MCP tool

What it is

Tools are the part of the Model Context Protocol that lets a model act: query a database, call an API, run a calculation. The specification calls them model-controlled, meaning the model decides when to use them based on the conversation. Each tool definition has:

• name, unique on the server, such as get_weather;
• an optional title for display;
• a description the model reads to decide when to use it;
• an inputSchema (JSON Schema) for the arguments, and optionally an outputSchema;
• optional annotations, hints such as whether the tool only reads.

Why it matters

The description and schema are effectively part of the prompt. A model chooses tools by reading them, so vague names, overlapping descriptions or loose schemas lead to wrong calls. Anthropic's agent guidance says tool definitions deserve as much prompt-engineering attention as the prompt itself.

How it works

1. The client sends tools/list (paginated) and passes the definitions to the model.
2. The model emits a tool call; the client sends tools/call with name and arguments.
3. The server returns content (text, images, links) and, when it declares an output schema, structuredContent.
4. Failures come back two ways: a JSON-RPC error for protocol problems such as an unknown tool, or a result with isError: true for execution problems such as a bad date. The specification says clients should pass execution errors to the model so it can correct itself.

Example

{
  "name": "create_ticket",
  "description": "Create a ticket in the service desk.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "title": {"type": "string"},
      "priority": {"type": "string", "enum": ["low", "medium", "high"]}
    },
    "required": ["title"]
  }
}

Common pitfalls

• One tool per endpoint. Mapping a large API one-to-one produces hundreds of tools. See tool overload.
• Trusting annotations. The specification says clients must treat annotations as untrusted unless they come from a trusted server; a "read-only" hint enforces nothing.
• Tool poisoning. The OWASP MCP cheat sheet treats the whole tool schema, not only the description, as a possible injection surface. See prompt injection.
• Errors without a next step. "400 Bad Request" teaches the model nothing; say what was wrong and what to send instead.

How actionlake handles it

The actionlake server exposes eight tools, and the list never grows: help, find_actions, get_action, do, ask, check, cost and account. The 289,000+ vendor actions are not tools. An agent searches them with find_actions, reads one action's full schema with get_action, and runs it with do, or asks a question across systems with ask. Only do and ask can cost money; the other six are free. Whatever a tool's hints say, the key's permissions decide what runs. See the eight tools on the docs page.