Chapter 13

Prompts Publish a Template, Not Hidden Power

An MCP prompt is a discoverable template of messages with arguments. It helps the host offer the user a ready workflow: "prepare a release review" in one action. But precisely because it's convenient, it's important to understand its boundary - a prompt does not replace system policy and must not quietly hand the server extra rights.

Our prompt fills a message that names the needed tool and the required response format.

  server.registerPrompt(
    "prepare-release-review",
    {
      title: "Prepare a release review",
      description: "Creates a user message naming the needed tool and the required response format.",
      argsSchema: z.object({
        service: z.string().min(2),
        version: z.string().regex(/^\d+\.\d+\.\d+$/u)
      })
    },
    ({ service, version }) => ({
      description: `Review ${service}@${version}`,
      messages: [{
        role: "user",
        content: {
          type: "text",
          text: [
            `Check the readiness of ${service}@${version}.`,
            "Use review_release and the runbook://release-policy policy.",
            "Return the decision, the failed checks, and the evidence."
          ].join(" ")
        }
      }]
    })
  );

The difference between a good and a bad use is very vivid here. The good one is an IDE command "Prepare release review" that explicitly fills in service and version and shows the resulting text before running: the user sees exactly what will go to the model. The bad one is a hidden instruction to ignore policy, auto-call a destructive tool, or pass the server extra data. The same mechanism, the opposite level of trust.

The key is who controls what. The server offers a template. The client requests it. The host decides how to show and insert the messages. The user must see important consequences, and the host's system and developer instructions stay above any server-provided text. Break that order and a prompt turns from a convenience into a channel of hidden power.

A tool, a resource, or a prompt. If you need a side effect or a computation - it's a tool. If you need an addressable fact - it's a resource. If you need a reusable interaction template - it's a prompt. Don't make three surfaces for one operation without a clear reason.

The three MCP surfaces are covered. But everything we've written lives by the rules of a specific protocol revision - and in 2026 that revision changed seriously. Time to understand exactly how.

Prompts Publish a Template, Not Hidden Power

Links