When an assistant uses an MCP tool, which pairing of roles is correct?
Select an answer to reveal the explanation.
Short Explanation
Tools are model-controlled: the model says 'let's use this,' the server does the work, and you or the host can hit the brakes. If the model is 'executing' something, that answer is a trap.
Full Explanation
Tools in MCP are designed to be model-controlled: the language model discovers and invokes tools based on its contextual understanding and the user's prompts. Execution happens on the server, which receives the tools/call request, runs the operation against its systems, and returns a result. For trust, safety and security, the specification says there SHOULD always be a human in the loop with the ability to deny tool invocations, and applications SHOULD show which tools are exposed, indicate when they are invoked, and present confirmation prompts; that veto belongs to the host and its user. Having the server decide to call its own tools reverses the control model, and clients route requests rather than execute tools. Requiring the user to write every call by hand describes the prompt primitive's user-controlled model, not tools, and servers do not hold an approval role over the user. Letting the host decide and the model execute inverts the roles again; the model only produces a selection, and the host enforces policy. Exam caveat: implementations may expose tools through any interface pattern, but the human ability to deny invocations remains a SHOULD in the specification. Operational check: observe one tool use and confirm the model's selection, the host's approval prompt, and the server's execution appear as separate steps.