MCP Is Three Primitives, Not One — and Your Token Should Never Touch the LLM
Treating MCP as just a tool-calling protocol leaves two-thirds of its surface area unused and muddies the separation between the LLM, the transport layer, and external APIs. Getting the credential boundary wrong — especially letting tokens leak into URL query params or LLM context — creates a logging and security hazard that survives HTTPS encryption.
A developer who built a GitLab MCP Server early on discovered their mental model was incomplete. They had registered only Tools and assumed that was the whole protocol. MCP actually defines three primitives: Tools for actions, Resources for readable data, and Prompts for reusable templates. The distinction matters once an integration grows beyond simple tool-calling.
The same re-examination untangled the Host, Client, and Server roles. In stdio mode, a local Server process is launched by the Client-side application, which creates the illusion that the Server runs inside the Client. Switching to Streamable HTTP makes the separation obvious: the Client connects to an independently deployed remote Server and never manages its lifecycle.
A concrete trust-boundary experiment tested three scenarios — stdio, HTTP with an Authorization header, and HTTP with the token stuffed into a query parameter. The unsafe variant was rejected before any downstream GitLab API call occurred, preventing side effects and keeping the token out of the simulated LLM context. The demo also clarifies how MCP, API, Tool, Skill, and Plugin each solve different problems in an agentic stack.
Many developers who have built and used MCP Servers still operate with an incomplete mental model, mistaking their narrow implementation for the full protocol.
The stdio transport creates a deceptive coupling: because the Client process spawns the Server, it is easy to conflate their roles and assume the Server lives inside the Client.
Placing a token in a URL query parameter is dangerous not only because it is visible in transit but because it persists in proxy logs, access logs, and monitoring systems even after HTTPS decryption.
The distinction between Skill and MCP Server is underappreciated — a Skill defines when and how to act, but the actual side effect always originates from a Tool handler calling an external API.