MCP servers expose three kinds of capability, distinguished by who decides when they are used.
Tools are model-controlled. They are executable functions (query a database, send a message, create a ticket) that the language model chooses to invoke during generation. Invocation is subject to host approval. Tools are the action surface and carry the most risk, so hosts typically require user confirmation for consequential calls.
Resources are application-controlled. They are read-only data items with an address, such as a file, schema, or log stream. The host decides when to fetch and attach them.
Prompts are user-controlled. They are reusable, parameterized message templates the server publishes, which hosts typically surface as slash commands or menu items.
For example, a code review server might expose a review_pr prompt that the user selects. The application could attach a git://repo/diff resource, while the model could call a post_review_comment tool after approval.
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
Why there's no diagram: “”
The interactive diagram is below the answer - jump to diagram ↓ · Below it, the related concept . Jump to it ↓
The diagram below the answer is the concept . Jump to it ↓