MCP Sampling Invocation

MCP sampling invocation occurs when a Model Context Protocol (MCP) server requests that the client or host perform a model completion on the server’s behalf. 

A model completion is the process where a model generates a response from supplied messages, instructions, or context. In this pattern, the MCP server can ask the host model to generate text, reason over supplied content, summarize information, or produce an answer that is then returned to the server or used in the workflow.

This invocation creates an elevated exposure condition because the server is no longer only returning data or exposing tools. It may initiate a model-facing request that causes reasoning, summarization, generation, or tool-adjacent behavior through the client’s model environment.

The primary risk is server-originated model steering. A malicious or compromised MCP server may use sampling requests to introduce instructions, request sensitive context, summarize information it should not receive, or cause the host model to generate content that supports later misuse.

Investigators should review MCP sampling requests, server identity, request payloads, messages supplied by the server, model responses, user consent records, returned outputs, and subsequent server or tool activity. Particular attention should be given to sampling requests from low-trust servers, requests involving sensitive context, unexpected model completions, and server-originated prompts that resemble operator instructions.

Investigative Relevance

MCP sampling invocation is relevant because it allows an MCP server to initiate model activity rather than merely respond to a user-initiated tool call. The invocation source is the server request, and the resulting model output may influence later actions.

This sub-section is especially relevant where MCP clients permit server-requested sampling, agentic workflows, model-in-the-loop tools, server-side planning, or integrations that allow external servers to request completions through the host model.