Tool (MCP primitive)
Also called: function, function call
A named, schema-typed action an MCP server exposes for the model to invoke, with arguments the model fills in.
A tool is the "verb" of MCP: create_issue, run_query, send_email. The server declares its name and argument schema; the model chooses to call it and supplies the arguments; the server executes and returns a result. Tools are model-controlled by design — that is the point of the primitive.
Why it matters
Every tool is a capability granted to whatever is driving the model, including an attacker who has injected instructions. The blast radius of a compromise is exactly the set of tools available in that session and the privileges behind them. This is why tool allowlisting, per-tool approval, and least-privilege credentials matter more than any single filter.
Exposure map
Live counts of instances showing this pattern will appear here once the exposure map is collecting data.