Tools versus resources
An MCP server can offer tools, which the model can call to take an action, and resources, which expose read-only data such as files or records. Keeping them apart makes permissions easier to reason about: a resource can be read freely, while a tool call may need approval.
Where to draw the permission line
Decide for every tool whether it only reads, writes to your own system, or reaches outside it. Read-only tools can run without prompting. Tools that write or send anything should require a confirmation step.
Validate on the server
Do not rely on the client to send clean arguments. Validate each argument against a schema on the server, the same way you would for any public API.
Next
This guide is an outline of the approach. A full walkthrough with a runnable server will follow in this series.
