What is MCP Tool?

How It Works

An MCP Tool is the action primitive in the Model Context Protocol. A Server publishes a Tool definition, a Client discovers it, and a Host may present it to a model and route a selected call. The protocol does not make the model the executor or authority: the Server performs the bounded backend operation, while the Host and Server apply policy. A Tool differs from an MCP Resource, which exposes URI-addressed context, and an MCP Prompt, which provides a user-controlled interaction template. Function Calling is a model-provider interface that a Host may use to represent an MCP Tool, but it is not the MCP discovery, transport, authorization, or result protocol.

In MCP 2026-07-28, every tools/list and tools/call Request is stateless and carries the protocol version and relevant Client Capabilities in _meta. A Server that supports Tools declares the tools Capability through server/discover. Its list may be empty or filtered by credentials presented on the current Request, but it must not vary merely because another Request used the same Connection. Stable ordering, Pagination Cursor, truthful ttlMs and cacheScope, and notifications/tools/list_changed delivered only through a matching subscriptions/listen stream make discovery cacheable without turning a Connection into a Session.

A Tool definition contains a programmatic name, optional display title and icons, a model-facing description, mandatory inputSchema, optional outputSchema, and optional annotations. Names are case-sensitive by convention, should use 1 to 128 ASCII letters, digits, underscores, hyphens, or dots, and are unique only within one Server. A Host or Gateway aggregating Servers therefore needs a stable namespace tied to the configured Server identity; the self-reported serverInfo.name alone is not guaranteed unique. Description changes also need review because natural-language metadata influences selection even when the JSON shape is unchanged.

Tool schemas are JSON Schema contracts, not permission systems. A schema without $schema uses the 2020-12 dialect, and a no-argument Tool should still use an object Schema that states whether extra properties are accepted. Implementations must reject invalid or unsupported Schemas, must not automatically fetch network $ref targets, and should bound depth, subschema count, input bytes, arrays, strings, and validation time. The Server validates both structure and domain rules before execution: a syntactically valid repository, tenant, path, amount, or recipient can still be outside the caller's authority.

For Streamable HTTP, x-mcp-header can mark a statically reachable string, integer, or boolean input property for mirroring as Mcp-Param-*. Header names must satisfy HTTP token syntax and be unique case-insensitively; integers are limited to the interoperable safe range. Clients reject invalid definitions on that Transport. Passwords, API keys, tokens, PII, and other secrets must not be promoted into headers because intermediaries and logs may expose them. stdio Clients may ignore this extension.

A tools/call result uses resultType: "complete" when final and can return text, image, audio, Resource links, embedded Resources, or any JSON value in structuredContent. If outputSchema is declared, the Server must make structuredContent conform and the Client should validate it; a serialized JSON TextContent remains a compatibility fallback. Structural validity does not establish truth, freshness, authorization, or safety. Keep large artifacts behind scoped Resource links, label truncation and partial results, remove secrets and hidden backend fields, and treat every Tool result as untrusted data that cannot override Host policy.

Separate failures by layer. Malformed requests, unknown Tools, invalid protocol arguments, and internal protocol faults use JSON-RPC errors; an expected backend or domain failure can return a valid Tool result with isError: true, allowing a model or user to correct the call. Timeout, cancellation, transport loss, and a closed response stream do not prove that a downstream side effect was rolled back. Return stable machine-readable failure classes, preserve a Request ID, and expose whether an effect was not started, committed, compensated, or left with an unknown outcome without leaking stack traces or credentials.

Model-controlled does not mean pre-authorized. Authenticate the Principal and authorize the exact Server, Tool, Tenant, object, arguments, purpose, and side effect on every Request. OAuth Audience and Scope are coarse gates, while readOnlyHint, destructiveHint, idempotentHint, and other Tool annotations are untrusted hints rather than enforcement. Hosts should show the selected Tool and material arguments, let users deny calls, and require confirmation for consequential operations. Approval must bind to the reviewed arguments and policy revision; a previous approval or an unchanged Connection cannot authorize a modified call.

A Tool that needs Elicitation, Roots, or supported legacy Sampling during execution may return MRTR resultType: "input_required". The retry is a new Request with a new JSON-RPC ID, inputResponses, and any opaque requestState. Verify that state as attacker-controlled input, bind integrity-protected state to the Principal, Tool, salient argument digest, short expiry, and policy, and enforce one-time consumption when replay could duplicate an effect. Do not commit an irreversible action before required input and authorization complete. For retryable writes, enforce idempotency or transactional deduplication at the backend; an annotation cannot provide that guarantee.

Tool metadata and output create a semantic supply-chain boundary. Tool Poisoning can hide instructions in descriptions, Shadowing can influence other Tools, Rug Pulls can change metadata after review, and Tool output can carry indirect Prompt Injection. Pin the Server or package source where possible, record an immutable build and descriptor/schema hash, review changes before re-enabling consequential Tools, isolate credentials and egress, and keep Server-side allowlists independent of model judgment. Trace the Server identity, Tool and Schema revision, Principal and Tenant, authorization and approval decision, redacted argument digest, idempotency decision, result type, latency, cancellation, error class, and final effect status. A valid MCP message proves protocol shape, not that a Tool is trustworthy, necessary, or safe to execute.

Key Characteristics

• Protocol action primitive: a Server advertises a model-controlled operation while the Host and Server retain selection, consent, authorization, and execution policy
• Discoverable contract: tools/list returns deterministic, paginated, cache-scoped definitions and can notify subscribed Clients when the set changes
• Schema-bounded exchange: inputSchema validates arguments and optional outputSchema constrains structuredContent under an explicit JSON Schema dialect
• Per-request security: identity, Tenant, object, arguments, purpose, and side effects are authorized independently of Connections, scopes, and annotations
• Effect-aware execution: MRTR, cancellation, idempotency, transactions, and outcome states prevent retries or incomplete calls from silently duplicating work
• Semantic supply-chain surface: descriptions, annotations, schema revisions, and results require provenance, integrity review, isolation, and redacted audit evidence

Common Use Cases

1. Expose a bounded repository search operation with per-request project authorization and source-linked structured results
2. Create a support ticket only after displaying material fields, recording approval, and deduplicating retries with an idempotency key
3. Run parameterized read-only analytics with Tenant filters, query limits, timeout, result truncation, and no free-form SQL execution
4. Return a generated report as a scoped Resource link instead of injecting a large or sensitive artifact directly into model context
5. Route a remote API operation through Streamable HTTP with Audience validation, narrowly scoped credentials, cancellation, and effect-status auditing

Frequently Asked Questions

Related Tools

Related Terms

Related Articles