MCP Context: Tools, Resources, Prompts, and Agent Memory
Learn what MCP context means, how tools, resources, and prompts reach an AI application, and why context exchange differs from persistent agent memory.
MCP context is information an AI application can obtain through the Model Context Protocol to help complete a task. It may include a tool result, a document exposed as a resource, or a reusable prompt template. The application decides how to select and use that material in a model request; connecting a server does not automatically provide unlimited context or persistent memory.
For an intelligence workflow, useful context is specific: the question, the relevant entities, supporting evidence, observation dates, and the limits of what was found.
How does context move through MCP?
The MCP architecture overview describes a host application, its MCP client connections, and servers that expose capabilities. The protocol defines the exchange. It leaves model use and context management to the application.
The three core server primitives have different roles:
| Primitive | Purpose | Y2 example |
|---|---|---|
| Tool | An operation the application can call | y2_call_api retrieves an authorized API resource |
| Resource | Data made available for the application to read | y2://openapi exposes the API contract |
| Prompt | A reusable interaction template | integrate-y2-api helps structure an integration task |
Y2's MCP reference documents its package's tools, resources, and prompts. Inspect
tools/list, resources/list, and prompts/list on the installed server for its actual
capabilities. A prompt template may guide a workflow, but it does not grant API permissions.
What does an agent need in its context?
Suppose a user asks for a geopolitical briefing about a shipping corridor. A useful sequence is:
- Translate the question into a defined geography, period, and event category.
- Inspect the relevant API operation's schema before constructing its filters.
- Retrieve a small initial result set and preserve identifiers and source references.
- Expand only the entities or incidents that matter to the question.
- Present the supporting evidence alongside uncertainty and remaining coverage gaps.
This is a proposed workflow, not an automatic behavior of every MCP host. The host needs policies for tool selection, output handling, and how much retrieved material enters the model request.
For a concrete regional query, use the OSINT MCP guide. For vulnerability and actor relationships, use the threat intelligence MCP guide.
More context is not the same as better evidence
A large response can contain duplicates, outdated observations, and irrelevant entities. Instead of asking for everything, define an evidence budget for the question: how many candidate records will be examined, which detail requests are allowed, and what ends the investigation?
Y2's Intel API supports filters, sparse fieldsets, and bounded related-resource expansion. Select fields deliberately. Removing a timestamp or identity field to save space can make an otherwise readable result difficult to verify. Keep the full authorized evidence outside the model request when your application needs an audit trail.
If a response is truncated, report that limitation and narrow the request. A clipped result is not proof that there were no additional records. Likewise, following one page of results does not make a broad search exhaustive.
Keep instructions and evidence separate
An article, incident description, or tool result can contain text that asks the agent to ignore its assignment or reveal information. Treat such material as untrusted evidence. The OWASP prompt-injection guide describes attacks through external content and layered defenses.
Apply permissions outside the model, restrict destinations that can receive sensitive results, and inspect proposed actions against the user's actual task. Merely wrapping a tool response in delimiters does not establish a security boundary.
Frequently asked questions
Does MCP increase a model's context window?
No. MCP provides a way to access external capabilities and information. The model's input limits and the host's selection or summarization behavior still determine what fits into each request.
Is MCP the same as RAG?
No. RAG describes retrieving material to support generation. An MCP server can expose retrieval tools, along with other operations. They can be used together without being the same mechanism.
Is a tool result stored as long-term memory?
Only if the host or another application service stores it. MCP context exchange does not define your application's retention policy. See AI agent memory for the storage, retrieval, and correction decisions.
Does an MCP resource give access to private Y2 data?
Y2's documentation resources describe the product and contract. Access to authenticated API operations depends on the configured key and operation-specific scopes. Start with MCP scoped API keys before connecting private workflows.