The three MCP primitives

The Model Context Protocol exposes server capabilities to a host model through three orthogonal primitives — Tools, Resources, and Prompts. Cognitive Server implements all three under a single sovereign perimeter, so that any reasoning step a host model performs is inspectable, policy-bound, and traceable to its evidentiary source.

Tools — invocable actions

A Tool is a side-effecting action exposed by the server. The host model may request its invocation; the server is the sole authority on whether the call is permitted and how it is logged. Tools are the only primitive that may mutate state outside the model context.

Each tool ships a JSON Schema describing its parameters, a deterministic name, and a server-side policy binding. On Cognitive Server, every tool call is signed by the tenant JWT, evaluated against the active scope set, and appended to the Chain fabric ledger before execution.

// src/lib/mcp/tools/audit-cloud-config.ts
import { defineTool } from "mcp-tanstack-start";
import { z } from "zod";

export const auditCloudConfig = defineTool({
  name: "audit_cloud_config",
  description: "Audit a cloud configuration against NIS2 controls.",
  parameters: z.object({
    tenant: z.string(),
    regime: z.enum(["NIS2", "DORA", "AI_ACT"]),
  }),
  execute: async ({ tenant, regime }, { auth }) => {
    await requireScope(auth, "audit:read");
    return runAudit(tenant, regime);
  },
});

Resources — read-only context

A Resource is a read-only handle to context the host model may consume — configuration files, regulatory texts, internal documentation, retrieval fragments. Resources are addressable by URI and may carry MIME types, versions, and lineage metadata.

On Cognitive Server, every resource fetch is mediated by the VAULT app: data residency is enforced before the bytes leave storage, and the read is recorded for downstream compliance evidence.

server.resource({
  uri: "vault://tenant/{tenantId}/policy/{name}",
  mimeType: "application/json",
  description: "Tenant-scoped policy document, lineage-tracked.",
  read: async ({ tenantId, name }, { auth }) => {
    await requireScope(auth, "vault:read");
    return vault.read(tenantId, name);
  },
});

Prompts — templated workflows

A Prompt is a server-defined, parameterised workflow that the host can instantiate on behalf of a user. Prompts are how operators encode repeatable reasoning patterns — incident triage, conformity assessment, vendor due diligence — without baking them into the model weights.

Cognitive Server's NEXUS app ships dozens of regulator-aligned prompts out of the box. Each is versioned, signed by the Shield fabric, and replayable: an auditor can re-execute the exact prompt against the exact inputs months later.

server.prompt({
  name: "nis2_incident_triage",
  description: "Classify and route a suspected NIS2 incident.",
  arguments: [
    { name: "signal", required: true },
    { name: "jurisdiction", required: true },
  ],
  build: ({ signal, jurisdiction }) => ({
    messages: [
      { role: "system", content: policyFor(jurisdiction) },
      { role: "user",   content: signal },
    ],
  }),
});

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "audit_cloud_config",
    "arguments": { "tenant": "acme-bank", "regime": "DORA" }
  },
  "id": "req_01J8..."
}

Composing the three

A real workload uses all three. A NEXUS Prompt loads a regulatory Resource from VAULT, calls an audit Tool exposed by HUB, and returns a structured finding. The composition is the unit CORE reasons over — and the unit the Chain fabric records as a single replayable transaction.

Specification references

Cognitive Server tracks the MCP 2025-06-18 Streamable HTTP transport. Multi-tenant routing rides on top of standard JSON-RPC 2.0 with a tenant-scoped JWT in the Authorization header. See the multi-tenant chapter for the isolation contract.