Which statements correctly describe the MCP primitive types?

An MCP server can expose three kinds of capability, and the trick is knowing who starts each one. **Tools** are the model's lever. The LLM decides to call a tool, like `send_email` or `run_query`, and the call can change the outside world. Each tool ships an `inputSchema` so the model knows what arguments to fill in. Resources are read-only data the host application pulls in. Think of a file, a database row, or a document chunk, addressed by a URI. The model references them, but it does not invoke them and cannot write back through them. Prompts are reusable message templates the server registers. The host surfaces them to the user, often as slash-commands or menu items. The user picks one, fills in any slots, and it expands into a starting message. So the recall pattern is simple: tools are model-initiated and can have side effects, resources are application-initiated and read-only, prompts are user-initiated templates.

MCP servers expose three primitive types, distinguished by who initiates them. **Tools** are model-initiated. The LLM decides to call one, and the call may produce side effects on external systems. Every tool ships an `inputSchema` that tells the model how to form valid arguments. This is the primitive closest to classic function calling. Resources are application-initiated and read-only. The host pulls them by URI and feeds the bytes into context. The model can reference a resource but never invokes it directly, and there is no write path back through a resource. Files, query results, and document chunks all fit here. Prompts are user-initiated templates the server registers. The host surfaces them on user-facing surfaces, typically as slash-commands. The user picks one, fills any slots, and it expands into a seed message. The distractors flip the initiator. Resources are not model-initiated and cannot write data back. And the spec does not mandate user approval before every call across all three primitives. Approval is a host-side safety practice for tool calls, not a universal protocol rule.