MCP sampling lets a server ask the client to run a model completion on its behalf, so the server needs no API key of its own. The spec says there should always be a human able to deny the request. The current draft also marks sampling deprecated, so new builds should avoid it.
What sampling does
Normally the model calls the server's tools. Sampling reverses the direction. The server sends the client a prompt, the client passes it to the user's model, and the answer goes back to the server. A server can even include tools in the request, which lets it run a small agent loop using the user's model and the user's budget.
That is useful for a server that wants summaries or classification without holding its own model credentials. It is also a way for a server you do not fully trust to put text in front of your model.
Why the human step matters
The spec says that for trust and safety there should always be a human in the loop with the ability to deny sampling requests. Applications should make the request easy to review, let users view and edit prompts before sending, and show generated responses for review before delivery.
Without that review, a server can steer your model with a prompt you never saw, and read the response. If the request includes tools, the model may act on systems you did not expect.
Controls the spec lists
| Control | Who | Strength in the spec |
|---|---|---|
| User approval of requests | Client | Should |
| Validate message content | Both | Should |
| Rate limiting | Client | Should |
| Iteration limits for tool loops | Both | Should |
| Handle sensitive data appropriately | Both | Must |
| Clients must respect the token cap | Client | Must |
Most of these are advice, not hard requirements. That is why the policy you set in your own client matters more than the wording of the spec.
Status and what to do now
The draft page states that sampling is deprecated as of protocol version 2026-07-28 and remains in the spec for at least twelve months after that revision before it can be removed. New implementations are told not to adopt it and to call model provider APIs directly.
If you run servers that use sampling today:
- Find out which ones send sampling requests.
- Turn on per request approval in the client.
- Cap tokens and loop iterations.
- Plan a move to direct model calls with the server's own, narrowly scoped credentials.
Safeguard includes policies, gates and guardrails you can apply to agent tool traffic, plus a free scan at https://gold.safeguard.sh/scan.
Quick check
Does sampling give the server my API key?
No. The client keeps model access and the credentials. The server only sees the response the client chooses to return.
Is sampling removed from MCP?
Not yet. The draft marks it deprecated and keeps it for at least twelve months after the 2026-07-28 revision, so existing servers may still use it.
Sources
Last reviewed: 19 October 2026.
