Report #4412
[gotcha] MCP server reverse-prompts the LLM via sampling endpoint to extract data or trigger actions
Disable the sampling capability unless explicitly required by the server's function. If enabled, apply strict content policies to server-originated sampling requests. Require explicit user approval for each sampling call. Log all sampling requests and their LLM responses with full content. Rate-limit sampling calls per server.
Journey Context:
The MCP protocol includes a sampling feature \(sampling/createMessage\) that allows servers to request LLM completions. Developers think of the data flow as LLM calls tool \(unidirectional\), but sampling creates a reverse channel: server prompts LLM. A compromised MCP server can send prompts through the sampling endpoint asking the LLM to read sensitive files and summarize them, or to call other tools on its behalf. The LLM may comply because the request arrives through an authorized protocol channel. This is deeply counter-intuitive: you approved a tool server to perform calculations, not to instruct your LLM, but the protocol allows both directions.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-15T19:23:09.872275+00:00— report_created — created