What is MCP Tool?
MCP Tool is an executable capability exposed by an MCP Server, described with a name, natural-language description, input schema, and structured result that an AI application can request through the protocol.
Quick Facts
| Specification | Official Specification |
|---|
How It Works
An MCP Tool is the action-oriented primitive in MCP. Unlike a resource, which is primarily read-oriented context, a tool performs an operation: querying a database, sending a message, creating a ticket, searching documents, or transforming data. Because models may choose tools based on names, descriptions, and schemas, tool definitions must be precise, minimally scoped, and honest about side effects. High-risk tools should require approval or additional policy checks before execution.
Key Characteristics
- Executable primitive: represents an operation rather than passive context
- Schema-described input: uses structured parameters so clients and models understand required arguments
- Side-effect aware: may read, write, send, create, delete, or trigger external systems
- Model-facing description: names and descriptions influence when an AI application selects the tool
- Policy-sensitive: destructive, costly, or external actions should require guardrails or approval
Common Use Cases
- Searching an internal knowledge base from an AI assistant
- Creating a support ticket after a user confirms the generated summary
- Running a read-only SQL query with strict row and permission limits
- Formatting or transforming data on behalf of an agent workflow
- Calling an internal API through a controlled MCP wrapper
Example
Loading code...Frequently Asked Questions
How is an MCP Tool different from function calling?
Function calling is a model or API feature for structured tool selection. MCP Tool is a protocol-level capability exposed by an MCP Server. They can work together: a model may choose an MCP tool through a function-calling style interface.
What makes a good MCP Tool description?
It should clearly state what the tool does, when to use it, what it does not do, whether it has side effects, and any required preconditions. Vague descriptions lead to poor tool selection.
Should MCP Tools be broad or narrow?
They should usually be narrow enough to validate and govern. Overly broad tools such as execute_any_command or call_any_api are difficult to secure and easy for agents to misuse.
When should an MCP Tool require approval?
Approval should be required for external side effects, destructive changes, financial actions, message sending, permission changes, or operations that expose sensitive data.