What Are Resources in MCP?

📘 Content, addressed rather than invoked

A resource is content an MCP server makes readable to a caller. Each one is identified by a URI, and a client reads it by asking for that URI. The server publishes a list of what it offers, and may offer parameterised forms — a template with a slot in it — so that a family of addressable items can be described without enumerating every member of it.

The defining difference from a tool is that a resource is addressed rather than invoked. Reading one is not expected to change anything, which makes it safe to read speculatively, to cache, and to read again. That expectation is exactly what lets a host pull a resource into context without the approval step it would put in front of an operation that has side effects.

A read returns the content that address identifies, together with an indication of what kind of content it is, as text or as bytes. Nothing requires a resource to be a file, and frequently it is not: a record assembled on request, the result of a query, a view of something held in an entirely different shape. Listing and reading are also deliberately separate steps — a listing gives names, descriptions and types, which is usually enough for an application to choose from without fetching everything first.

Nor does anything stop a server from publishing an operation that returns the same material a resource already exposes. Where both exist the difference is not what comes back; it is who is expected to decide that it should. One is content an application reaches for on its own terms, the other an operation something chose to call, and a host that treats invocation as the point at which it asks a person will treat the two differently even though the bytes are identical.

🧩 Who chooses, and what happens when the content moves

Which resources reach a conversation is normally decided by the application or by the person using it, rather than selected automatically in the middle of an exchange. That is the control model rather than a limitation. Content occupies room in a conversation, and how much of that room to spend on what is a judgement the application is positioned to make and a server is not.

Content also moves, and a session that read something an hour ago is holding a copy. A server can announce that its list of resources has changed, and a client can additionally ask to be told when one particular item it cares about is updated. Neither is automatic: a server offering no notification is not misbehaving, and neither is a client that never asks for one — which is why a long-lived session should be explicit about which of its material is a snapshot.

📐 The address is the server’s own

A resource is content the server chose to publish, addressed the way the server chose to address it. The URI scheme belongs to that server: it is an identifier within that connection, not a promise that the same address means anything anywhere else.

⚙️ How the Registry classifies exposing documents for reading

Publishing existing documents for reading and retrieving one back through a client is retrieval over material that already exists, which the information retrieval class covers. On the order form's task class field, select Information retrieval, which covers search, information gathering, research, summarisation. That class has its own page at /tasks/retrieval.

The Registry files this topic under one canonical task, fixed in advance and published here rather than generated per visit:

Expose a folder of internal policy documents as MCP resources and read one of them back through a client.

That string, hashed once, is 4444ccc0e13eb561… — the first sixteen of sixty-four hex characters. An assessment ordered against a task of this kind is computed from the class, the wording submitted, and the permanent chart the Registry derives for the model configuration named on the order: its ascendant, its ruling planet, and the composite harmony that constrains the range of verdicts available to it. The whole derivation is published at /method.

The risk in resource work is exposure by convenience: a directory published wholesale because choosing was harder, then read in full by something that needed one file out of it. 4 risk factors are tracked for information retrieval tasks generally; an assessment reports 3 of them, selected by the submitted task's own seed rather than chosen. Their names, severities and descriptions are certificate content and are not published on a free page.

Get Assessment

📏 What this page does not claim

The Registry makes no representation that an assessment predicts the outcome of any task, and no assessment is validated against real-world results.

This page defines a term and states a classification. It publishes no verdict: the Registry does not test implementations, does not measure how often anything works, and has never run the canonical task above against any model. Which documents are published, how they are addressed, and what is deliberately left unpublished are decisions the canonical brief does not make.

What is sold is a permanent, numbered assessment for one submitted task at one model configuration — a verdict on a seven-point scale, a recommended execution window, and, above the first tier, the risk factors the class tracks. EUR 1.90 Standard, EUR 4.90 Extended, and EUR 14.90 Full Chart, which adds the permanent chart for the configuration itself. Assessments from EUR 1.90; machine-readable at /pricing.json.

🔗 Related surfaces

← All MCP topics · The AFR-1 method · Information retrieval task class

Related topics: Tools · Prompts · Listing and discovery

❓ Questions about a resource

What is a resource in MCP?

Content a server makes readable, identified by a URI. A client lists what is available and reads one by asking for its address.

How is a resource different from a tool?

A resource is read; a tool is invoked and may change something. Reading is not expected to have side effects, which is why a host can pull a resource into context without the approval step an operation usually receives.

Does a resource have to be a file?

No. A URI is an identifier the server resolves however it chooses. A resource may be a record assembled on request, the result of a query, or a view of something that exists in an entirely different shape.

Who decides which resources are used?

Normally the application or the person using it. Resources are addressed content rather than operations offered for automatic selection, and a server may notify a client when the available list changes.

How does a caller learn that a resource has changed?

A server can announce that its list has changed, and a client can ask to be told when a particular item is updated. Neither happens by default, so a session that has been open for a while may be working from a copy that was accurate only when it was read.