Expose an MCP tool when an AI agent should be able to invoke an operation, a resource when the client should provide or manage contextual data, and a prompt when a user should choose a reusable interaction template. The deciding question is who should control access to the capability—and what safeguards its effects require.
These are protocol-level distinctions, not guarantees about how every AI client presents the features. Choose the primitive around the capability’s job, then verify how the client you support handles it.
As an Amazon Associate I earn from qualifying purchases.
How tools, resources, and prompts differ
The MCP overview describes tools as model-controlled, resources as application-controlled, and prompts as user-controlled. Those labels summarize the intended control model; clients can implement different interfaces, and feature support varies.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Primitive | Control model | Best fit | Example | Key design question |
|---|---|---|---|---|
| Tool | Model-controlled | An operation the model can invoke with structured arguments | Query a database, call an API, or calculate a result | Should the model be able to initiate this operation, and what validation or approval is needed? |
| Resource | Application-controlled | Contextual content the client can provide or manage | A file, schema, record, or reference document | Should the client decide when and how this data enters context? |
| Prompt | User-controlled | A reusable template or guided interaction selected by a person | A code-review template with arguments | Should a person explicitly choose this workflow or framing? |
These roles come from the MCP overview and tools specification, the resources specification, and the prompts specification. MCP defines the primitives; it does not prescribe the right product boundary for every server.
#1 Best Overall
When to expose a tool
Tools let a model interact with external systems through named operations with descriptions and input schemas. In the usual flow, a client discovers available tools, the model selects one and supplies arguments, the server processes the request, and the client returns the result to the model. Database queries, API calls, and computations are typical examples.
Use a tool when the model should be able to request an operation or retrieve information on demand. A tool may change state, but it can also be read-only; the important distinction is that the model invokes the operation. Whether that is appropriate depends on the risk and the application.
Design the contract and result
- Give the tool a precise name and description, and define arguments in a valid input schema.
- Validate inputs on the server. A schema helps describe the contract, but it does not replace runtime validation, authorization, or rate limiting.
- Sanitize results before returning them. If results are structured, an output schema can support validation and parsing; servers must conform to a provided schema, and clients should validate structured results.
- Represent execution failures in the result with
isError: truewhere appropriate. The tools specification says clients should provide execution errors to models so they can attempt to self-correct. - Tool results may be structured or unstructured and can include links to resources.
Make consequential calls visible
For sensitive operations, the tools specification recommends clear visibility of tool invocation and a confirmation path. Design the client experience so a person can understand and deny a sensitive call. Treat tool annotations as untrusted unless they come from a trusted server, validate results before passing them to the model, and use timeouts.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
When to expose a resource
Resources make content available as context for a client to manage. A resource can contain text or binary data and is identified by a URI. Use one when the main capability is reference material—such as a file, schema, or record—rather than an operation the model needs to initiate.
Rank #3
Resources can have fixed URIs or be offered through parameterized resource templates. Optional subscriptions and update notifications let clients that support them track changes. Annotations can indicate intended audience, priority, or last-modified time, helping a client filter, prioritize, or sort content.
Validate resource URIs and apply access controls to sensitive resources. If retrieval should happen only when the model actively asks for it, requires complex arguments, or has side effects, consider whether that capability is better exposed as a tool. That boundary is an application design choice, not a protocol rule.
When to expose a prompt
Prompts are named templates a client can list and retrieve. They can accept optional arguments and return a sequence of messages containing text, images, audio, or embedded resources. They fit reusable workflows, examples, and structured interaction starters that a person deliberately selects.
Recommended Free Tools
Use a prompt when the main value is a repeatable framing or workflow chosen by the user—not an operation the agent must perform or reference data the client should manage. Validate prompt inputs and outputs. Do not rely on prompt text to enforce security or privacy controls; those belong in deterministic implementation safeguards.
Best Value
A practical decision sequence
- Is the capability an operation? If it calls an external system, retrieves information on demand, or changes state, consider a tool when model initiation is appropriate. Add server-side validation, authorization, rate limits, and output handling. For sensitive actions, provide a user-confirmation path in the client.
- Is it reference content? If its main purpose is to supply contextual material for the client to manage, use a resource. Choose a fixed URI or a parameterized resource template according to how the content is addressed, and protect sensitive resources with access controls.
- Is it a reusable interaction pattern? If a person should select and customize a template, use a prompt. Validate its arguments and output.
- Does safe use depend on relationships across features? Where supported, put concise guidance about cross-feature workflows, constraints, and limitations in server instructions. Test how the target client uses them; do not rely on instructions for critical safeguards.
- Can users understand and control what the agent does? Check that the client makes tools and their invocation activity legible and allows users to deny sensitive calls.
Where server instructions fit
Server instructions can supply concise context about relationships between features, operational patterns, constraints, and limitations that individual tool descriptions do not adequately convey. They are not a long manual, a place to repeat every tool description, or a substitute for enforcing safeguards in code.
In a November 3, 2025 article, MCP maintainer Ola Hungerford wrote: “No instructions are better than poorly written instructions.” The article reports 40 GitHub pull-request review sessions: the same three-step workflow occurred in 17 of 20 sessions with instructions and 12 of 20 without—85% versus 60% in that sample. This is a small evaluation of one reported setup, not evidence that instructions improve every model or MCP integration.
Host behavior varies, and instructions do not guarantee model behavior. Test them in the target client and enforce critical security and privacy requirements deterministically. The MCP server instructions guidance describes the protocol feature; the maintainer’s article discusses its use and the reported evaluation.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Safety boundaries and client support
- Tools: Make descriptions clear, validate every input, enforce authorization and rate limits, sanitize outputs, and set timeouts. Make availability and invocation visible; use confirmation for sensitive actions. Treat annotations as untrusted unless they come from a trusted server.
- Resources: Validate URIs and protect sensitive content with access controls.
- Prompts: Validate inputs and outputs; do not treat template text as an enforcement mechanism.
- Across features: Test the actual host. Do not assume every client exposes tools, resources, prompts, or server instructions in the same way—or supports them at all.
OpenAI’s developer guide to MCP servers describes tools, resources, prompts, and server instructions as possible capabilities, and outlines tool discovery, selection, execution, and result handling. It is an implementation perspective, not a replacement for the MCP specification.
Which specification revision to check
The detailed tools, resources, and prompts descriptions linked here are from the MCP specification revision dated November 25, 2025. The MCP site has also surfaced draft specification content, and the project announced a July 28, 2026 specification release candidate. A release candidate or draft should not be treated as a finalized stable revision. For version-sensitive behavior, check the project’s current specification status and version before relying on a detail in production.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
