Prompts
Domain know-how should live next to the tools. A security server can ship a threat-model prompt that every client runs the same way.
Prompts are recipe cards in a shared kitchen. Every chef (client) follows the same steps for 'how to review a PR.'
Visual Workflows
Start here — scroll inside each diagram frame to explore, then use + / − to zoom up to 200% if needed.
Overview
Scroll inside the frame to explore · use + / − to zoom up to 200%
Scroll inside the frame to explore · use + / − to zoom up to 200%
Fill then inject
Scroll inside the frame to explore · use + / − to zoom up to 200%
The server owns the wording. The client only supplies arguments.
Key Takeaways
- 1.MCP prompts are reusable recipes stored on the server, not in the app. list_prompts shows names; get_prompt fills arguments and returns messages.
- 2.Use them for checklists: code review, incident response, threat modeling. Clients often surface them as slash commands or starter templates.
- 3.Prompt arguments are typed (usually strings). Keep templates short.
- 4.Pull live facts with a resource or tool, then let the prompt tell the model how to think.
Learn elsewhere
- →Tools vs resources vs prompts — this trio is the whole MCP surface
- →Local vs remote delivery — next modules
Real Example
Scenario
A security MCP server exposes a threat-model prompt. You pass a system_description and get a structured analysis template back, the same in every client.
What you would do
In Model Context Protocol, apply Prompts to this scenario: A security MCP server exposes a threat-model prompt. Identify the inputs, run the technique, validate the output, and note one thing you would monitor in production.
Commands
Commands to Remember
list_prompts / get_promptPrompts = recipes, tools = actionsArguments fill holes in the templateClients may show prompts as slash commands
Cheat Sheet
Quick recap
quick ref- •Prompt = parameterized message pack
- •get_prompt(name, args)
- •Store expertise on the server
- •Not a replacement for tools
Common Mistakes
- ✕Hiding a dangerous action inside a prompt instead of a tool
- ✕Huge prompts that blow the context window
- ✕Prompts that assume data the client never fetched