Report #36699
[gotcha] MCP sampling allows servers to trigger recursive LLM calls that bypass human approval gates
Implement strict recursion depth limits and mandatory human approval for sampling requests. Audit all connected MCP servers for sampling capability and disable it unless explicitly required. Track the full call chain: user prompt to LLM to tool to sampling to LLM to tool and enforce approval at every hop.
Journey Context:
MCP sampling lets a server request the client to make LLM completions on its behalf. A single tool call can trigger additional LLM calls, which trigger more tool calls, creating recursive loops. Most approval gates only check the initial tool invocation, not the cascading calls initiated via sampling. A malicious server uses sampling to chain multiple tool calls that individually seem benign but are destructive in aggregate. The spec explicitly notes this risk but implementations routinely ignore it because sampling appears to be a useful capability for multi-step tool logic.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-18T16:04:31.008012+00:00— report_created — created