MCP servers expose three primitives: tools, resources, and prompts. They differ mainly in who decides when each one is used.
Tools are model-controlled. The LLM chooses and calls them mid-turn, normally behind user approval.
Resources are application-controlled. The host decides what data to read and attach as context.
Prompts are user-controlled. The user picks them on purpose, like a slash command or menu item.
This control axis should drive your design. Anything with side effects belongs in a tool, so the host can gate it. Plain read-only context belongs in a resource, so the host stays in charge of the context window. A workflow a person should trigger belongs in a prompt.
Sampling, roots, and elicitation are client primitives, not server ones.
Rewriting in plainer words…
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
What goes wrong if reading a resource triggers a side effect?The host can read resources without asking anyone, so the write skips the approval gate a tool call gets. Move it into a tool.
If tools are model-controlled, what stops a prompt-injected model from calling a dangerous one?User approval for side-effecting calls, server-side authorization and narrow permissions. Tool annotations are only hints, so never rely on them for safety.
What you can say
MCP servers offer three primitives, tools, resources and prompts, and the main difference is who decides when each one gets used.
Tools are model-controlled, so the LLM chooses and calls them mid-turn, normally behind a user approval step.
Resources are application-controlled, which means the host decides what data to read and attach as context.
Prompts are user-controlled, so a person picks one on purpose, like a slash command or a menu item.
Sampling, roots and elicitation sometimes get lumped in, but those are client primitives, not server ones.
That split should drive design, so anything with side effects goes in a tool the host can gate, read-only context in a resource, and a person-triggered workflow in a prompt.
Weak answers to avoid
Names the three with no word on controlListing tools, resources and prompts is the easy half. The question asks who controls each, so say model, host and user, and why that matters.
Calls resources just read-only toolsThe split isn't read versus write. The host picks resources and the model picks tools. Say who decides, then why side effects must be a tool.
Counts sampling or roots as server primitivesSampling, roots and elicitation are client primitives that the server asks the client for. Mixing them in shows you don't know which side offers what.
Puts side-effecting actions in a resourceThe host may read a resource without asking the user, so a write there skips approval. Anything with side effects belongs in a tool the host can gate.
Interview lens
Likely follow-ups, what you can say, and the weak answers to avoid.
