diff --git a/agents/README.md b/agents/README.md
index 2b4b20b..69ecc57 100644
--- a/agents/README.md
+++ b/agents/README.md
@@ -26,6 +26,17 @@ description = "Expert software engineer. Reads, writes, and analyzes code."
 author = "librefang"
 module = "builtin:chat"              # runtime module — builtin:chat for all current agents
 
+# Resource allowlists — keep these small. The kernel injects every entry's
+# tools/skills into the agent's prompt on every LLM call, so an empty list
+# (the default "all available" semantics) on an instance with many MCP
+# servers and skills can burn 30-60k tokens per turn on definitions the
+# agent never uses.
+mcp_servers = ["memory", "git", "github", "filesystem"]   # [] = all available
+skills = ["rust-expert", "python-expert", "git-expert"]   # [] = all available
+# max_history_messages = 60          # OPT-IN override; omit to inherit kernel default
+                                     # (default rises with the kernel; setting too low
+                                     #  thrashes the prompt cache — measure before pinning)
+
 [metadata.routing]
 aliases = ["write code", "fix bug", "implement feature"]    # exact activation phrases
 weak_aliases = ["refactor", "patch", "code change"]         # keyword hints
@@ -171,8 +182,9 @@ Agents can also be used as base templates in a Hand by setting `base = "coder"`
 2. Set `module = "builtin:chat"` unless you have a custom runtime module.
 3. Write a focused `system_prompt` — clear role definition, methodology, and constraints.
 4. Declare only the tools and capabilities the agent actually needs.
-5. Add `[metadata.routing]` aliases so the router can activate the agent by intent.
-6. Run `python scripts/validate.py`.
-7. Submit a PR.
+5. Set `mcp_servers` and `skills` to the minimum the prompt actually references — leaving them empty falls back to "all available", which on a populated instance bloats every LLM call with tool definitions the agent never uses.
+6. Add `[metadata.routing]` aliases so the router can activate the agent by intent.
+7. Run `python scripts/validate.py`.
+8. Submit a PR.
 
 See [CONTRIBUTING.md](../CONTRIBUTING.md) for the full guide.
diff --git a/agents/academic-researcher/agent.toml b/agents/academic-researcher/agent.toml
index 7dccb97..c6c3190 100644
--- a/agents/academic-researcher/agent.toml
+++ b/agents/academic-researcher/agent.toml
@@ -5,6 +5,14 @@ author = "librefang"
 module = "builtin:chat"
 tags = ["research", "academic", "papers", "literature-review", "science"]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "fetch", "exa-search", "brave-search"]
+skills = ["technical-writer", "writing-coach", "pdf-reader"]
+
+
+max_history_messages = 80
 [metadata.routing]
 aliases = [
   "academic research",
diff --git a/agents/analyst/agent.toml b/agents/analyst/agent.toml
index 8496c05..1130bda 100644
--- a/agents/analyst/agent.toml
+++ b/agents/analyst/agent.toml
@@ -4,6 +4,14 @@ description = "Data analyst. Processes data, generates insights, creates reports
 author = "librefang"
 module = "builtin:chat"
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "sqlite-mcp", "postgresql"]
+skills = ["data-analyst", "sql-analyst", "python-expert"]
+
+
+max_history_messages = 80
 [metadata.routing]
 aliases = ["analytics", "metrics analysis", "report analysis"]
 weak_aliases = ["kpi", "insights", "reporting"]
diff --git a/agents/architect/agent.toml b/agents/architect/agent.toml
index b0fd0f3..e45ccc7 100644
--- a/agents/architect/agent.toml
+++ b/agents/architect/agent.toml
@@ -5,6 +5,14 @@ author = "librefang"
 module = "builtin:chat"
 tags = ["architecture", "design", "planning"]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "fetch", "github"]
+skills = ["openapi-expert", "technical-writer"]
+
+
+max_history_messages = 80
 [metadata.routing]
 aliases = [
   "system design",
diff --git a/agents/assistant/agent.toml b/agents/assistant/agent.toml
index f58f9d7..f5195bb 100644
--- a/agents/assistant/agent.toml
+++ b/agents/assistant/agent.toml
@@ -12,6 +12,14 @@ tags = [
   "productivity",
 ]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "fetch", "filesystem"]
+skills = []
+
+
+max_history_messages = 120
 [metadata.routing]
 aliases = [
   "general help",
diff --git a/agents/code-reviewer/agent.toml b/agents/code-reviewer/agent.toml
index 5a962d4..99fdfb2 100644
--- a/agents/code-reviewer/agent.toml
+++ b/agents/code-reviewer/agent.toml
@@ -5,6 +5,14 @@ author = "librefang"
 module = "builtin:chat"
 tags = ["review", "code-quality", "best-practices"]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "github", "git"]
+skills = ["code-reviewer", "rust-expert", "python-expert", "typescript-expert"]
+
+
+max_history_messages = 80
 [metadata.routing]
 aliases = [
   "code review",
diff --git a/agents/coder/agent.toml b/agents/coder/agent.toml
index 4185e52..6275019 100644
--- a/agents/coder/agent.toml
+++ b/agents/coder/agent.toml
@@ -5,6 +5,20 @@ author = "librefang"
 module = "builtin:chat"
 tags = ["coding", "implementation", "rust", "python"]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "git", "github", "filesystem"]
+skills = [
+  "rust-expert",
+  "python-expert",
+  "typescript-expert",
+  "git-expert",
+  "shell-scripting",
+]
+max_history_messages = 80
+
+
 [metadata.routing]
 aliases = [
   "write code",
diff --git a/agents/customer-support/agent.toml b/agents/customer-support/agent.toml
index b048af2..5e15686 100644
--- a/agents/customer-support/agent.toml
+++ b/agents/customer-support/agent.toml
@@ -12,6 +12,14 @@ tags = [
   "resolution",
 ]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "fetch"]
+skills = ["email-writer", "writing-coach"]
+
+
+max_history_messages = 60
 [metadata.routing]
 aliases = [
   "customer support",
diff --git a/agents/data-scientist/agent.toml b/agents/data-scientist/agent.toml
index aabca5e..c13003d 100644
--- a/agents/data-scientist/agent.toml
+++ b/agents/data-scientist/agent.toml
@@ -4,6 +4,14 @@ description = "Data scientist. Analyzes datasets, builds models, creates visuali
 author = "librefang"
 module = "builtin:chat"
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "sqlite-mcp", "postgresql"]
+skills = ["data-analyst", "ml-engineer", "python-expert", "sql-analyst"]
+
+
+max_history_messages = 80
 [metadata.routing]
 aliases = ["data science", "build model", "train model", "machine learning"]
 weak_aliases = ["modeling", "statistics"]
diff --git a/agents/debugger/agent.toml b/agents/debugger/agent.toml
index 27d6ce3..0010a41 100644
--- a/agents/debugger/agent.toml
+++ b/agents/debugger/agent.toml
@@ -4,6 +4,14 @@ description = "Expert debugger. Traces bugs, analyzes stack traces, performs roo
 author = "librefang"
 module = "builtin:chat"
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "git", "github", "sentry"]
+skills = ["rust-expert", "python-expert", "shell-scripting"]
+
+
+max_history_messages = 80
 [metadata.routing]
 aliases = [
   "debug this",
diff --git a/agents/devops-lead/agent.toml b/agents/devops-lead/agent.toml
index 0035951..25142d8 100644
--- a/agents/devops-lead/agent.toml
+++ b/agents/devops-lead/agent.toml
@@ -4,6 +4,23 @@ description = "DevOps lead. Manages CI/CD, infrastructure, deployments, monitori
 author = "librefang"
 module = "builtin:chat"
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "git", "github", "filesystem"]
+skills = [
+  "docker",
+  "kubernetes",
+  "terraform",
+  "ansible",
+  "ci-cd",
+  "helm",
+  "prometheus",
+  "sysadmin",
+]
+max_history_messages = 60
+
+
 [metadata.routing]
 aliases = [
   "ci cd",
diff --git a/agents/doc-writer/agent.toml b/agents/doc-writer/agent.toml
index c567540..d5c84cd 100644
--- a/agents/doc-writer/agent.toml
+++ b/agents/doc-writer/agent.toml
@@ -4,6 +4,14 @@ description = "Technical writer. Creates documentation, README files, API docs,
 author = "librefang"
 module = "builtin:chat"
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "filesystem", "fetch", "github"]
+skills = ["technical-writer", "writing-coach", "openapi-expert"]
+
+
+max_history_messages = 60
 [metadata.routing]
 aliases = [
   "write documentation",
diff --git a/agents/email-assistant/agent.toml b/agents/email-assistant/agent.toml
index 6bc81dc..029c196 100644
--- a/agents/email-assistant/agent.toml
+++ b/agents/email-assistant/agent.toml
@@ -12,6 +12,14 @@ tags = [
   "productivity",
 ]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "gmail"]
+skills = ["email-writer", "writing-coach"]
+
+
+max_history_messages = 60
 [metadata.routing]
 aliases = [
   "draft email",
diff --git a/agents/health-tracker/agent.toml b/agents/health-tracker/agent.toml
index ac3674a..53055d6 100644
--- a/agents/health-tracker/agent.toml
+++ b/agents/health-tracker/agent.toml
@@ -5,6 +5,14 @@ author = "librefang"
 module = "builtin:chat"
 tags = ["health", "wellness", "fitness", "medication", "habits", "tracking"]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory"]
+skills = []
+skills_disabled = true
+
+
 [metadata.routing]
 aliases = [
   "health tracking",
diff --git a/agents/hello-world/agent.toml b/agents/hello-world/agent.toml
index fe83527..38f7be3 100644
--- a/agents/hello-world/agent.toml
+++ b/agents/hello-world/agent.toml
@@ -4,6 +4,14 @@ description = "A friendly greeting agent that can read files, search the web, an
 author = "librefang"
 module = "builtin:chat"
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "fetch"]
+skills = []
+skills_disabled = true
+
+
 [metadata.routing]
 aliases = [
   "hello world",
diff --git a/agents/home-automation/agent.toml b/agents/home-automation/agent.toml
index 06f96aa..434ee6c 100644
--- a/agents/home-automation/agent.toml
+++ b/agents/home-automation/agent.toml
@@ -5,6 +5,14 @@ author = "librefang"
 module = "builtin:chat"
 tags = ["smart-home", "iot", "automation", "devices", "monitoring", "home"]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "fetch"]
+skills = []
+skills_disabled = true
+
+
 [metadata.routing]
 aliases = [
   "smart home",
diff --git a/agents/legal-assistant/agent.toml b/agents/legal-assistant/agent.toml
index 01a5ee6..5d65697 100644
--- a/agents/legal-assistant/agent.toml
+++ b/agents/legal-assistant/agent.toml
@@ -5,6 +5,14 @@ author = "librefang"
 module = "builtin:chat"
 tags = ["legal", "contracts", "compliance", "research", "review", "documents"]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "fetch"]
+skills = ["compliance", "writing-coach"]
+
+
+max_history_messages = 80
 [metadata.routing]
 aliases = [
   "legal review",
diff --git a/agents/meeting-assistant/agent.toml b/agents/meeting-assistant/agent.toml
index d898f08..86c1f02 100644
--- a/agents/meeting-assistant/agent.toml
+++ b/agents/meeting-assistant/agent.toml
@@ -12,6 +12,14 @@ tags = [
   "productivity",
 ]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "google-calendar", "gmail"]
+skills = ["writing-coach"]
+
+
+max_history_messages = 60
 [metadata.routing]
 aliases = [
   "meeting notes",
diff --git a/agents/ops/agent.toml b/agents/ops/agent.toml
index 666c772..d0d8acc 100644
--- a/agents/ops/agent.toml
+++ b/agents/ops/agent.toml
@@ -4,6 +4,20 @@ description = "DevOps agent. Monitors systems, runs diagnostics, manages deploym
 author = "librefang"
 module = "builtin:chat"
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "git"]
+skills = [
+  "docker",
+  "sysadmin",
+  "shell-scripting",
+  "linux-networking",
+  "prometheus",
+]
+max_history_messages = 60
+
+
 [metadata.routing]
 aliases = [
   "service status",
diff --git a/agents/orchestrator/agent.toml b/agents/orchestrator/agent.toml
index cc88e8e..e22bd47 100644
--- a/agents/orchestrator/agent.toml
+++ b/agents/orchestrator/agent.toml
@@ -4,6 +4,14 @@ description = "Meta-agent that decomposes complex tasks, delegates to specialist
 author = "librefang"
 module = "builtin:chat"
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory"]
+skills = []
+
+
+max_history_messages = 120
 [metadata.routing]
 aliases = [
   "multi agent",
diff --git a/agents/personal-finance/agent.toml b/agents/personal-finance/agent.toml
index 3df719a..8e29de3 100644
--- a/agents/personal-finance/agent.toml
+++ b/agents/personal-finance/agent.toml
@@ -5,6 +5,14 @@ author = "librefang"
 module = "builtin:chat"
 tags = ["finance", "budget", "expenses", "savings", "planning", "money"]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory"]
+skills = ["data-analyst"]
+
+
+max_history_messages = 60
 [metadata.routing]
 aliases = [
   "budget planning",
diff --git a/agents/planner/agent.toml b/agents/planner/agent.toml
index b8fe55e..e70af51 100644
--- a/agents/planner/agent.toml
+++ b/agents/planner/agent.toml
@@ -4,6 +4,14 @@ description = "Project planner. Creates project plans, breaks down epics, estima
 author = "librefang"
 module = "builtin:chat"
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "github", "linear", "jira"]
+skills = ["project-manager"]
+
+
+max_history_messages = 60
 [metadata.routing]
 aliases = [
   "project plan",
diff --git a/agents/recipe-assistant/agent.toml b/agents/recipe-assistant/agent.toml
index e08390e..b4f16d0 100644
--- a/agents/recipe-assistant/agent.toml
+++ b/agents/recipe-assistant/agent.toml
@@ -5,6 +5,14 @@ author = "librefang"
 module = "builtin:chat"
 tags = ["cooking", "recipes", "meal-planning", "nutrition", "food"]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "fetch"]
+skills = []
+skills_disabled = true
+
+
 [metadata.routing]
 aliases = [
   "recipe helper",
diff --git a/agents/recruiter/agent.toml b/agents/recruiter/agent.toml
index 9892eb0..58de417 100644
--- a/agents/recruiter/agent.toml
+++ b/agents/recruiter/agent.toml
@@ -5,6 +5,14 @@ author = "librefang"
 module = "builtin:chat"
 tags = ["recruiting", "hiring", "resume", "outreach", "talent", "hr"]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "gmail", "linear"]
+skills = ["email-writer", "writing-coach", "interview-prep"]
+
+
+max_history_messages = 60
 [metadata.routing]
 aliases = [
   "candidate screening",
diff --git a/agents/researcher/agent.toml b/agents/researcher/agent.toml
index bc1dc75..4762721 100644
--- a/agents/researcher/agent.toml
+++ b/agents/researcher/agent.toml
@@ -5,6 +5,14 @@ author = "librefang"
 module = "builtin:chat"
 tags = ["research", "analysis", "web"]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "fetch", "exa-search", "brave-search"]
+skills = ["technical-writer", "writing-coach"]
+
+
+max_history_messages = 80
 [metadata.routing]
 aliases = [
   "web research",
diff --git a/agents/sales-assistant/agent.toml b/agents/sales-assistant/agent.toml
index f3fee24..3549cd0 100644
--- a/agents/sales-assistant/agent.toml
+++ b/agents/sales-assistant/agent.toml
@@ -5,6 +5,14 @@ author = "librefang"
 module = "builtin:chat"
 tags = ["sales", "crm", "outreach", "pipeline", "prospecting", "deals"]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "gmail", "slack"]
+skills = ["email-writer", "writing-coach"]
+
+
+max_history_messages = 60
 [metadata.routing]
 aliases = ["sales outreach", "crm update", "pipeline review", "deal tracking"]
 weak_aliases = ["crm", "leads"]
diff --git a/agents/security-auditor/agent.toml b/agents/security-auditor/agent.toml
index fb8ac3f..60d5737 100644
--- a/agents/security-auditor/agent.toml
+++ b/agents/security-auditor/agent.toml
@@ -5,6 +5,14 @@ author = "librefang"
 module = "builtin:chat"
 tags = ["security", "audit", "vulnerability"]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "github", "git"]
+skills = ["security-audit", "compliance", "oauth-expert"]
+
+
+max_history_messages = 80
 [metadata.routing]
 aliases = [
   "security audit",
diff --git a/agents/social-media/agent.toml b/agents/social-media/agent.toml
index c05a75f..a55361d 100644
--- a/agents/social-media/agent.toml
+++ b/agents/social-media/agent.toml
@@ -12,6 +12,14 @@ tags = [
   "analytics",
 ]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "fetch"]
+skills = ["writing-coach"]
+
+
+max_history_messages = 60
 [metadata.routing]
 aliases = [
   "social media plan",
diff --git a/agents/test-engineer/agent.toml b/agents/test-engineer/agent.toml
index 1c890e0..0ae0cf6 100644
--- a/agents/test-engineer/agent.toml
+++ b/agents/test-engineer/agent.toml
@@ -5,6 +5,14 @@ author = "librefang"
 module = "builtin:chat"
 tags = ["testing", "qa", "validation"]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "github", "git"]
+skills = ["api-tester", "python-expert", "rust-expert", "typescript-expert"]
+
+
+max_history_messages = 80
 [metadata.routing]
 aliases = [
   "test plan",
diff --git a/agents/translator/agent.toml b/agents/translator/agent.toml
index 960877e..ff0ba25 100644
--- a/agents/translator/agent.toml
+++ b/agents/translator/agent.toml
@@ -12,6 +12,14 @@ tags = [
   "i18n",
 ]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "fetch"]
+skills = ["writing-coach"]
+
+
+max_history_messages = 60
 [metadata.routing]
 aliases = [
   "translate document",
diff --git a/agents/travel-planner/agent.toml b/agents/travel-planner/agent.toml
index 5d3364f..becaafe 100644
--- a/agents/travel-planner/agent.toml
+++ b/agents/travel-planner/agent.toml
@@ -5,6 +5,14 @@ author = "librefang"
 module = "builtin:chat"
 tags = ["travel", "planning", "itinerary", "booking", "logistics", "vacation"]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "fetch", "google-maps", "google-calendar"]
+skills = []
+
+
+max_history_messages = 60
 [metadata.routing]
 aliases = [
   "trip itinerary",
diff --git a/agents/tutor/agent.toml b/agents/tutor/agent.toml
index ebf89dd..7322d4f 100644
--- a/agents/tutor/agent.toml
+++ b/agents/tutor/agent.toml
@@ -12,6 +12,14 @@ tags = [
   "knowledge",
 ]
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "fetch"]
+skills = ["writing-coach", "python-expert"]
+
+
+max_history_messages = 60
 [metadata.routing]
 aliases = [
   "teach me",
diff --git a/agents/writer/agent.toml b/agents/writer/agent.toml
index 9e20fa0..93d19d6 100644
--- a/agents/writer/agent.toml
+++ b/agents/writer/agent.toml
@@ -4,6 +4,14 @@ description = "Content writer. Creates documentation, articles, and technical wr
 author = "librefang"
 module = "builtin:chat"
 
+# Per-agent resource allowlists (refs librefang/librefang-registry#87).
+# Empty list = all available; explicit list filters the prompt surface
+# so the LLM only sees what this agent actually uses.
+mcp_servers = ["memory", "fetch"]
+skills = ["technical-writer", "writing-coach"]
+
+
+max_history_messages = 60
 [metadata.routing]
 aliases = [
   "write article",
diff --git a/hands/analytics/HAND.toml b/hands/analytics/HAND.toml
index 67df279..45beae3 100644
--- a/hands/analytics/HAND.toml
+++ b/hands/analytics/HAND.toml
@@ -23,6 +23,12 @@ tools = [
   "event_publish",
 ]
 
+# Per-hand resource allowlists (refs librefang/librefang-registry#87).
+# Inherited by every [agents.*] in this hand unless overridden.
+mcp_servers = ["memory", "sqlite-mcp", "postgresql", "filesystem"]
+skills = ["data-analyst", "sql-analyst", "python-expert", "data-pipeline"]
+
+
 [routing]
 aliases = [
   "data analysis",
diff --git a/hands/apitester/HAND.toml b/hands/apitester/HAND.toml
index c251d48..fd9c240 100644
--- a/hands/apitester/HAND.toml
+++ b/hands/apitester/HAND.toml
@@ -24,6 +24,18 @@ tools = [
   "event_publish",
 ]
 
+# Per-hand resource allowlists (refs librefang/librefang-registry#87).
+# Inherited by every [agents.*] in this hand unless overridden.
+mcp_servers = ["memory", "github", "fetch"]
+skills = [
+  "api-tester",
+  "openapi-expert",
+  "graphql-expert",
+  "python-expert",
+  "typescript-expert",
+]
+
+
 [[requires]]
 key = "curl"
 label = "curl must be installed"
diff --git a/hands/browser/HAND.toml b/hands/browser/HAND.toml
index 0502beb..e98738d 100644
--- a/hands/browser/HAND.toml
+++ b/hands/browser/HAND.toml
@@ -28,6 +28,12 @@ tools = [
   "file_read",
 ]
 
+# Per-hand resource allowlists (refs librefang/librefang-registry#87).
+# Inherited by every [agents.*] in this hand unless overridden.
+mcp_servers = ["memory", "puppeteer"]
+skills = []
+
+
 [routing]
 aliases = [
   "open website",
diff --git a/hands/clip/HAND.toml b/hands/clip/HAND.toml
index 7336b5d..66c66e8 100644
--- a/hands/clip/HAND.toml
+++ b/hands/clip/HAND.toml
@@ -17,6 +17,15 @@ tools = [
   "memory_recall",
 ]
 
+# Per-hand resource allowlists (refs librefang/librefang-registry#87).
+# Inherited by every [agents.*] in this hand unless overridden.
+mcp_servers = ["memory", "filesystem"]
+skills = []
+# `skills_disabled = true` lives on each [agents.*] below — HandDefinitionRaw
+# in librefang-hands doesn't carry the field, so a hand-level entry would be
+# silently dropped by serde.
+
+
 [routing]
 aliases = [
   "clip video",
@@ -219,6 +228,7 @@ description = "AI video editor — downloads, transcribes, and creates viral sho
 module = "builtin:chat"
 provider = "default"
 model = "default"
+skills_disabled = true
 max_tokens = 8192
 temperature = 0.4
 max_iterations = 40
@@ -622,6 +632,7 @@ description = "Content writer. Creates scripts, captions, titles, and descriptio
 module = "builtin:chat"
 provider = "default"
 model = "default"
+skills_disabled = true
 max_tokens = 4096
 temperature = 0.7
 system_prompt = """You are Writer, a short-form video content specialist within the Clip Hand.
@@ -760,6 +771,7 @@ description = "Social media strategist. Plans distribution, scheduling, and enga
 module = "builtin:chat"
 provider = "default"
 model = "default"
+skills_disabled = true
 max_tokens = 4096
 temperature = 0.7
 system_prompt = """You are Distributor, the publishing and distribution specialist within the Clip Hand.
diff --git a/hands/collector/HAND.toml b/hands/collector/HAND.toml
index df65db7..ead1c84 100644
--- a/hands/collector/HAND.toml
+++ b/hands/collector/HAND.toml
@@ -25,6 +25,12 @@ tools = [
   "event_publish",
 ]
 
+# Per-hand resource allowlists (refs librefang/librefang-registry#87).
+# Inherited by every [agents.*] in this hand unless overridden.
+mcp_servers = ["memory", "fetch", "exa-search", "brave-search", "filesystem"]
+skills = ["data-analyst"]
+
+
 [routing]
 aliases = [
   "monitor changes",
diff --git a/hands/creator/HAND.toml b/hands/creator/HAND.toml
index c3d6f28..70b03be 100644
--- a/hands/creator/HAND.toml
+++ b/hands/creator/HAND.toml
@@ -20,6 +20,15 @@ tools = [
   "memory_recall",
 ]
 
+# Per-hand resource allowlists (refs librefang/librefang-registry#87).
+# Inherited by every [agents.*] in this hand unless overridden.
+mcp_servers = ["memory", "filesystem"]
+skills = []
+# `skills_disabled = true` lives on each [agents.*] below — HandDefinitionRaw
+# in librefang-hands doesn't carry the field, so a hand-level entry would be
+# silently dropped by serde.
+
+
 [routing]
 aliases = [
   "generate image",
@@ -172,6 +181,7 @@ description = "AI media studio — generates images, videos, music, and speech f
 module = "builtin:chat"
 provider = "default"
 model = "default"
+skills_disabled = true
 max_tokens = 8192
 temperature = 0.5
 max_iterations = 30
@@ -279,6 +289,7 @@ description = "Prompt engineer that crafts detailed, effective prompts for media
 module = "builtin:chat"
 provider = "default"
 model = "default"
+skills_disabled = true
 max_tokens = 4096
 temperature = 0.8
 system_prompt = """You are Prompt Writer, a creative prompt engineer within the Creator Hand.
diff --git a/hands/devops/HAND.toml b/hands/devops/HAND.toml
index 85dc4f2..4d23172 100644
--- a/hands/devops/HAND.toml
+++ b/hands/devops/HAND.toml
@@ -24,6 +24,30 @@ tools = [
   "event_publish",
 ]
 
+# Per-hand resource allowlists (refs librefang/librefang-registry#87).
+# Inherited by every [agents.*] in this hand unless overridden.
+mcp_servers = [
+  "memory",
+  "git",
+  "github",
+  "filesystem",
+  "sentry",
+  "elasticsearch",
+]
+skills = [
+  "docker",
+  "kubernetes",
+  "terraform",
+  "ansible",
+  "ci-cd",
+  "helm",
+  "prometheus",
+  "sysadmin",
+  "linux-networking",
+  "shell-scripting",
+]
+
+
 [[requires]]
 key = "curl"
 label = "curl must be installed"
diff --git a/hands/devteam/HAND.toml b/hands/devteam/HAND.toml
index e3fe18f..4d9d492 100644
--- a/hands/devteam/HAND.toml
+++ b/hands/devteam/HAND.toml
@@ -30,11 +30,20 @@ tools = [
   "workflow_run",
 ]
 
-# MCP servers: all agents can access these (per-agent mcp_servers further restricts)
-mcp_servers = ["github"]
+# Per-hand resource allowlists (refs librefang/librefang-registry#87).
+# Inherited by every [agents.*] in this hand unless overridden.
+mcp_servers = ["memory", "github", "git", "filesystem"]
+skills = [
+  "github",
+  "git-expert",
+  "rust-expert",
+  "python-expert",
+  "typescript-expert",
+  "code-reviewer",
+  "api-tester",
+  "ci-cd",
+]
 
-# Skills: all available (agents can restrict individually)
-skills = []
 
 # Plugins: useful for dev workflow
 allowed_plugins = ["todo-tracker", "auto-summarizer", "episodic-memory"]
diff --git a/hands/lead/HAND.toml b/hands/lead/HAND.toml
index 1222651..bf28c7a 100644
--- a/hands/lead/HAND.toml
+++ b/hands/lead/HAND.toml
@@ -24,6 +24,19 @@ tools = [
   "knowledge_query",
 ]
 
+# Per-hand resource allowlists (refs librefang/librefang-registry#87).
+# Inherited by every [agents.*] in this hand unless overridden.
+mcp_servers = [
+  "memory",
+  "fetch",
+  "gmail",
+  "linear",
+  "exa-search",
+  "brave-search",
+]
+skills = ["email-writer", "writing-coach", "data-analyst"]
+
+
 [routing]
 aliases = [
   "lead generation",
diff --git a/hands/linkedin/HAND.toml b/hands/linkedin/HAND.toml
index 245cd33..912d749 100644
--- a/hands/linkedin/HAND.toml
+++ b/hands/linkedin/HAND.toml
@@ -23,6 +23,12 @@ tools = [
   "event_publish",
 ]
 
+# Per-hand resource allowlists (refs librefang/librefang-registry#87).
+# Inherited by every [agents.*] in this hand unless overridden.
+mcp_servers = ["memory", "fetch"]
+skills = ["writing-coach", "email-writer"]
+
+
 [routing]
 aliases = ["linkedin", "profile optimization", "professional networking"]
 weak_aliases = ["professional engagement", "linkedin post"]
diff --git a/hands/predictor/HAND.toml b/hands/predictor/HAND.toml
index a7b4d41..1df0926 100644
--- a/hands/predictor/HAND.toml
+++ b/hands/predictor/HAND.toml
@@ -23,6 +23,12 @@ tools = [
   "knowledge_query",
 ]
 
+# Per-hand resource allowlists (refs librefang/librefang-registry#87).
+# Inherited by every [agents.*] in this hand unless overridden.
+mcp_servers = ["memory", "fetch", "exa-search", "brave-search"]
+skills = ["data-analyst", "python-expert"]
+
+
 [routing]
 aliases = [
   "predict",
diff --git a/hands/reddit/HAND.toml b/hands/reddit/HAND.toml
index b4d9cd6..e684e4e 100644
--- a/hands/reddit/HAND.toml
+++ b/hands/reddit/HAND.toml
@@ -23,6 +23,12 @@ tools = [
   "event_publish",
 ]
 
+# Per-hand resource allowlists (refs librefang/librefang-registry#87).
+# Inherited by every [agents.*] in this hand unless overridden.
+mcp_servers = ["memory", "fetch"]
+skills = ["writing-coach"]
+
+
 [routing]
 aliases = ["reddit", "subreddit", "reddit post", "reddit monitor"]
 weak_aliases = ["karma", "reddit thread"]
diff --git a/hands/researcher/HAND.toml b/hands/researcher/HAND.toml
index d8a5833..0175668 100644
--- a/hands/researcher/HAND.toml
+++ b/hands/researcher/HAND.toml
@@ -26,6 +26,12 @@ tools = [
   "event_publish",
 ]
 
+# Per-hand resource allowlists (refs librefang/librefang-registry#87).
+# Inherited by every [agents.*] in this hand unless overridden.
+mcp_servers = ["memory", "fetch", "exa-search", "brave-search"]
+skills = ["technical-writer", "writing-coach", "python-expert", "pdf-reader"]
+
+
 [routing]
 aliases = [
   "deep research",
diff --git a/hands/strategist/HAND.toml b/hands/strategist/HAND.toml
index 393a405..096dcbf 100644
--- a/hands/strategist/HAND.toml
+++ b/hands/strategist/HAND.toml
@@ -24,6 +24,12 @@ tools = [
   "event_publish",
 ]
 
+# Per-hand resource allowlists (refs librefang/librefang-registry#87).
+# Inherited by every [agents.*] in this hand unless overridden.
+mcp_servers = ["memory", "fetch", "exa-search", "brave-search"]
+skills = ["project-manager", "data-analyst", "writing-coach"]
+
+
 [routing]
 aliases = [
   "strategic analysis",
diff --git a/hands/trader/HAND.toml b/hands/trader/HAND.toml
index 202e452..5333401 100644
--- a/hands/trader/HAND.toml
+++ b/hands/trader/HAND.toml
@@ -25,6 +25,12 @@ tools = [
   "event_publish",
 ]
 
+# Per-hand resource allowlists (refs librefang/librefang-registry#87).
+# Inherited by every [agents.*] in this hand unless overridden.
+mcp_servers = ["memory", "fetch", "postgresql", "sqlite-mcp"]
+skills = ["data-analyst", "sql-analyst", "python-expert"]
+
+
 [routing]
 aliases = [
   "trade",
diff --git a/hands/twitter/HAND.toml b/hands/twitter/HAND.toml
index 280daee..aa72d90 100644
--- a/hands/twitter/HAND.toml
+++ b/hands/twitter/HAND.toml
@@ -24,6 +24,12 @@ tools = [
   "event_publish",
 ]
 
+# Per-hand resource allowlists (refs librefang/librefang-registry#87).
+# Inherited by every [agents.*] in this hand unless overridden.
+mcp_servers = ["memory", "fetch"]
+skills = ["writing-coach"]
+
+
 [routing]
 aliases = [
   "twitter",
diff --git a/hands/wiki/HAND.toml b/hands/wiki/HAND.toml
index 3085fcd..25cfc9a 100644
--- a/hands/wiki/HAND.toml
+++ b/hands/wiki/HAND.toml
@@ -18,8 +18,12 @@ tools = [
   "memory_store",
 ]
 
-mcp_servers = []
+# Per-hand resource allowlists (refs librefang/librefang-registry#87).
+# Inherited by every [agents.*] in this hand unless overridden.
+mcp_servers = ["memory", "fetch", "filesystem"]
 skills = []
+
+
 allowed_plugins = []
 # memory_store is used ONLY for dashboard metrics.
 # No wiki content enters LibreFang's general memory — all knowledge lives in the vault.
diff --git a/schema.toml b/schema.toml
index accce8b..e579c39 100644
--- a/schema.toml
+++ b/schema.toml
@@ -204,6 +204,26 @@ required = true
 description = "Runtime module (builtin:chat, builtin:tool, etc.)"
 example = "builtin:chat"
 
+[agent.fields.mcp_servers]
+type = "array"
+required = false
+description = "MCP server allowlist. Empty list (default) means every connected MCP server's tools are injected into this agent's prompt — on a typical instance that is ~85 tool definitions and ~50k tokens per call. Set an explicit list to trim the surface to only the servers this agent actually uses (e.g. [\"memory\", \"git\", \"github\"])."
+item_type = "string"
+example = ["memory", "git", "github"]
+
+[agent.fields.skills]
+type = "array"
+required = false
+description = "Skill allowlist. Empty list (default) means every installed skill is available. Set an explicit list to load only what this agent needs."
+item_type = "string"
+example = ["rust-expert", "python-expert"]
+
+[agent.fields.max_history_messages]
+type = "number"
+required = false
+description = "Per-agent override for the message-history trim cap. Omit (default) inherits from KernelConfig.max_history_messages, which itself falls back to the compiled constant librefang_runtime::agent_loop::DEFAULT_MAX_HISTORY_MESSAGES (60 today). Values below 4 are clamped at runtime with a warning. Pinning this *below* the kernel default trashes the prompt cache — every turn that hits the cap invalidates the cached prefix and costs more than the smaller history saves. Set this only to raise the cap for iteration-heavy agents that legitimately need more context, or to lower it for agents whose conversations are demonstrably short and where you've measured the trade-off."
+example = 80
+
 # --- Agent: [model] section ---
 
 [agent.sections.model]