← Back to Articles
MCP ConceptsToolsResourcesPrompts

MCP Tools vs Resources vs Prompts: Understanding the Core Primitives

Deep dive into the three core MCP primitives — tools, resources, and prompts. Learn when to use each and how they work together.

By Web MCP GuideFebruary 12, 20265 min read


The Model Context Protocol defines three core primitives that MCP servers can expose: tools, resources, and prompts. Understanding the differences between these primitives is essential for building effective MCP integrations. If you're new to MCP, start with our introduction to the protocol first.

Quick Overview

| Primitive | Purpose | Who Controls It | Example |
|-----------|---------|-----------------|---------|
| Tools | Execute actions | AI model | Send email, query database |
| Resources | Provide context data | AI model | File contents, API responses |
| Prompts | Template interactions | User (typically) | Code review template |

Tools: Actions the AI Can Take

Tools are executable functions that AI applications can invoke to perform actions. They're the most powerful primitive because they allow AI to affect the outside world.

Characteristics:

  • Model-controlled: The AI decides when to call them

  • Can have side effects (send emails, modify files)

  • Return results back to the AI

  • Should be carefully designed with safety in mind
  • Example Use Cases:

  • Query a database

  • Send a Slack message

  • Create a GitHub issue

  • Execute a calculation

  • Call an external API
  • Code Example:

    server.tool(
    "send_email",
    "Send an email to a recipient",
    {
    to: z.string().email(),
    subject: z.string(),
    body: z.string(),
    },
    async ({ to, subject, body }) => {
    // Send the email
    await emailService.send({ to, subject, body });
    return {
    content: [{
    type: "text",
    text: Email sent to ${to},
    }],
    };
    }
    );

    When to Use Tools:

  • When you need the AI to perform actions

  • When the operation has side effects

  • When you need computed results returned
  • Resources: Context Data for the AI

    Resources are data sources that provide contextual information to AI applications. They're read-only and designed to give the AI the information it needs to make better decisions.

    Characteristics:

  • Primarily for reading, not writing

  • Can be static or dynamic

  • Support subscriptions for real-time updates

  • Identified by URIs
  • Example Use Cases:

  • File contents from a repository

  • Database schema information

  • Configuration settings

  • API documentation

  • User profile data
  • Code Example:

    server.resource(
    "user-profile",
    "user://current",
    async (uri) => ({
    contents: [{
    uri: uri.href,
    mimeType: "application/json",
    text: JSON.stringify({
    name: "John Doe",
    role: "Developer",
    preferences: {
    language: "TypeScript",
    theme: "dark",
    },
    }),
    }],
    })
    );

    When to Use Resources:

  • When you need to provide context without actions

  • When data should be cacheable

  • When you want to expose structured information

  • When implementing subscriptions for live data
  • Prompts: Interaction Templates

    Prompts are reusable templates that help structure interactions with language models. They're particularly useful for standardizing common workflows.

    Characteristics:

  • Typically user-invoked (not model-controlled)

  • Can include parameters for customization

  • Help ensure consistent interactions

  • Great for complex multi-step workflows
  • Example Use Cases:

  • Code review templates

  • Bug report generators

  • Data analysis workflows

  • Content creation templates

  • System prompts for specific tasks
  • Code Example:

    server.prompt(
    "code-review",
    "Template for requesting a code review",
    {
    language: z.string().describe("Programming language"),
    focus: z.string().optional().describe("Areas to focus on"),
    },
    ({ language, focus }) => ({
    messages: [{
    role: "user",
    content: {
    type: "text",
    text: Please review the following ${language} code.
    ${focus ?
    Focus particularly on: ${focus} : ""}

    Look for:

  • Potential bugs

  • Performance issues

  • Security vulnerabilities

  • Code style improvements
  • Provide specific, actionable feedback.,
    },
    }],
    })
    );

    When to Use Prompts:

  • When you have repeatable workflows

  • When you want to standardize interactions

  • When complex instructions need to be consistent

  • When building guided experiences
  • How They Work Together

    The real power of MCP comes from combining these primitives. Here's an example of a code analysis server:

    Resources provide the code and project structure:

    server.resource("codebase", "file://project/src", ...);

    Tools perform analysis and modifications:

    server.tool("analyze_complexity", ...);
    server.tool("refactor_function", ...);

    Prompts guide the analysis workflow:

    server.prompt("full-audit", ...);

    The AI can:
    1. Read the codebase via resources
    2. Use the analysis tools to find issues
    3. Follow the audit prompt for thorough review
    4. Use refactoring tools to fix problems

    Decision Framework

    When designing your MCP server, ask these questions:

    "Does the AI need to DO something?" → Use a Tool

  • Sending messages

  • Modifying data

  • Executing commands

  • Calling APIs with side effects
  • "Does the AI need to KNOW something?" → Use a Resource

  • Reading files

  • Accessing configurations

  • Getting current state

  • Providing documentation
  • "Do users need GUIDED interactions?" → Use a Prompt

  • Standard workflows

  • Complex multi-step processes

  • Best practice templates

  • Consistent formatting needs
  • Common Patterns

    1. Tool + Resource Combo:
    Expose data as a resource, but allow modifications via tools:

    Resource: database://users (read users)
    Tool: update_user (modify users)

    2. Prompt + Tool Workflow:
    Prompt sets up the context, tools do the work:

    Prompt: data-migration (sets up migration plan)
    Tool: migrate_table (executes migration)

    3. Resource Hierarchy:
    Organize related data in resource trees:

    project://root
    project://root/src
    project://root/tests
    project://root/docs

    Security Considerations

    Each primitive has different security implications:

    Tools: Highest risk — can modify data, make API calls

  • Implement rate limiting

  • Require confirmation for sensitive operations

  • Log all tool invocations
  • Resources: Medium risk — could expose sensitive data

  • Implement access controls

  • Sanitize content before exposing

  • Be careful with dynamic resources
  • Prompts: Lower risk — but can influence AI behavior

  • Review prompt content for injection risks

  • Validate parameters carefully

  • Document expected behavior
  • Conclusion

    Understanding when to use tools, resources, and prompts is fundamental to building effective MCP servers. Tools enable action, resources provide context, and prompts guide workflows. Master these primitives, and you'll be able to build powerful AI integrations that feel natural and intuitive.

    Ready to put this knowledge into practice? Build your first MCP server or explore the top 10 MCP servers for inspiration.