---
title: "What is an MCP tool? Definition and schema - actionlake"
description: "An MCP tool is a named function an MCP server offers to AI models, with a description and a JSON Schema. How tools are listed and called, and what goes wrong."
canonical: https://actionlake.com/glossary/mcp-tool
updated: 2026-10-24
---

Model Context Protocol

# MCP tool

An MCP tool is a named function that an MCP server offers to AI models, described by a name, a plain-language description and a JSON Schema for its input, and invoked with a tools/call request.

Updated 24 October 2026 Also called Model Context Protocol tool 3 sources checked

**On this page**

Connect an agent to every system you run.

100,000 calls free a month. No card.

[Start free](https://actionlake.com/console?start=sandbox)

## What it is

Tools are the part of the [Model Context Protocol](https://actionlake.com/glossary/mcp) that lets a model act: query a database, call an API, run a calculation. The specification calls them model-controlled, meaning the model decides when to use them based on the conversation. Each tool definition has:

- `name`, unique on the server, such as `get_weather`;
- an optional `title` for display;
- a `description` the model reads to decide when to use it;
- an `inputSchema` (JSON Schema) for the arguments, and optionally an `outputSchema`;
- optional `annotations`, hints such as whether the tool only reads.

## Why it matters

The description and schema are effectively part of the prompt. A model chooses tools by reading them, so vague names, overlapping descriptions or loose schemas lead to wrong calls. Anthropic's agent guidance says tool definitions deserve as much prompt-engineering attention as the prompt itself.

## How it works

1. The client sends `tools/list` (paginated) and passes the definitions to the model.
2. The model emits a [tool call](https://actionlake.com/glossary/tool-calling); the client sends `tools/call` with `name` and `arguments`.
3. The server returns `content` (text, images, links) and, when it declares an output schema, `structuredContent`.
4. Failures come back two ways: a JSON-RPC error for protocol problems such as an unknown tool, or a result with `isError: true` for execution problems such as a bad date. The specification says clients should pass execution errors to the model so it can correct itself.

## Example

```json
{
  "name": "create_ticket",
  "description": "Create a ticket in the service desk.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "title": {"type": "string"},
      "priority": {"type": "string", "enum": ["low", "medium", "high"]}
    },
    "required": ["title"]
  }
}
```

## Common pitfalls

- **One tool per endpoint.** Mapping a large API one-to-one produces hundreds of tools. See [tool overload](https://actionlake.com/glossary/tool-overload).
- **Trusting annotations.** The specification says clients must treat annotations as untrusted unless they come from a trusted server; a "read-only" hint enforces nothing.
- **Tool poisoning.** The OWASP MCP cheat sheet treats the whole tool schema, not only the description, as a possible injection surface. See [prompt injection](https://actionlake.com/glossary/prompt-injection).
- **Errors without a next step.** "400 Bad Request" teaches the model nothing; say what was wrong and what to send instead.

## How actionlake handles it

The actionlake server exposes eight tools, and the list never grows: `help`, `find_actions`, `get_action`, `do`, `ask`, `check`, `cost` and `account`. The 289,000+ vendor actions are not tools. An agent searches them with `find_actions`, reads one action's full schema with `get_action`, and runs it with `do`, or asks a question across systems with `ask`. Only `do` and `ask` can cost money; the other six are free. Whatever a tool's hints say, the key's [permissions](https://actionlake.com/glossary/ai-agent-permissions) decide what runs. See the eight tools on the [docs page](https://actionlake.com/docs).

## Questions

**How many tools should an MCP server expose?**

As few as the job allows. Anthropic's documentation says Claude's tool selection degrades past 30 to 50 tools, so large catalogues are better searched on demand than loaded whole.

**What is the difference between an MCP tool and an MCP resource?**

A tool is a function the model can invoke, and it may change things. A resource is data the model or the person can read, identified by a URI.

**Are MCP tool annotations enforced?**

No. Annotations such as readOnlyHint are hints from the server. The specification tells clients to treat them as untrusted unless the server is trusted; enforcement has to live on the server.

## Related terms

- [Tool calling Tool calling, also called function calling, is a language model's ability to answer with a structured request to run a named function with arguments, which the application executes before handing the result back to the model.](https://actionlake.com/glossary/tool-calling)
- [MCP server An MCP server is a program that offers tools, resources and prompts to AI applications over the Model Context Protocol, usually by wrapping one system's API, such as a ticket desk or an accounting ledger.](https://actionlake.com/glossary/mcp-server)
- [Tool overload Tool overload is the loss of accuracy and context space that happens when an AI model is given more tool definitions than it can reliably choose between; Anthropic's documentation says Claude's tool selection degrades once more than 30 to 50 tools are available.](https://actionlake.com/glossary/tool-overload)
- [Prompt injection Prompt injection is an attack in which text that a language model reads, typed by a user or hidden in a web page, email, document or tool result, changes the model's behaviour, and in a tool-using agent it can turn into real actions.](https://actionlake.com/glossary/prompt-injection)
- [Dry run A dry run checks whether an agent's action would succeed, whether it is allowed and what it would cost, by validating the inputs, permissions and connection without sending anything to the vendor.](https://actionlake.com/glossary/dry-run)

## Sources

1. [Server features: Tools (2025-11-25)](https://modelcontextprotocol.io/specification/2025-11-25/server/tools) Model Context Protocol · checked 22 October 2026
2. [Building effective agents](https://www.anthropic.com/engineering/building-effective-agents) Anthropic · checked 22 October 2026
3. [MCP Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/MCP_Security_Cheat_Sheet.html) OWASP Cheat Sheet Series · checked 22 October 2026

[All 30 glossary terms](https://actionlake.com/glossary)

## Connect an agent. Start free.

[Start free](https://actionlake.com/console?start=sandbox) [Read the quickstart](https://actionlake.com/docs/quickstart)

100,000 calls free every month. No card. Hard caps on every key.

---

Source: https://actionlake.com/glossary/mcp-tool
More: https://actionlake.com/llms.txt