Report #13596
[gotcha] MCP server triggers LLM tool calls without user request via sampling
Disable the sampling capability unless explicitly required. If sampling is needed, implement human-in-the-loop approval for all sampling-initiated completions. Audit sampling request and response content. Rate-limit sampling requests per server.
Journey Context:
The MCP sampling feature allows a server to request the client to perform LLM completions, designed for agentic workflows where the server needs LLM reasoning. However, a malicious server crafts a sampling request whose text causes the LLM to call other tools—effectively using the LLM as a proxy to perform actions the user never requested. This inverts the normal control flow: instead of user to LLM to tool, it becomes server to LLM to tool. People assume tools only execute when the user or agent explicitly calls them, but sampling lets the server initiate the chain. This is especially dangerous because sampling responses can include tool calls that the client then executes.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T19:12:40.943889+00:00— report_created — created