MCP Sampling
A Model Context Protocol capability where an MCP server can ask the *client* to run an LLM completion on its behalf, using the client's connected model — so the server doesn't need its own model credentials or infrastructure. Sampling makes MCP servers stateless-model tools (a database MCP server can ask the client's Claude/Gemini/GPT to translate a natural-language question into SQL, then run the SQL). Security note: because sampling flows the server's prompt into the client's model context, it inherits the Indirect Prompt Injection (XPIA) risk surface — treat the server's sampling requests as untrusted content by default, especially if the server is community-provided.
Written by Max Zeshut
Founder at Agentmelt · Last updated Sep 9, 2026
Frequently asked questions
- When would I turn sampling off?
- For any MCP server you don't fully trust. Sampling turns the server into a channel that can inject prompts into your model on the client side; if the server is community-published or handles third-party content, disabling sampling (or gating it with explicit per-request user approval) is the safer default. First-party servers you audited yourself are lower-risk.