MCP explained: tools, resources and prompts without an open back door

What MCP solves

MCP standardises how an AI application discovers and uses context and capabilities from external systems. A host manages the experience, clients maintain connections and servers expose bounded functions. The standard improves integration consistency but does not certify that a server is trustworthy.

Tools perform actions

A tool suits a targeted action such as finding a ticket or creating a draft record. Define its name, input schema, errors and side effects precisely. A few narrow business operations are easier to secure than a general “run query” tool.

Resources provide read context

Resources represent readable information an application can add to context. Share only what the task needs, apply each user’s access rules and prevent general resources from including sensitive fields by default.

Prompts are reusable starting points

A server can offer predefined prompts for known processes. Treat them as user-selected templates rather than hidden system policy. Show which context is added and let the user inspect parameters.

No. The host, authentication and access rules determine which servers and functions are available.

Secure the complete chain

Authentication alone is insufficient. Restrict scopes, validate redirect targets, prevent tokens being passed through to other systems and request confirmation for mutations. Do not trust metadata from an unknown server without review.

Operate the connection in production

Maintain an inventory of servers, owners, data categories and allowed actions. Log technical events without sensitive content, test access revocation and reassess connections whenever specifications or vendors change.

{"tools":["create_ticket"],"resources":["support://policy"],"prompts":["triage_request"]}

Make MCP tools, resources and prompts verifiable

The decision review for MCP tools, resources and prompts first focuses on one read resource and one narrow tool with separate schemas, minimum scopes and visible mutation consent. Define the acceptable user outcome, essential inputs and authorised approver for MCP tools, resources and prompts before the trial starts. Keep the first MCP tools, resources and prompts trial small enough to separate causes from effects.

Build evidence for MCP tools, resources and prompts around one realistic successful route and also simulate an overbroad scope, token passthrough to another system and misleading server metadata or tool descriptions. For every MCP tools, resources and prompts check, record the expected outcome, visible evidence and recovery action when it fails. The final decision question for MCP tools, resources and prompts is: “Does MCP automatically grant an agent access?”

MCP tools, resources and prompts: from trial to everyday operation

Assign MCP tools, resources and prompts one operational owner, one subject reviewer and a clear fallback route. Treat the MCP tools, resources and prompts checklist as separate evidenced steps, so punctuation or phrasing never becomes part of the process logic. Ask the relevant user to complete MCP tools, resources and prompts without spoken help and record every point that still needs explanation or manual recovery.

Keep change rights, logging, support and review dates for MCP tools, resources and prompts in one operating plan. Repeat the MCP tools, resources and prompts trial after a change to source data, configuration, model, integration or user role. Expand MCP tools, resources and prompts only when the team can also detect, contain and recover an overbroad scope, token passthrough to another system and misleading server metadata or tool descriptions.

Stop the MCP tools, resources and prompts rollout while an overbroad scope, token passthrough to another system and misleading server metadata or tool descriptions is not reported visibly and recoverable by the assigned owner.