--- title: "MCP Architecture Explained: Tools, Resources, and Prompts (Deep Dive)" description: "MCP architecture explained: learn how MCP's three core primitives - tools, resources, and prompts - work together to connect AI agents to external systems. With examples, diagrams, and implementation guidance for 2026." source_url: "https://www.getknit.dev/blog/mcp-architecture-deep-dive-tools-resources-and-prompts-explained" page_type: "blog" --- _This is an educational blog post from Knit's blog: “MCP Architecture Explained: Tools, Resources, and Prompts (Deep Dive)”._ # MCP Architecture Explained: Tools, Resources, and Prompts (Deep Dive) The [Model Context Protocol (MCP)](https://www.getknit.dev/blog/what-is-the-model-context-protocol-mcp-the-new-standard-for-ai-tool-integration) is revolutionizing the way AI agents interact with external systems, services, and data. By following a client-server model, MCP bridges the gap between static AI capabilities and the dynamic digital ecosystems they must work within. In previous posts, we’ve explored the basics of [how MCP operates](https://www.getknit.dev/blog/how-mcp-works-a-look-under-the-hood-client-server-discovery-tools) and the types of problems it solves. Now, let’s take a deep dive into the core components that make MCP so powerful: **Tools**, **Resources**, and **Prompts**. Each of these components plays a unique role in enabling intelligent, contextual, and secure AI-driven workflows. Whether you're building AI assistants, integrating intelligent agents into [enterprise systems](https://getknit.dev/mcp-servers), or experimenting with multimodal interfaces, understanding these MCP elements is essential. #### **What Are Tools?** In the world of [MCP, **Tools**](https://getknit.dev/products/mcp-servers) **are action enablers**. Think of them as verbs that allow an AI model to move beyond generating static responses. Tools empower models to call external services, interact with APIs, trigger business logic, or even manipulate real-time data. These tools are not part of the model itself but are defined and managed by an MCP server, making the model more dynamic and adaptable. Tools help AI transcend its traditional boundaries by integrating with real-world systems and applications, such as messaging platforms, databases, calendars, web services, or cloud infrastructure. #### **Key Characteristics of Tools** * **Discovery**: Clients can discover which tools are available through the tools/list endpoint. This allows dynamic inspection and registration of capabilities. * **Invocation**: Tools are triggered using the tools/call endpoint, allowing an AI to request a specific operation with defined input parameters. * **Versatility**: Tools can vary widely, from performing math operations and querying APIs to orchestrating workflows and executing scripts. #### **Examples of Common Tools** * search\_web(query) – Perform a web search to fetch up-to-date information. * send\_slack\_message(channel, message) – Post a message to a specific Slack channel. * create\_calendar\_event(details) – Create and schedule an event in a calendar. * execute\_sql\_query(sql) – Run a SQL query against a specified database. #### **How Tools Work** An MCP server advertises a set of available tools, each described in a structured format. Tool metadata typically includes: * **Tool Name**: A unique identifier. * **Description**: A human-readable explanation of what the tool does. * **Input Parameters**: Defined using JSON Schema, this sets expectations for what input the tool requires. When the AI model decides that a tool should be invoked, it sends a call\_tool request containing the tool name and the required parameters. The MCP server then executes the tool’s logic and returns either the output or an error message. #### **Why Tools Matter** Tools are central to bridging model intelligence with real-world action. They allow AI to: * Interact with live, real-time data and systems * Automate backend operations, workflows, and integrations * Respond intelligently based on external input or services * Extend capabilities without retraining the model #### **Best Practices for Implementing Tools** To ensure your tools are robust, safe, and model-friendly: * **Use Clear and Descriptive Naming **Give tools intuitive names and human-readable descriptions that reflect their purpose. This helps models and users understand when and how to use them correctly. * **Define Inputs with JSON Schema **Input parameters should follow strict schema definitions. This helps the model validate data, autocomplete fields, and avoid incorrect usage. * **Provide Realistic Usage Examples **Include concrete examples of how a tool can be used. Models learn patterns and behavior more effectively with demonstrations. * **Implement Robust Error Handling and Input Validation **Always validate inputs against expected formats and handle errors gracefully. Avoid assumptions about what the model will send. * **Apply Timeouts and Rate Limiting **Prevent tools from hanging indefinitely or being spammed by setting execution time limits and throttling requests as needed. * **Log All Tool Interactions for Debugging **Maintain detailed logs of when and how tools are used to help with debugging and performance tuning. * **Use Progress Updates for Long Tasks **For time-consuming operations, consider supporting intermediate progress updates or asynchronous responses to keep users informed. **Security Considerations** Ensuring tools are secure is crucial for preventing misuse and maintaining trust in AI-assisted environments. * **Input Validation **Rigorously enforce schema constraints to prevent malformed requests. Sanitize all inputs, especially commands, file paths, and URLs, to avoid injection attacks or unintended behavior. Validate lengths, formats, and ranges for all string and numeric fields. * **Access Control **Authenticate all sensitive tool requests. Apply fine-grained authorization checks based on user roles, privileges, or scopes. Rate-limit usage to deter abuse or accidental overuse of critical services. * **Error Handling **Never expose internal errors or stack traces to the model. These can reveal vulnerabilities. Log all anomalies securely, and ensure that your error-handling logic includes cleanup routines in case of failures or crashes. **Testing Tools: Ensuring Reliability and Resilience** Effective testing is key to ensuring tools function as expected and don’t introduce vulnerabilities or instability into the MCP environment. * **Functional Testing **Verify that each tool performs its expected function correctly using both valid and invalid inputs. Cover edge cases and validate outputs against expected results. * **Integration Testing **Test the entire flow between model, MCP server, and backend systems to ensure seamless end-to-end interactions, including latency, data handling, and response formats. * **Security Testing **Simulate potential attack vectors like injection, privilege escalation, or unauthorized data access. Ensure proper input sanitization and access controls are in place. * **Performance Testing **Stress-test your tools under simulated load. Validate that tools continue to function reliably under concurrent usage and that timeout policies are enforced appropriately. ### **What Are Resources?** If **Tools are the verbs** of the Model Context Protocol (MCP), then **Resources are the nouns**. They represent structured data elements exposed to the AI system, enabling it to understand and reason about its current environment. Resources provide critical context—, whether it’s a configuration file, user profile, or a live sensor reading. They bridge the gap between static model knowledge and dynamic, real-time inputs from the outside world. By accessing these resources, the AI gains situational awareness, enabling more relevant, adaptive, and informed responses. Unlike Tools, which the AI uses to perform actions, Resources are passively made available to the AI by the host environment. These can be queried or referenced as needed, forming the informational backbone of many AI-powered workflows. ### **Types of Resources** Resources are usually identified by **URIs (Uniform Resource Identifiers)** and can contain either **text** or **binary** content. This flexible format ensures that a wide variety of real-world data types can be seamlessly integrated into AI workflows. #### **Text Resources** Text resources are UTF-8 encoded and well-suited for structured or human-readable data. Common examples include: * **Source code files** – e.g., file://main.py * **Configuration files** – JSON, YAML, or XML used for system or application settings * **Log files** – System, application, or audit logs for diagnostics * **Plain text documents** – Notes, transcripts, instructions #### **Binary Resources** Binary resources are base64-encoded to ensure safe and consistent handling of non-textual content. These are used for: * **PDF documents** – Contracts, reports, or scanned forms * **Audio and video files** – Voice notes, call recordings, or surveillance footage * **Images and screenshots** – UI captures, camera input, or scanned pages * **Sensor inputs** – Thermal images, biometric data, or other binary telemetry ### **Examples of Resources** Below are typical resource identifiers that might be encountered in an MCP-integrated environment: * file://document.txt – The contents of a file opened in the application * db://customers/id/123 – A specific customer record from a database * user://current/profile – The profile of the active user * device://sensor/temperature – Real-time environmental sensor readings ### **Why Resources Matter** * **Provide relevant context** for the AI to reason effectively and personalize output * **Bridge static model capabilities with real-time data**, enabling dynamic behavior * **Support tasks that require structured input**, such as summarization, analysis, or extraction * **Improve accuracy and responsiveness** by grounding the AI in current data rather than relying solely on user prompts * **Enable application-aware interactions** through environment-specific information exposure ### **How Resources Work** Resources are passively exposed to the AI by the host application or server, based on the current user context, application state, or interaction flow. The AI does not request them actively; instead, they are made available at the right moment for reference. For example, while viewing an email, the body of the message might be made available as a resource (e.g., mail://current/message). The AI can then summarize it, identify action items, or generate a relevant response, all without needing the user to paste the content into a prompt. This separation of data (Resources) and actions (Tools) ensures clean, modular interaction patterns and enables AI systems to operate in a more secure, predictable, and efficient manner. ### **Best Practices for Implementing Resources** * **Use descriptive URIs** that reflect resource type and context clearly (e.g., user://current/settings) * **Provide metadata and MIME types** to help the AI interpret the resource correctly (e.g., application/json, image/png) * **Support dynamic URI templates** for common data structures (e.g., db://users/{id}/orders) * **Cache static or frequently accessed resources** to minimize latency and avoid redundant processing * **Implement pagination or real-time subscriptions** for large or streaming datasets * **Return clear, structured errors** and retry suggestions for inaccessible or malformed resources ### **Security Considerations** * **Validate resource URIs** before access to prevent injection or tampering * **Block directory traversal and URI spoofing** through strict path sanitization * **Enforce access controls and encryption** for all sensitive data, particularly in user-facing contexts * **Minimize unnecessary exposure of sensitive binary data** such as identification documents or private media * **Log and rate-limit access** to sensitive or high-volume resources to prevent abuse and ensure compliance ### **What Are Prompts?** **Prompts** are predefined templates, instructions, or interface-integrated commands that guide how users or the AI system interact with tools and resources. They serve as structured input mechanisms that encode best practices, common workflows, and reusable queries. In essence, prompts act as a communication layer between the user, the AI, and the underlying system capabilities. They eliminate ambiguity, ensure consistency, and allow for efficient and intuitive task execution. Whether embedded in a user interface or used internally by the AI, prompts are the scaffolding that organizes how AI functionality is activated in context. Prompts can take the form of: * Suggestive query templates * Interactive input fields with placeholders * Workflow macros or presets * Structured commands within an application interface By formalizing interaction patterns, prompts help translate user intent into structured operations, unlocking the AI's potential in a way that is transparent, repeatable, and accessible. ### **Examples of Prompts** Here are a few illustrative examples of prompts used in real-world AI applications: * “Show me the **{metric}** for **{product}** in the **{time\_period}** region.” * “Summarize the contents of **{resource\_uri}**.” * “Create a follow-up task for this email.” * “Generate a compliance report based on **{policy\_doc\_uri}**.” * “Find anomalies in **{log\_file}** between **{start\_time}** and **{end\_time}**.” These prompts can be either static templates with editable fields or dynamically generated based on user activity, current context, or exposed resources. ### **How Prompts Work** Just like tools and resources, prompts are advertised by the MCP (Model Context Protocol) server. They are made available to both the user interface and the AI agent, depending on the use case. * In a **user interface**, prompts provide a structured, pre-filled way for users to interact with AI functionality. Think of them as smart autocomplete or command templates. * Within an **AI agent**, prompts help organize reasoning paths, guide decision-making, or trigger specific workflows in response to user needs or system events. Prompts often contain **placeholders**, such as {resource\_uri}, {date\_range}, or {user\_intent}, which are filled dynamically at runtime. These values can be derived from user input, current application context, or metadata from exposed resources. ### **Why Prompts Are Powerful** Prompts offer several key advantages in making AI interactions more useful, scalable, and reliable: * **Lower the barrier to entry** by giving users ready-made, understandable templates to work with; no need to guess what to type. * **Accelerate workflows** by pre-configuring tasks and minimizing repetitive manual input. * **Ensure consistent usage of AI capabilities**, particularly in team environments or across departments. * **Provide structure for domain-specific applications**, helping AI operate within predefined guardrails or business logic. * **Improve the quality and predictability of outputs** by constraining input format and intent. ### **Best Practices for Implementing Prompts** When designing and implementing prompts, consider the following best practices to ensure robustness and usability: * **Use clear and descriptive names** for each prompt so users can easily understand its function. * **Document required arguments and expected input types** (e.g., string, date, URI, number) to ensure consistent usage. * **Build in graceful error handling**, if a required value is missing or improperly formatted, provide helpful suggestions or fallback behavior. * **Support versioning and localization** to allow prompts to evolve over time and be adapted for different regions or user groups. * **Enable modular composition** so prompts can be nested, extended, or chained into larger workflows as needed. * **Continuously test across diverse use cases** to ensure prompts work correctly in various scenarios, applications, and data contexts. ### **Security Considerations** Prompts, like any user-facing or dynamic interface element, must be implemented with care to ensure secure and responsible usage: * **Sanitize all user-supplied or dynamic arguments** to prevent injection attacks or unexpected behavior. * **Limit the exposure of sensitive resource data or context**, particularly when prompts may be visible across shared environments. * **Apply rate limiting and maintain logs** of prompt usage to monitor abuse or performance issues. * **Guard against prompt injection and spoofing**, where malicious actors try to manipulate the AI through crafted inputs. * **Establish role-based permissions** to restrict access to prompts tied to sensitive operations (e.g., financial summaries, administrative tools). ### **Example Use Case** Imagine a **business analytics dashboard** integrated with MCP. A prompt such as: …can be presented to the user in the UI, pre-filled with defaults or values pulled from recent activity. Once the user selects the inputs, the AI fetches relevant data (via **resources** like db://sales/records) and invokes a **tool** (e.g., a report generator) to compile a summary. The prompt acts as the orchestration layer tying these components together in a seamless interaction. ## **The Synergy: Tools, Resources, and Prompts in Concert** While **Tools**, **Resources**, and **Prompts** are each valuable as standalone constructs, their true potential emerges when they operate in harmony. When thoughtfully integrated, these components form a cohesive, dynamic system that empowers AI agents to perform meaningful tasks, adapt to user intent, and deliver high-value outcomes with precision and context-awareness. This trio transforms AI from a passive respondent into a proactive collaborator, one that not only understands what needs to be done, but knows _how_, _when_, and _with what data_ to do it. ### **How They Work Together: A Layered Interaction Model** To understand this synergy, let’s walk through a typical workflow where an AI assistant is helping a business user analyze sales trends: 1. **Prompt **The interaction begins with a structured prompt: _“Show sales for product X in region Y over the last quarter.” _This guides the user’s intent and helps the AI parse the request accurately by anchoring it in a known pattern. 2. **Tool **Behind the scenes, the AI agent uses a predefined tool (e.g., fetch\_sales\_data(product, region, date\_range)) to carry out the request. Tools encapsulate the logic for specific operations—like querying a database, generating a report, or invoking an external API. 3. **Resource **The result of the tool's execution is a resource: a structured dataset returned in a standardized format, such as: data://sales/q1\_productX.json. This resource is now available to the AI agent for further processing, and may be cached, reused, or referenced in future queries. 4. **Further Interaction **With the resource in hand, the AI can now: * Summarize the findings * Visualize the trends using charts or dashboards * Compare the current data with historical baselines * Recommend follow-up actions, like alerting a sales manager or adjusting inventory forecasts Built for AI developers ### Enterprise MCP servers that implement all three primitives — out of the box. Knit's MCP Servers expose HRIS, ATS, and ERP data as Tools, Resources, and Prompts for any MCP-compatible agent — [Workday](https://md.getknit.dev/mcp-servers/workday-mcp-server), [BambooHR](https://md.getknit.dev/integration/bamboohr), Greenhouse, NetSuite, and 100+ more. No custom server to build or maintain. ### **Why This Matters** This multi-layered interaction model allows the AI to function with clarity and control: * **Tools** provide the _actionable capabilities_, the verbs the AI can use to do real work. * **Resources** deliver the _data context_, the nouns that represent information, documents, logs, reports, or user assets. * **Prompts** shape the _user interaction model_, the grammar and structure that link human intent to system functionality. The result is an AI system that is: * **Context-aware**, because it can reference real-time or historical resources * **Task-oriented**, because it can invoke tools with well-defined operations * **User-friendly**, because it engages with prompts that remove guesswork and ambiguity This framework scales elegantly across domains, enabling complex workflows in enterprise environments, developer platforms, customer service, education, healthcare, and beyond. ## **Conclusion: Building the Future with MCP** The **Model Context Protocol (MCP)** is not just a communication mechanism—it is an architectural philosophy for integrating intelligence across software ecosystems. By rigorously defining and interconnecting **Tools**, **Resources**, and **Prompts**, MCP lays the groundwork for AI systems that are: * **Modular and Composable**: Components can be independently built, reused, and orchestrated into workflows. * **Secure by Design**: Access, execution, and data handling can be governed with fine-grained policies. * **Contextually Intelligent**: Interactions are grounded in live data and operational context, reducing hallucinations and misfires. * **Operationally Aligned**: AI behavior follows best practices and reflects real business processes and domain knowledge. ### Next Steps: See how these components are used in practice: * [Simple Single-Server Integrations](https://getting-started-with-mcp-simple-single-server-integrations/) * [Using Multiple MCP Servers](https://scaling-ai-capabilities-using-multiple-mcp-servers-with-one-agent/) * [Agent Orchestration with MCP](https://advanced-mcp-agent-orchestration-chaining-and-handoffs/) * [Powering RAG and Agent Memory with MCP](https://powering-rag-and-agent-memory-with-mcp/) ### FAQs **1\. What is MCP architecture?** MCP (Model Context Protocol) architecture is the client-server framework that defines how AI models connect to external data sources and tools. In MCP architecture, an MCP host (the AI application - e.g. Claude Desktop or a custom agent) connects to one or more MCP servers via a standardised protocol. Each MCP server exposes three types of capabilities: tools (functions the AI can call to take actions), resources (data the AI can read for context), and prompts (reusable templates that structure how the AI interacts with that server). The protocol handles capability discovery, request/response formatting, and transport - so any MCP-compatible client can connect to any MCP-compatible server without custom wiring. Knit offers MCP servers, making enterprise data accessible to any MCP-compatible AI agent. **2\. What is the difference between MCP tools, resources, and prompts?**The three MCP primitives serve distinct roles. Tools are executable functions — the AI calls a tool to take an action (run a query, write a record, call an API). They are model-controlled: the AI decides when to call them based on the task. Resources are read-only data sources — the AI reads from a resource to get context (a file, a database record, a knowledge base). They are application-controlled: the host decides when to surface them. Prompts are reusable interaction templates — pre-defined workflows or instruction structures that guide how the AI should use the server's tools and resources for a given task. They are user-controlled: exposed to the user as selectable options rather than triggered autonomously by the model. **3\. What is the difference between MCP and a regular API?** A regular API requires a client to know exactly what endpoints exist, how to authenticate, what parameters to pass, and how to parse responses - all bespoke per API. MCP adds a discovery and standardisation layer on top: an MCP client can connect to any MCP server and automatically discover what tools, resources, and prompts it exposes, without prior knowledge of the server's implementation. For AI agents specifically, this matters because the model can reason about which tools to call based on their descriptions - rather than being hard-coded to call specific endpoints. MCP essentially makes APIs self-describing and AI-native. **4\. How does MCP client-server architecture work?**In MCP's client-server architecture, the MCP host (an AI application like Claude or a custom agent framework) contains an MCP client that manages connections to one or more MCP servers. Each server runs as a separate process - either locally or remotely - and exposes its capabilities (tools, resources, prompts) via the MCP protocol. When an AI agent needs to take an action or access data, the client sends a request to the appropriate server using JSON-RPC over the configured transport (stdio for local servers, HTTP/SSE for remote). The server executes the request and returns a structured response. This separation means servers can be built, deployed, and updated independently of the AI application - and a single agent can connect to multiple servers simultaneously, composing capabilities from many sources. **5\. How do Tools and Resources complement each other in MCP?** Tools perform actions (e.g., querying a database), while Resources provide the data context (e.g., the query result). Together they enable workflows that are both action-driven and data-grounded. **6\. What’s the difference between invoking a Tool and referencing a Resource?** Invoking a Tool is an active request (using `tools/call`), while referencing a Resource is passive, the AI can access it when made available without explicitly requesting execution. **7\. Why are JSON Schemas critical for Tool inputs?** Schemas prevent misuse by enforcing strict formats, ensuring the AI provides valid parameters, and reducing the risk of injection or malformed requests. **8\. How can binary Resources (like images or PDFs) be used effectively?** Binary Resources, encoded in base64, can be referenced for tasks like summarizing a report, extracting data from a PDF, or analyzing image inputs. **9\. What safeguards are needed when exposing Resources to AI agents?** Developers should sanitize URIs, apply access controls, and minimize exposure of sensitive binary data to prevent leakage or unauthorized access. **10\. How do Prompts reduce ambiguity in AI interactions?** Prompts provide structured templates (with placeholders like `{resource_uri}`), guiding the AI’s reasoning and ensuring consistent execution across workflows. **11\. Can Prompts dynamically adapt based on available Resources?** Yes. Prompts can auto-populate fields with context (e.g., a current email body or log file), making AI responses more relevant and personalized. **12\. What testing strategies apply specifically to Tools?** Alongside functional testing, Tools require integration tests with MCP servers and backend systems to validate latency, schema handling, and error resilience. **13\. How do Tools, Resources, and Prompts work together in a layered workflow?** A Prompt structures intent, a Tool executes the operation, and a Resource provides or captures the data—creating a modular interaction loop. **14\. What’s an example of misuse if these elements aren’t implemented carefully?** Without input validation, a Tool could execute a harmful command; without URI checks, a Resource might expose sensitive files; without guardrails, Prompts could be manipulated to trigger unsafe operations. ## Related pages - [How Knit works](https://md.getknit.dev/how-knit-works) - [Unified API product](https://md.getknit.dev/products/unified-api)