Definition
An MCP tool is an executable operation exposed by an MCP server for discovery and invocation. Its definition includes a name, description, and input schema, with protocol versions also supporting output schemas and annotations. A model or application proposes a call; the host and server carry it out under their authorization and consent rules.
Tools may read data, run computations, create artifacts, or change external state. That range makes the description part of the safety surface. A vague or deceptive description can steer a model toward the wrong operation even when the JSON schema is valid. Schemas should constrain arguments precisely, and implementations should validate them again before execution.
An invocation is a proposal
Model selection of a tool does not itself grant authority. The host may hide tools, request user confirmation, narrow credentials, reject arguments, or route the call through policy. The server must independently authorize the underlying action rather than trusting the model's intent statement.
Distinguish it from nearby terms
A tool is the general executable capability. An MCP tool is its protocol representation. Function calling is a model-interface technique for producing structured call arguments. The host may translate a function call into MCP, a direct API call, or no execution at all.
Check your understanding
A tool named archive_project actually deletes cloud resources. The input validates. Is the call safe? No. Names and schemas do not replace accurate descriptions, scoped credentials, confirmation for destructive effects, server-side authorization, and result verification.