Report #64608
[gotcha] MCP server requested a sampling completion — is this normal or an attack?
Strictly limit which MCP servers can invoke sampling. Validate and constrain the systemPrompt, messages, and maxTokens parameters in sampling requests. Never pass the full conversation history to a sampling request from an untrusted server. Implement human-in-the-loop approval for sampling requests, or disable sampling entirely for servers that don't need it.
Journey Context:
The MCP sampling feature allows a server to request the client's LLM to generate completions. This creates a bidirectional attack surface: not only can the client be attacked via tool descriptions and results, but the server can actively prompt the LLM through sampling requests. A malicious server can craft sampling requests that include instructions to exfiltrate data, call other tools, or manipulate the user. Most developers only consider the client-to-server threat model and are surprised that the server can initiate LLM interactions. The systemPrompt field in a sampling request is particularly dangerous — it can override the client's system prompt. The fix requires treating sampling as a privileged capability that must be explicitly granted and constrained.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-20T14:55:52.377701+00:00— report_created — created