MCP has tools, resources, and prompts. What makes a resource different from a tool?

Flashcard·Easy·4.0 · 0·~30s·Asked atAccenture Uniphore Voyage Ai·Relevant atAnthropic

Attempt it

A resource is read only data the server exposes to the host, identified by a URI (for example file:///path/to/doc, postgres://table/rows). The host, not the LLM, decides when to pull or subscribe to a resource and how to inject the content into the model's context. Resources are application controlled and side effect free. Tools are model initiated and may have side effects. The two primitives exist because read only data and actions that change state deserve different invocation patterns and different policy gates.

Your answer

**A resource** is one of the three primitives an MCP server can expose, alongside tools and prompts. It represents a piece of read only data: a file, a database row, a web page, anything the server wants to make available for the model to see. The core properties are read only and host pulled. **Read only** means there is no write operation in the resource API by design; resources cannot modify anything. **Host pulled** means the host application decides when to fetch a resource and what to include in the model's context. The model never emits 'please read resource X'; the host makes that decision. Each resource has a URI that identifies it. `file:///path/to/doc.md` points at a local file. `postgres://schema/table/rows` points at database content. Servers define their own URI schemes for whatever data they expose. The lifecycle is small. The client calls `resources/list` to discover available resources. The host picks one and calls `resources/read` to fetch the content, which then gets injected into the conversation. Optionally the host can subscribe to a resource with `resources/subscribe` and receive a notification when the data changes. The contrast with tools is the anchor: tools are model invoked and may cause side effects; resources are host pulled and strictly read only.

**A resource** is a piece of read only data exposed by an MCP server, identified by a URI, and pulled by the host (not the model) for inclusion in the model's context. Resources sit alongside tools and prompts in the three primitive families MCP servers expose. **Tools** are model invoked and may have side effects. **Resources** are host pulled and strictly read only. **Prompts** are user invoked parameterized templates. The three exist because three distinct invocation patterns mattered enough to standardize separately, and resources own the read only data slot. Each resource is identified by a URI. The URI scheme tells the host what kind of data it points at: `file:///` for filesystem paths, `postgres://` for database content, `https://` for web pages, and server specific schemes for everything else (a GitHub server might expose `github://owner/repo/issues/42`). Servers also support URI templates with parameters when the resource set is generative rather than enumerable: a Postgres server can advertise `postgres://{table}/rows` instead of listing every table individually. The lifecycle has three JSON-RPC methods. **resources/list** returns available resources or templates. **resources/read** fetches the content of a specific URI as one or more content blocks. **resources/subscribe** registers interest in updates; when the data changes, the server sends `notifications/resources/updated` and the host can re fetch. The model never picks a resource. The host decides when to fetch and what to inject. This deliberate asymmetry keeps the model from accidentally exfiltrating or modifying data through the resource layer; when you want the model to act, use tools instead.

TL;DR

A resource is read only, URI identified data that the host (not the model) pulls and injects into context. Tools are model invoked and may have side effects; resources inform without acting.

Memory aid

Easy to grasp

Think of the AI app as someone with a library card. The librarian (the MCP server) keeps a catalog of documents, each with a unique address like a call number. When the app decides the model needs to see a document, the app goes to the librarian and asks for it. The model never walks to the shelves itself; only the app does. And nothing the app does to a document changes it: there is no write back, no edit, no delete. Resources are how MCP lets a server share read only context with the model without giving the model the keys to modify anything. Files, database rows, web pages, log snippets: any blob of data that should be read but never changed through this channel can be a resource.

Key concepts

Resource URI Host Application Tool

Concept explanation~2 min read

Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.

A resource is the MCP primitive for read only data. It sits alongside tools (which act) and prompts (which the user invokes) in the three primitive model the protocol defines. Of the three, resources are the most often confused because they look superficially like tools but behave very differently in practice.

This deep dive walks through what a resource is, the URI based identification scheme, the JSON-RPC methods that operate on resources, the host pull invocation model, the subscription pattern, and how resources differ from tools in design intent. By the end you should be able to look at a real world capability and confidently decide whether it should be a tool or a resource.

The definition, unpacked

A resource is a piece of read only data the server exposes to the host, identified by a URI, that the host can pull and inject into the model's context.

Four load bearing pieces sit in that definition. Read only means resources have no write operation by protocol design. The server returns content; nothing in the resource API modifies the underlying data. Server exposed means resources are declared by the server and advertised through the standard JSON-RPC methods; clients discover them via resources/list. URI identified means each resource has a unique URI (a file path, a database reference, a web URL, a server specific scheme); the URI is how clients and servers refer to the data. Host pulled means the host (not the model) decides when to fetch a resource and what to do with the content.

The contrast with tools is sharp on every axis. Tools have flat names; resources have URIs. Tools are model invoked; resources are host pulled. Tools may have side effects; resources are strictly read only. The asymmetry is intentional: the two primitives exist because read only data and side effecting actions deserve different invocation patterns and different policy gates.

URI based identification and URI templates

The three JSON-RPC methods: list, read, subscribe

Host pull versus model invoke: why the asymmetry matters

Real world resource examples and how they fit

Situations where this technique stops working.

2–4 min · Everything important, quickly.

Real products, models, and research that use this idea.

Filesystem server exposes files under configured roots as `file:///path` resources; the host can read any file the server is allowed to see and inject it into conversation context.
Postgres and SQLite servers expose table contents as `postgres://` resources, often using URI templates for browsing schemas and tables without listing every row.

What an interviewer would ask next. Try answering before peeking at the approach.

QWhy are resources host pulled and not model invoked?

Two reasons. First, it keeps the model from accidentally exfiltrating data it should not have access to; the host applies policy before injecting any resource content. Second, it matches a common UX pattern where the host or user decides which context to include based on application logic, not based on the model guessing the user's intent.

2 more follow-ups an interviewer would ask next. Sign in to reveal them.

Red flags & common mistakes

The phrases that signal junior thinking. Click to expand.

Most common mistake

Believing the model invokes resources directly. The host pulls resources and decides when to inject the content; the model only sees what the host chose to include.

60 second bullets to scan on the way to the call.

Define an MCP resource using the read only and host pulled framing
Name the identification scheme used for resources (URIs)

Primary sources. Browse if you want the original framing.