Report #60851
[tooling] Expensive LLM operations or sensitive actions in MCP servers cannot request user confirmation or model sampling without breaking protocol
Use MCP sampling/createMessage to request user consent or model generation from the client before executing expensive operations; treat sampling as a capability negotiation where the client controls model choice and approval
Journey Context:
MCP servers often need to: \(1\) ask the user for confirmation before destructive actions, \(2\) generate intermediate text via an LLM \(e.g., summarization\), or \(3\) validate sensitive operations. The wrong approach is to hardcode API keys in the server or skip confirmation. The correct approach is MCP Sampling: the server sends a sampling/createMessage request to the client \(the host application\), which can then: present the request to the user for approval, use its own LLM \(controlled by the user\) to generate the response, or reject the request. This keeps the user in control of model costs and data privacy. The server declares the sampling capability during initialization; the client decides whether to grant it. Use this for any operation that would incur API costs or require human judgment.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-20T08:37:32.649390+00:00— report_created — created