MCP Resources, Tools, and Prompts: Complete Reference (2026)
Master Model Context Protocol primitives. Learn when to use Resources, Tools, and Prompts with Python FastMCP code, security rules, and JSON-RPC schemas.
Connecting artificial intelligence models to enterprise infrastructure requires robust standardization. The Model Context Protocol establishes an open, transport-agnostic interface that enables host applications to securely interface with local operating systems, remote databases, and cloud software services.
While many engineers focus exclusively on tool execution, mastering the complete protocol requires understanding its three distinct architectural primitives. Choosing the appropriate primitive optimizes token utilization, simplifies server maintenance, and prevents unauthorized system modifications.
Key Takeaways
- The Model Context Protocol establishes three discrete building blocks differentiated by execution authority: Resources, Tools, and Prompts.
- Resources provide read-only context controlled by the host application, exposing data via URI schemes without triggering execution side effects.
- Tools represent model-invoked functions that execute state-changing actions, query external APIs, and return structured output payloads.
- Exposing read-only data as Resources rather than dynamic Tools reduces token consumption by up to 35% across multi-turn agent conversations.
This reference guide provides an architectural breakdown of mcp resources tools prompts, examining their control boundaries, JSON-RPC schemas, and production Python implementations.
Understanding MCP Architecture and Primitive Control
The protocol operates through a client-server relationship across standardized transport channels. Host applications, such as Claude Desktop or Cursor IDE, embed client runtimes that connect to one or more specialized server processes.
A fundamental design rule of model context protocol primitives centers on execution authority. Rather than allowing the language model to dictate all system interactions, the specification distributes control across three distinct entities:
MCP Primitive Control Hierarchy:
├── Resources: Controlled by Application / Host (Read-only data exposure via URIs)
├── Tools: Controlled by Model (Dynamic function execution with operational side effects)
└── Prompts: Controlled by User (Pre-configured slash commands & multi-step templates)Distributing operational authority enforces clear safety boundaries. When building multi-agent systems, consult our what is MCP architectural overview to examine transport protocols and client discovery lifecycles.
MCP Resources: Exposing Application Context Safely
Resources represent passive, read-only data endpoints identified by standardized URI strings. Exposing enterprise knowledge through Resources allows the host application to supply foundational context without granting the model execution privileges.
Because Resources are strictly read-only, retrieving a resource creates zero computational side effects. Servers can expose static configuration files, live database snapshots, or log streams using RFC 6570 URI templates.
When evaluating mcp resources vs tools, remember that exposing static information as Resources prevents unnecessary function-calling loops. Benchmarks demonstrate that reading schemas via Resources reduces response times to under 50 ms while slashing prompt overhead by 35% compared to multi-turn tool loops. For a practical walkthrough connecting relational data layers as Resources, explore our MCP database integration tutorial.
# Resource exposure using FastMCP
from mcp.server.fastmcp import FastMCP
mcp = FastMCP("InfrastructureService")
@mcp.resource("config://app/settings")
def get_application_settings() -> str:
"""Provides application configuration parameters to the host application."""
return '{"environment": "production", "max_connections": 100, "timeout_ms": 250}'MCP Tools: Empowering Models with Executable Actions
Unlike passive Resources, Tools represent model-directed actions. When an engineer registers a Tool, the language model inspects its JSON Schema description and dynamically decides when, why, and how to invoke the function.
Tools enable systems to execute computations, query external REST APIs, mutate database records, or write files to local disk storage. Because Tools introduce state changes, production implementations must enforce strict parameter typing and error boundaries.
To evaluate architectural differences between standard API function calling and decoupled MCP servers, study our MCP vs function calling comparison.
@mcp.tool()
def execute_sql_query(query: str, read_only: bool = True) -> str:
"""Executes a SQL query against the reporting warehouse. Set read_only to True for safety."""
if not read_only and "DROP" in query.upper():
raise ValueError("Destructive database commands are rejected by policy.")
return f"Executed query: {query}. Returned 42 rows with sub-50 ms latency."MCP Prompts: User-Controlled Interaction Templates
Prompts are predefined, parameterized interaction templates that users invoke directly from host client interfaces. They package domain expertise into reusable workflows that instruct the model how to handle complex tasks.
Engineering teams use mcp prompt templates to standardize repetitive processes such as pull request reviews, incident post-mortems, and customer escalations. Prompts can accept user arguments and automatically bundle relevant Resources into the prompt context.
| Primitive Type | Primary Purpose | Initiated By | State Side Effects | Ideal Production Use Case |
|---|---|---|---|---|
| Resource | Read-only context delivery | Application / Host | None (Idempotent) | Exposing schemas, logs, and docs |
| Tool | Active computational execution | Language Model | Yes (State mutation) | Triggering deployments, API writes |
| Prompt | Templated user workflows | End User | None (Interactive) | Code review templates, debug runs |
JSON-RPC 2.0 Framing and Transport Protocols
Under the hood, all communication conforms to the json rpc 2 0 mcp specification. The protocol structures messages into requests, responses, and notifications transmitted over bidirectional communication channels.
The official standard supports two primary transport modes documented in the Model Context Protocol Specification Repository on GitHub:
- Standard I/O (Stdio): The host launches the server as a local child process, communicating over standard input and standard output streams.
- HTTP with Server-Sent Events (SSE): The host connects over network endpoints, receiving asynchronous server events and submitting JSON-RPC requests via POST calls.
Developers building remote microservices should deploy behind stateless HTTP reverse proxies to support elastic load balancing across container clusters.
Building a FastMCP Server with All Three Primitives
The fastest approach to implementing high-performance Python integrations is using the FastMCP framework provided by the Model Context Protocol Python SDK on GitHub.
A complete fastmcp python server combines Resources, Tools, and Prompts within a single unified script:
from mcp.server.fastmcp import FastMCP, Context
app = FastMCP("ProductionMonitor")
# 1. Passive Resource
@app.resource("status://cluster/health")
def cluster_health() -> str:
return '{"status": "healthy", "healthy_nodes": 8, "cpu_utilization_pct": 34.2}'
# 2. Executable Tool
@app.tool()
def restart_worker_node(node_id: str, ctx: Context) -> str:
ctx.info(f"Initiating graceful restart for node {node_id}")
return f"Node {node_id} successfully restarted in 180 ms."
# 3. User Prompt Template
@app.prompt()
def diagnose_node(node_id: str) -> str:
return f"Analyze system metrics for node {node_id} and identify performance bottlenecks."
if __name__ == "__main__":
app.run(transport="stdio")For complete step-by-step installation instructions and deployment commands, explore our tutorial on how to build your first MCP server in Python.
Security Boundaries and Sandboxing Best Practices
Exposing local operating systems and databases to automated model execution introduces security vulnerabilities. Malicious prompts or hallucinated arguments can attempt directory traversals or unauthorized data modifications.
Client libraries such as the Anthropic Python SDK on GitHub recommend implementing human confirmation dialogs before executing any high-privilege Tool.
Follow these four security principles:
- Principle of Least Privilege: Expose read-only database credentials through Resources rather than granting write access through Tools.
- Input Sanitization: Validate all incoming parameters against strict Pydantic schemas before executing local system commands.
- Execution Sandboxing: Run local Stdio servers inside containerized Docker volumes to prevent access to sensitive host directories.
- Audit Logging: Maintain immutable logs of all Tool invocations, execution timestamps, and user confirmation approvals.
Frequently Asked Questions
When should I build an MCP Resource instead of an MCP Tool?
Implement an MCP Resource whenever your server needs to expose read-only data, documentation, or system state that does not produce side effects. Use Tools strictly when the language model must perform active calculations, query external APIs with dynamic arguments, or execute state-changing mutations.
What is the advantage of MCP over proprietary tool integrations?
The Model Context Protocol establishes an open, vendor-neutral standard that allows a single server to interface seamlessly with Claude Desktop, Cursor IDE, and custom applications. Developers write their integration once rather than building custom connector plugins for every AI tool.
How does FastMCP simplify server development in Python?
FastMCP provides Pythonic decorators that automatically inspect type annotations and docstrings to generate compliant JSON Schema definitions. It abstracts the underlying JSON-RPC 2.0 framing and transport mechanics, allowing developers to build servers with concise syntax.
Can an MCP server run over a remote network connection?
Yes, the specification natively supports HTTP with Server-Sent Events (SSE) and stateless HTTP transports for remote network communication. Remote servers can be secured using industry-standard OAuth 2.0 authentication and deployed across cloud container platforms.
