How we build the thing that publishes your changelog, your blog and your release notes.
The server is the same in both. What differs is which layers the client implements: how it connects, how it discovers the authorisation server, which of the three capabilities it lists, and whether it reads the hints on each tool.
Both can hand a model a block of JSON, so the choice looks cosmetic. It is not. A tool call is a decision the model makes with arguments it invents; a resource read is a fetch the client performs against an address it already holds.
An agent that can write its own audit row can write a plausible one. Four properties keep the trail out of reach: the row is written on the far side of the tool boundary, storage is append-only, the actor is a reference, and recording never fails the operation.
An agent that publishes without a feedback loop is writing post forty the same way it wrote post one. Closing the loop takes a stored measurement window and a reader that groups by decisions.
An agent writing at volume will run out of evidence long before it runs out of topics. There are three honest moves at that point, and inventing a plausible figure is not one of them.
A tool error that says "invalid input" ends the run. One that quotes the rejected value, lists the accepted set and names the next move lets the assistant repair the call itself. Four real messages from one codebase, read closely.
Delete a rejected idea and it becomes indistinguishable from an idea nobody ever had. The next generation run will derive it again, from the same evidence, and propose it again.
The consumer of an MCP tool result is a model with a fixed budget for reading. Paging for that reader is a different design from paging for a web page.
Nobody usefully reviews two thousand words they did not ask for. A brief is one page that says what the article will be, and it exists before the writing does.
A future published_at schedules a post with no scheduler job behind it: every public surface filters on publishedAt <= now, so nothing has to run overnight for the post to appear.
A tool result carries two things: unstructured content blocks and an optional structuredContent value. Declare an outputSchema and the client can validate the second one, so nothing downstream has to read numbers out of prose.
A prompt composed in an agent's head disappears when the context window rolls. A brief is the same reading written down: one record per query per result page, replaced in place with a revision number, reviewable in one page.
Read and write is not enough of a split for an agent's API key. The scope that spends money has to be its own, or a read-only key quietly is not one.
The useful question is not which marketing tasks an agent can do. It is which ones have an answer that stays the same, and which ones change with the circumstances.
Market4 turns one release note into a changelog page, a blog post, a mail-out and a week of social posts — and then tells you which of them brought anyone back.