Why are MCP Tools and Resources distinct primitives rather than one read or write abstraction?

MCP gives a server three ways to expose capability, and two of them are **Tools** and **Resources**. They look similar, but they differ on two axes: who starts the call, and whether it changes anything. A Tool is an action the model decides to invoke. It can have side effects: send an email, write a row, delete a file. Because the model picks when to fire it, and because it can change the world, a tool call often needs the user to approve it. A Resource is read only data the host application chooses to pull, like a file or a query result. It never mutates state, and the host decides whether to include it in context. The model does not trigger it directly. So why keep them separate rather than one read or write abstraction? Because the risk and the control direction differ. Reads are safe and host driven; actions are risky and model driven. Splitting them lets a host grant data access without granting action access, and ask for consent only where it matters.

MCP splits capability along two axes: who initiates the call, and whether it has side effects. Tools are model initiated and potentially side effecting. The LLM decides to call one, and it may write, delete, or trigger an external action. Resources are application controlled and read only. The host decides when to pull one, and it never mutates state. The model does not invoke a resource directly; it references data the host supplies. Collapsing both into one read/write abstraction would erase that boundary. You would lose the clean place to enforce least privilege. Keeping them distinct buys two things. First, security scoping. A host can grant read data access through Resources without granting action execution access through Tools. Those are different trust levels and deserve different grants. Second, consent modeling. Users can treat a resource pull as harmless context loading. A tool call may demand explicit approval because it can change the world. The interview grade phrasing is control direction plus side effect risk. Tools are the dangerous, model driven plane; Resources are the safe, host driven plane. The split makes that difference enforceable rather than implicit.