DataArena
MCP Primitives: Resources, Tools & Prompts
Model Context Protocol (MCP) & Tools • API Design8 min read

MCP Primitives: Resources, Tools & Prompts

Exposing read-only data assets (Resources), executable functions with side effects (Tools), and templated workflows (Prompts).

Practice in Prompt LabTest in AI Interview

Core Conceptual Brief

The MCP specification is built on three core primitives: Resources (static context), Tools (active execution), and Prompts (workflow orchestration). Learn when to use each.

Theoretical & Empirical Architecture

A well-designed MCP server clearly separates its capabilities according to the three core MCP primitives:

  1. Resources: Passive, read-only data that provide context to the LLM (like a file read or database table view).
  2. Tools: Active, callable functions that perform computations or execute real-world side effects (like sending an email or executing a SQL query).
  3. Prompts: Reusable prompt templates and workflows parameterized for user interaction.

Under the Hood: Key Engineering Mechanics

1Resources (URI-Based Context)

Resources are addressed via standard URIs (e.g. postgres://production/schema or file:///var/log/nginx/access.log). They can be static or dynamic, and support real-time subscription notifications when contents change.

2Tools (JSONSchema Validation)

Every tool defines an inputSchema using JSONSchema. This schema is fed directly into the model's function calling parameter definitions, guaranteeing that parameters match expected types before code executes.

3Human-in-the-Loop Confirmation for Dangerous Tools

A production MCP host must differentiate between safe tools (e.g. query_select) and mutating tools (e.g. drop_table or git_push). Mutating tools must trigger explicit confirmation prompts in the UI.

Defining an MCP Tool with Schema Validation

// Tool definition within an MCP server
export const ExecuteQueryTool = {
  name: "execute_readonly_sql",
  description: "Execute a read-only SELECT query against the analytics database.",
  inputSchema: {
    type: "object",
    properties: {
      sql_query: {
        type: "string",
        description: "The PostgreSQL SELECT query to execute. Must NOT contain DROP, DELETE, or UPDATE."
      },
      limit: {
        type: "number",
        description: "Maximum rows to return (default 50, maximum 500)",
        default: 50
      }
    },
    required: ["sql_query"]
  }
};

Production Guardrails & Takeaways

  • Use Resources for passive reading, Tools for active execution, and Prompts for pre-packaged workflows.
  • Define rigorous JSONSchema constraints for all tool inputs to prevent type errors.
  • Always implement human confirmation guards for tools that perform disk writes or remote mutations.

Real Staff AI Systems Interview Question

Q: What is the security difference between an MCP Resource and an MCP Tool?

Staff Answer:

An MCP Resource is strictly read-only and idempotent: reading a resource has zero external side effects and cannot mutate state. An MCP Tool represents an executable function that can have side effects (modifying databases, deleting files, sending HTTP webhooks). Therefore, tools require stricter authentication, parameter validation, and user consent gates.

MCP Primitives: Resources, Tools & Prompts | AI Systems Engineering Guide · DataArena