MCP Resources
Not everything an agent needs is an action. Often it just needs to read something: a file, a database row, a log, a page of documentation. In the Model Context Protocol those readable things are resources — data a server exposes for the agent to pull into its context, kept separate from the tools that do work.
How resources work
A resource is identified by a URI and described well enough to be chosen sensibly:
- Each has a URI such as file:///project/README.md or a custom scheme like db://orders/4821, plus a name, description and MIME type;
- The client calls resources/list to enumerate them — or expands a URI template for parameterised ones — then resources/read to fetch text or binary contents;
- A server can mark a resource subscribable and push a notification when it changes;
- Reads are application-controlled: the host decides what is attached, often letting the user pick, rather than the model helping itself.
That last point is the real difference from a tool. A tool call is a decision the model makes and may change the world; a resource read is inert context, chosen by the application around it.
Why it matters
It gives grounding a standard shape. Without resources, every request to let an agent see your data becomes a bespoke retrieval tool with its own conventions, and the agent must call a function merely to read a file. With them, context assembly stays auditable — you can see which documents a run was given — and read access can be granted without granting the ability to act.
MCP resources are read-only data items an MCP server exposes to an agent, each identified by a URI with a name, description and MIME type. The client lists and reads them, and may subscribe to changes. They are application-controlled context rather than model-invoked actions, which keeps grounding data separate from tools that have side effects — and makes read access grantable on its own.
There is a difference between letting someone read your filing cabinet and letting them rearrange it.
MCP resources are the reading half. When a service connects to an AI assistant, it can publish a list of things available to look at: documents, records, logs. Each one has an address, a name and a short description, so the right one can be picked out and pulled into the conversation.
Nothing is changed by reading it. That separation is deliberate — it lets you give an assistant access to information while keeping the power to act on that information behind a separate, tighter permission.