
    • Endpoint Security
  • Cloud ▼
    • Hybrid Cloud
    • Private Cloud
    • Public Cloud
  • Webinar Library
  • TiPs
  • DRAW

Snyk: AI Coding Tools: Rules, Skills, Hooks & MCP Explained

Snyk
08/08/2026
0 (0%)
Share
  • Comments
  • Download
  • Transcript
Report Like Favorite
  • Share/Embed
  • Email
Link
Embed

Transcript


about AI, and you just nodded along like you knew what they meant but actually didn't, then this video is for you. Here's the thing nobody's telling you. Most people using AI coding tools right now are maybe using one of these four things. It's usually rules, which means they're missing out on a lot of capability that actually makes these tools agentic. And it's not your fault. Even Anthropic's own docs have a dedicated page just for how do these things differ from each other because the confusion is that common. In the next 10 minutes or so, I'm going to give you the cleanest mental model I've found, the one decision framework you actually need, and the most expensive mistake almost everyone makes when setting these up. Let's jump right into it. Okay, before we go deep, here's the quick reference for you. If you only remember one thing from this video, make it this one. Rules are guidelines. Think of them like a style guide you hand the AI at the start of every session. Things like we use TypeScript, we prefer named exports, run tests before committing. Skills are repetitive workflows, the exact steps you want the AI to follow when, say, reviewing code or writing a brand-compliant slide deck. Stuff you don't want to retype into a prompt every single time. Hooks are hard constraints. They're things that must happen, like running a security scan before every commit. There's no judgment calls and no skipping from the AI. MCPs, or Model Context Protocol, are connectors to external systems, plugging the AI into your database or your Slack, your GitHub, so it can actually read and act on real data outside of the chat window. And that's the whole map. Rules, skills, hooks, MCPs. Now, let me give you the one idea that makes all of this click. Here's the insight that locks everything in place. And honestly, this is the difference between using AI tools well and getting burned by them. The thing is, some of these features are probabilistic. The AI tries to follow them, and most of the time it does, but sometimes, usually right when the context starts getting full and you're three steps deep into something complex, it tends to not follow them. Other features, on the other hand, are deterministic. They fire every single time. There's no model judgment, no creative interpretation, no skipping allowed. So which one's which? Well, rules, probabilistic. Claude reads your claude.md file, for instance, and tries its best to adhere to them. Skills, same thing. Claude has to decide a skill is relevant before it even loads. MCPs, the decision to call a tool is also probabilistic, but once that call goes out, the API actually executes. And hooks, fully deterministic. They run on lifecycle events, whether the AI likes it or not. This is the number one mistake I see people make. They write, never push to main in their rules file, and the AI follows it 90% of the time. The other 10%, though, you're explaining to your team why production is on fire. If a rule absolutely cannot be violated, it does not belong in a rules file, contrary to the name. Instead, it belongs in a hook. Memorize that. Now let's actually walk through each one. Rules are the easy one, because most of you are already using them. You just call them by different names depending on your tool. In Claude Code, it's claude.md. In Cursor, it's .cursorrules or the cursor slash rules directory. In Copilot, it's the copilotinstructions.md. There's even an emerging cross tool standard called agents.md. What they all do is the same. It's a markdown file the AI reads at the start of every session and keeps in context the whole time. Use rules for things like describing your tech stack, your naming conventions, build commands, the kind of stuff that's true on every prompt. The catch, though, and almost nobody talks about this, is that rules cost you tokens on every single request. A bloated 500 line claude.md isn't just unfocused, it's actively expensive. In fact, Anthropic recommends keeping it under 200 lines. So if you find your rules file is growing out of control, that's usually a signal that some of that content should be a skill instead. Which leads us to skills. They fix the biggest problem with rules. A skill is a folder. Inside is a skill.md file with metadata and instructions, and optionally, scripts, templates, and a reference doc. Think of it as an expertise package. Not just a prompt, an actual procedure with everything the AI needs to execute it. The killer feature is something called progressive disclosure. At session start, only the skill's name and a short description loads into the context. The full instructions only enter context when the AI decides the skill is relevant. Translation, you can have 100 skills installed and pay basically zero token cost until one is actually triggered. That is a huge deal compared to rules. Use skills for repeatable workflows. The classic example, code review. You don't want to type check for missing error handling or check for n plus one queries every single time into your prompts. You write that once as a skill, name it code review, and from then on, you just say review this PR and the AI pulls in your exact playbook. Same idea for deployment checklists, brand compliant content, internal database query patterns, anything where you'd otherwise paste the same prompt over and over again. Okay, on to MCP. This is the one that sounds the most intimidating is actually the most straightforward. MCP stands for model context protocol. It's an open standard. Anthropic launched it in late 2024. It's now governed by the Linux foundation and supported by open AI, Google cursor, windsurf, basically everyone. The job of MCP is simple. It connects AI tools to external systems like your database, your Slack workspace, Google drive, GitHub, a browser. If you want the AI to read or write data somewhere outside of the chat window, you need MCP. The way to think about it before MCP, every AI app needed custom code to talk to every tool with 10 AI tools and 10 data sources. That's a hundred different integration. MCP collapses that build one MCP server for say your Postgres database and any MCP compliant AI client can use it now. Now here's the nuance. Some videos skip MCPs, give the AI the ability to do something. A skill teaches the AI how to do it. Well, here's a concrete example, an MCP server connects Claude to your Postgres database. That gives it the ability to query, but without a skill that documents your schema and your query patterns, you could write bad queries. The MCP and the skill work together. They're not alternatives. All right, last one. Now hooks a hook is a script. It could be a shell command and HTTP endpoint, a quick prompt to a fast model. It fires automatically on a life cycle event. Some example of those life cycle events are before a tool runs, after a tool runs, when you submit a prompt or when the session ends. The defining property and the reason hooks exist at all is that they are deterministic. They run every time, no AI judgment in the loop. This is where you put the things that must happen. Auto-formatting on every file edit. It's a hook. Blocking dangerous commands like RMRF or force pushes to main. Also a hook. Triggering a security scan after the AI finishes writing code. That's the textbook hook use case. Hooks are how you turn polite suggestions into enforced rules. Please run tests and your claw.md is a hope. A post tool use hook that runs tests is a guarantee. All right, so when someone or you asks, which one of these do I actually need? Here are the four questions to help get a clearer answer. Question one, must it never be violated? If yes, you need a hook. Again, security checks, never pushed to main, blocking destructive commands, anything where if it only works 90% of the time is a disaster. Question number two, does it require connecting to an external system? If yes, MCP. Think again, your database, Slack, GitHub, Google Drive, anything outside the chat. Question three, is it a multi-step procedure or specialized knowledge you'll reuse? If so, it's a skill. Code review, deployment, brand guidelines, database query patterns. Question four, is it general guiding principles like style, conventions, project info? That's your rules file. Claw.md, cursor rules, agents.md, whatever your tool calls it to rule. That's the whole framework. Four questions in that order. Most people skip straight to question four and try to cram everything into rules, and that's exactly why their AI tools feel lacking. Here's where it gets fun. None of these are alternatives to each other. The best setups use all four. Here's a real production stack. Your Claw.md says, we use TypeScript strict mode, run tests with VTest. Your skills folder has a slash deploy, slash code review, and your database schema documentation there. Your MCP servers connect to Postgres, GitHub, and Slack. Your hooks block force pushes and check for security issues on code changes. Each layer does what it's best at. The rules give AI persistent context, the skills give it procedures, the MCPs give it reach, and the hooks give it strict guardrails. The combo here I want you to remember most is skills plus MCP. The pattern goes like this. MCP gives the AI access to your Sentry account. Skill teaches it how your team analyzes Sentry errors. Together, you've got an AI that can pull a real error and propose a fix in your team's exact style. That's the future, and it's available right now. Quick recap, three things to remember. One, four pieces in plain English. Rules are guidelines, skills are repetitive workflows, hooks are hard constraints, and MCPs are connectors to external systems. Item to remember number two, probabilistic versus deterministic. Rules and skills are suggestions that AI tries to follow. Hooks are guaranteed. If something must never be violated, it goes in a hook, not a rules file. That one shift will save you from a real bad day. Number three, they are not competitors. They stack. The best setups use all four of them, and the skill plus MCP combo is where most of that magic happens. Alright, so if you're already using one of these, probably rules, pick the one thing that's annoyed you this week. Maybe you keep retyping the same prompt. Maybe the AI keeps doing something it shouldn't, and add the right tool for that job to fix that problem. That's the whole game. On that note, that does it for this video. If you got value out of it, be sure to like it down below and share with somebody who could put it to use. And if you made it this far, subscribe to the channel so you don't miss out on upcoming videos. Thanks for watching, and happy, safe coding, everyone.

TL;DR

  • Rules are guidelines stored in files like claude.md that AI reads at session start—use for tech stack, naming conventions, and build commands, but keep under 200 lines to control token costs
  • Skills are expertise packages with progressive disclosure that only load full instructions when relevant—ideal for repeatable workflows like code reviews, deployment checklists, and brand-compliant content generation
  • MCP (Model Context Protocol) is an open standard that connects AI tools to external systems like databases, Slack, and GitHub—it provides capability while skills teach the AI how to use that capability effectively
  • Hooks are deterministic scripts that fire automatically on lifecycle events—use them for must-happen actions like security scans, auto-formatting, and blocking dangerous commands, as they execute every time without AI judgment

Understanding AI Coding Tool Components

This tutorial demystifies the four essential components that transform basic large language models into powerful coding agents: Rules, Skills, Hooks, and the Model Context Protocol (MCP). The video addresses widespread confusion around these terms, noting that even Anthropic maintains dedicated documentation to clarify the distinctions. Most developers currently use only one component—typically rules—missing significant agentic capabilities. The presentation introduces a critical framework distinguishing between probabilistic features (where AI attempts to follow guidelines) and deterministic features (which execute without exception), a distinction that prevents costly production incidents.

The Four-Question Decision Framework

The video presents a practical decision framework for selecting the appropriate tool: First, if something must never be violated (like security checks or blocking force pushes to main), it requires a hook. Second, if it needs external system connectivity (databases, Slack, GitHub), it needs MCP. Third, if it's a reusable multi-step procedure or specialized knowledge (code reviews, deployment checklists), it should be a skill. Fourth, if it's general guiding principles like style conventions or project information, it belongs in the rules file. The most powerful implementations combine all four components, with the Skills plus MCP combination enabling particularly sophisticated workflows like pulling real Sentry errors and proposing fixes in team-specific styles.

Chapters

0:00 - AI Coding Terminology Confusion
0:53 - Quick Reference Overview
1:54 - Probabilistic vs Deterministic
2:50 - The Number One Mistake
3:13 - Rules Explained
4:12 - Skills Deep Dive
5:16 - Model Context Protocol
6:31 - Hooks Implementation
7:26 - Four-Question Decision Framework
8:29 - Combining All Four Components
9:24 - Summary and Recap

Key Quotes

2:51 "This is the number one mistake I see people make. They write, never push to main in their rules file, and the AI follows it 90% of the time. The other 10%, though, you're explaining to your team why production is on fire."
4:29 "The killer feature is something called progressive disclosure. At session start, only the skill's name and a short description loads into the context. The full instructions only enter context when the AI decides the skill is relevant."
5:53 "The way to think about it before MCP, every AI app needed custom code to talk to every tool with 10 AI tools and 10 data sources. That's a hundred different integration. MCP collapses that build one MCP server for say your Postgres database and any MCP compliant AI client can use it now."
7:19 "Please run tests and your claw.md is a hope. A post tool use hook that runs tests is a guarantee."

FAQ

What's the difference between rules and skills in AI coding tools?

Rules are persistent guidelines stored in files like claude.md that the AI reads at every session start and keeps in context throughout, costing tokens on every request. Skills are expertise packages with progressive disclosure—only their name and description load initially, with full instructions entering context only when the AI determines the skill is relevant. This means skills are far more token-efficient for repeatable workflows you don't want to retype every time.

When should I use a hook instead of putting something in my rules file?

Use a hook whenever something absolutely cannot be violated. If a rule working only 90% of the time would be a disaster—like security checks, blocking force pushes to main, or preventing destructive commands—it must be a hook. Rules are probabilistic (the AI tries to follow them), while hooks are deterministic (they execute every time without AI judgment). The video emphasizes that writing 'never push to main' in your rules file means it will fail 10% of the time, potentially causing production incidents.


Categories:
  • » Cybersecurity » Application Security
  • » Data Protection
Channels:
News:
Events:
Tags:
  • AI & Machine Learning
  • DevSecOps
  • Application Security
  • Technical Deep Dive
  • How-To
  • AI Coding Agents
  • Model Context Protocol
  • Developer Productivity
  • AI Tool Configuration
  • Code Review Automation
  • Token Cost Optimization
  • Deterministic vs Probabilistic AI
Show more Show less

Browse videos

  • Related
  • Featured
  • By date
  • Most viewed
  • Top rated
  •  

              Video's comments: Snyk: AI Coding Tools: Rules, Skills, Hooks & MCP Explained

              XStreaminars (watch here)

              • Aug
                27

                Becoming Agent Ready with Cyera: Essential Strategies and Insights

                08/27/202601:00 PM ET
                More events

                Industry Events (Sponsor Hosted)

                • Aug
                  13

                  Harnessing AI for Secure Innovation in the Enterprise with Netskope & Omada

                  08/13/202612:00 PM ET
                  More events

                  Upcoming Webinar Calendar

                  • 08/13/2026
                    12:00 PM
                    08/13/2026
                    Harnessing AI for Secure Innovation in the Enterprise with Netskope & Omada
                    https://www.truthinit.com/index.php/channel/2065/harnessing-ai-for-secure-innovation-in-the-enterprise-with-netskope-omada/
                  • 08/27/2026
                    01:00 PM
                    08/27/2026
                    Becoming Agent Ready with Cyera: Essential Strategies and Insights
                    https://www.truthinit.com/index.php/channel/2081/becoming-agent-ready-with-cyera-essential-strategies-and-insights/
                  • 09/02/2026
                    12:00 PM
                    09/02/2026
                    Unified Data Security in Action: Uncover, Analyze, and Resolve Threats
                    https://www.truthinit.com/index.php/channel/2045/unified-data-security-in-action-uncover-analyze-and-resolve-threats/
                  • 09/30/2026
                    04:00 AM
                    09/30/2026
                    AI Command Center: Optimizing Visibility and Control in Your Operations
                    https://www.truthinit.com/index.php/channel/2024/ai-command-center-optimizing-visibility-and-control-in-your-operations/
                  • 11/19/2026
                    01:00 PM
                    11/19/2026
                    360View: Govern, Secure & Recover Your Microsoft 365 Environment
                    https://www.truthinit.com/index.php/channel/2076/360view-govern-secure-recover-your-microsoft-365-environment/
                  Truth in IT
                  • Sponsor
                  • About Us
                  • Terms of Service
                  • Privacy Policy
                  • Contact Us
                  • Preference Management
                  Desktop version
                  Standard version