What Are Tools in MCP?

📘 What a tool is made of

A tool is a named operation an MCP server offers for invocation. It is published with three things: a name, a human-readable description of what it does, and a schema describing the arguments it takes. A caller lists the tools a server offers, chooses one, and sends a request naming it with arguments; the server executes it and returns the result.

The schema is what makes the arrangement workable. Because arguments are described rather than assumed, a caller that has never seen the tool before can construct a valid call, and a host can check a proposed call against the schema before anything executes. That check is cheap and it happens before any side effect, which is the reason the description is machine-readable rather than prose.

Tools are the primitive intended to be selected during an exchange, in contrast to resources, which are addressed and read, and prompts, which a person normally picks. That is a statement about who initiates, not about what is technically possible, and it is why the three exist separately instead of as one general mechanism. Because an invocation may have side effects — writing a record, sending a message, spending money — hosts commonly place an approval step in front of one. The specification leaves that decision entirely to the host, so two applications connected to the same server can treat the same operation very differently.

🧩 Three properties that are easy to assume wrongly

What comes back is content rather than a typed return value in the caller’s language. The result is material meant to be read — by the application, and usually by whatever the host is assembling a conversation for — which is why the argument schema carries the contract and the return does not. It also means nothing in the loop compiles: no step anywhere checks that the behaviour still matches the sentence advertising it.

A tool may additionally be published with hints about its own behaviour: that it only reads, that it is destructive, that repeating it changes nothing. Hints are useful, and they are a server’s declarations about itself, which is the whole of their standing. A caller treating one as a guarantee has chosen to trust a server’s account of its own operations — a decision that properly belongs with the decision to connect to that server in the first place.

And a tool name means something inside one server’s list and nowhere else. Two servers may publish the same name for unrelated work, and a host connected to both keeps them apart by connection rather than by name. Nor is the binding permanent: what a server offers is established by listing, at run time, each time a session opens, and a server that has changed since yesterday was under no obligation to announce it in advance.

📐 The description is the interface

A tool description is documentation with consequences rather than decoration. It is the only account of the operation a caller ever sees, so an ambiguous description is an ambiguous interface, and no amount of correctness in the implementation behind it compensates for that.

⚙️ How the Registry classifies adding a tool to a server

Adding an operation to a server and describing its input schema for the calling agent is code written against a running integration, which the code modification class covers. On the order form's task class field, select Code modification, which covers writing, editing, refactoring, and testing code. That class has its own page at /tasks/code.

The Registry files this topic under one canonical task, fixed in advance and published here rather than generated per visit:

Add a tool to an MCP server that files a support ticket, and describe its input schema for the calling agent.

That string, hashed once, is 06fd4e890e6ea6f8… — the first sixteen of sixty-four hex characters. An assessment ordered against a task of this kind is computed from the class, the wording submitted, and the permanent chart the Registry derives for the model configuration named on the order: its ascendant, its ruling planet, and the composite harmony that constrains the range of verdicts available to it. The whole derivation is published at /method.

The risk in tool work is a description narrower or wider than the behaviour behind it — an operation that quietly does more than its own name admits to doing. 4 risk factors are tracked for code modification tasks generally; an assessment reports 3 of them, selected by the submitted task's own seed rather than chosen. Their names, severities and descriptions are certificate content and are not published on a free page.

Get Assessment

📏 What this page does not claim

The Registry makes no representation that an assessment predicts the outcome of any task, and no assessment is validated against real-world results.

This page defines a term and states a classification. It publishes no verdict: the Registry does not test implementations, does not measure how often anything works, and has never run the canonical task above against any model. What the operation does when the system underneath rejects it, and whether the host requires approval before it runs, sit outside the canonical brief.

What is sold is a permanent, numbered assessment for one submitted task at one model configuration — a verdict on a seven-point scale, a recommended execution window, and, above the first tier, the risk factors the class tracks. EUR 1.90 Standard, EUR 4.90 Extended, and EUR 14.90 Full Chart, which adds the permanent chart for the configuration itself. Assessments from EUR 1.90; machine-readable at /pricing.json.

🔗 Related surfaces

← All MCP topics · The AFR-1 method · Code modification task class

Related topics: Resources · Prompts · MCP server

❓ Questions about a tool

What is a tool in MCP?

A named operation a server publishes for invocation, with a description and a schema for its arguments. A caller lists the tools a server offers, sends a request naming one with arguments, and receives the result.

How does a caller know what arguments a tool takes?

From the schema published alongside the tool. It describes the argument names, their types and which of them are required, so a call can be constructed and validated before it is sent.

What is the difference between a tool and a resource?

A tool is invoked and may change something. A resource is addressed by URI and read, and reading it is not expected to change anything. That difference is why both exist instead of one general mechanism.

Can a tool call change something?

Yes. Nothing in the protocol prevents an operation from writing, sending or spending. A server may publish a hint that an operation only reads or that it is destructive, but a hint is the server describing itself, and whether a person is asked before the call runs is decided by the host.

Are tool names unique across servers?

No. A name identifies an operation within one server’s list. Two servers may publish the same name for unrelated work, and a host connected to both tells them apart by connection rather than by name.