Resource (MCP primitive)
A piece of data an MCP server makes readable to the model or host — a file, a record, a document — identified by a URI.
Where a tool is an action, a resource is content: the server lists resources by URI and the client can read them into context. Resources are meant to be application-controlled (the host decides what to load) rather than model-controlled, though implementations vary.
Why it matters
Resource contents are untrusted input. If a server exposes, say, the text of incoming support tickets as resources, then anyone who can file a ticket can put text in front of the model. This is the delivery mechanism for indirect prompt injection, and it is easy to overlook because "just reading a document" doesn't feel like running untrusted code — but for a language model, it is.
Exposure map
Live counts of instances showing this pattern will appear here once the exposure map is collecting data.