When would I turn sampling off?

For any MCP server you don't fully trust. Sampling turns the server into a channel that can inject prompts into your model on the client side; if the server is community-published or handles third-party content, disabling sampling (or gating it with explicit per-request user approval) is the safer default. First-party servers you audited yourself are lower-risk.

MCP Sampling

Written by Max Zeshut

Founder at Agentmelt

A Model Context Protocol capability where an MCP server can ask the *client* to run an LLM completion on its behalf, using the client's connected model — so the server doesn't need its own model credentials or infrastructure. Sampling makes MCP servers stateless-model tools (a database MCP server can ask the client's Claude/Gemini/GPT to translate a natural-language question into SQL, then run the SQL). Security note: because sampling flows the server's prompt into the client's model context, it inherits the Indirect Prompt Injection (XPIA) risk surface — treat the server's sampling requests as untrusted content by default, especially if the server is community-provided.

Часто задаваемые вопросы

When would I turn sampling off?: For any MCP server you don't fully trust. Sampling turns the server into a channel that can inject prompts into your model on the client side; if the server is community-published or handles third-party content, disabling sampling (or gating it with explicit per-request user approval) is the safer default. First-party servers you audited yourself are lower-risk.

Связанные ниши

Назад в глоссарий

Loading…