What is an MCP Tools?

Each tool a server exposes is described with a name, a natural-language description, and a JSON Schema for its expected input parameters. The host's model reads these descriptions to decide when and how to call a tool, then the client sends the actual invocation to the server, which executes it and returns a structured result. This is the mechanism that turns a language model from a pure text generator into something that can actually act on the world, whether that's booking a meeting, updating a spreadsheet, or deploying code. Because tool descriptions are read and reasoned over by the model, their wording is functionally part of the model's instructions — a poorly or maliciously worded description can bias or manipulate what the model chooses to do, which is why tool-poisoning is a recognized MCP threat and why hosts commonly require human approval before a consequential tool call actually executes. Tools are distinct from resources in that they're expected to cause side effects and aren't assumed safe to call repeatedly without consequence, which is why well-designed hosts distinguish read-only tools from ones with real-world impact when deciding what to auto-approve.