An MCP server exposes three types of things. Each has a different controller: the part of the system that decides when it is used.
| Primitive | What it is | Controlled by | Examples |
|---|---|---|---|
| Tools | Functions that can be called | The model | Web search, database query, code executor |
| Resources | Data loaded into context | The app | A file, a database record, a document |
| Prompts | Templates for a task | The user | "Summarize this document", "Review this code" |
Tools: model-controlled#
Tools are functions the model can call. The model decides when to call them, based on the conversation. They are the same as tool calling, but served over MCP, so any compatible app can use them.
Resources: app-controlled#
Resources are data the application chooses to load into context. The app decides what to load, not the model. When the app decides a file or record is relevant, it fetches it and puts it in the prompt.
This is the same idea as RAG: your code chooses what context the model sees.
Prompts: user-controlled#
Prompts are templates the user picks. The user selects a template from the server, fills in any parameters, and it is used in the conversation. For example, a user picks "Review this code" and supplies the file.
Why the controller matters#
In an interview, the controller is the point to get right:
- Tools are model-controlled.
- Resources are app-controlled.
- Prompts are user-controlled.
It also tells you where risk sits. A tool call is the model acting on its own judgment, so tools need the same validation and confirmation as any tool.
Short line#
An MCP server exposes three primitives. Tools are functions the model decides to call, resources are data the app decides to load into context, and prompts are templates the user picks.
Key takeaways#
- Tools are functions. The model decides when to call them.
- Resources are data such as files and records. The app decides what to load.
- Prompts are templates. The user picks one and fills in its parameters.
- Model, app and user: know which controls which.
- Tools carry the most risk, because the model calls them on its own judgment.