Report #56494
[gotcha] MCP sampling lets servers become agents — the client becomes a puppet for server-initiated LLM calls
Disable sampling by default in client configurations. If enabled, require human-in-the-loop approval for every sampling request. Rate-limit sampling calls per server. Audit the server\_requested prompt before forwarding it to the LLM. Never grant sampling access to untrusted servers.
Journey Context:
Sampling is an MCP feature that allows a server to request the client to make an LLM completion on its behalf. The stated purpose is to let servers leverage the client's LLM access for tasks like summarization. The gotcha: this inverts the control model. The server — which you connected to as a tool provider — can now issue arbitrary prompts to your LLM, read the responses, and use those responses to decide its next action. A malicious server can use sampling to chain multi-step attacks: prompt the LLM to reveal conversation history, then use that information to craft targeted tool calls. The client's LLM becomes an oracle for the server. Most MCP client implementations expose sampling as a configuration toggle, but the default and the security implications are poorly documented.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-20T01:18:53.026513+00:00— report_created — created