Report #13972
[gotcha] MCP sampling feature enables recursive infinite loops with accumulating real-world side effects
Implement hard depth limits on sampling recursion \(e.g., max 3 nested sampling rounds\); cap total tool calls per conversation turn; add circuit-breaker logic that aborts when the same tool is called more than N times in a chain; never allow sampling-enabled servers to call tools with irreversible side effects without per-call human approval.
Journey Context:
MCP's sampling feature lets a tool server request the LLM to generate a completion—which can include tool calls, which can trigger more sampling, creating unbounded recursion. This is not merely a resource-exhaustion bug: each loop iteration can execute real actions \(send emails, modify files, make API calls\). The LLM cannot detect it is in a loop because each sampling request appears as a fresh completion. Developers enable sampling for legitimate use cases \(a tool that needs the LLM to summarize its output\) without realizing they've opened a recursion channel. The MCP spec warns about this but provides no enforcement mechanism—it is entirely on the client to implement guards.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T20:18:16.985053+00:00— report_created — created