MCP turned agent tools into an interface

MCP made agent plumbing look more like a product surface than a collection of adapters.

The model did not become safer by itself. The useful change was that tool seams became visible: name, schema, error shape, side effects, and approval story.

The resource/tool distinction does a lot of work. A resource is something the agent reads. A tool changes the world. Confusing the two can turn a read approval into an unrecognized write permission.

resource:
  workspace://docs/refund-policy

tool:
  update_customer_billing_contact
  requires approval
  leaves a receipt
  can be reversed by an operator

The host controls visibility, the schema narrows possible actions, approval explains consequence, and the receipt makes the action reviewable later.

Tool descriptions should read like operator notes. “Search support articles by keyword and product area” gives a purpose and boundary. Marketing copy does not help a model decide what the call is for or what it should avoid.

Once tools are explicit, governance has somewhere to live:

• which server is trusted?
• which tools need approval?
• which resources are sensitive?
• which outputs may feed another tool?
• which calls are safe in CI?
• which actions stay inside a sandbox?

MCP did not solve agent safety. It made the contract visible enough to inspect, tighten, and version.