sampling/createMessage lets an MCP server run its own prompt through your model

At runtime the direction of the call is the story. A server is midway through a tool call, needs a judgment it has no model for, and emits `sampling/createMessage` back up to the client ^[3]. The client runs the completion on its own LLM, hands the text back, and the server resumes from where it paused ^[1]. In the expense case the dev.to write-up uses, a server hits a transaction it cannot categorize, asks the client which account the description belongs to, and carries on once the answer arrives ^[4].

The example request printed in that post sets `includeContext` to `"thisServer"` ^[9]. A client that has not declared a sampling-context capability will not honor that value at all ^[8]. Soft-deprecated, in this case, means the field still parses.

Strip the conversation history out and the interesting part remains. `messages` and `systemPrompt` both come from the server; the client wrote neither ^[5]. "A third party's server got to write a prompt and run it through the model I authenticated, on context I own," the post's author wrote ^[12], describing the feature as "a clean new way to get into your model's context" ^[18]. The completion then goes back to the server that asked for it ^[1].

`modelPreferences` is the lobbying channel. A server can send `hints`, `costPriority`, `intelligencePriority` and `speedPriority`, and the client still makes the final model pick ^[6]. The printed example hints `claude-3-sonnet`, sets `intelligencePriority` to 0.8 against `costPriority` 0.3, and caps the reply at `maxTokens` 100 ^[9]. Divide one by the other and the request weights capability about 2.7 times cost ^[15]. Sampling exists so that a server does not have to ship its own model and API key ^[14]. The tokens are billed to whoever owns the client's credentials ^[16].

The protocol authors did not leave the request unsupervised. Before the call, the client is supposed to show the prompt so it can be edited, approved or rejected ^[10]. Before the result returns, the client is supposed to show the completion so it can be approved or blocked ^[11]. "The catch is the word supposed to," the author wrote ^[13]. The text available here breaks off while asking whether a given client implements that gate well, or implements Sampling at all, and it names no client that does ^[17].

That is where an audit has to start, and it is a client-side audit. The spec's threat model assumes two human checkpoints inside code you may not have written ^[10][11]. If your client renders the server's prompt in a dialog nobody reads, or skips the dialog, the protocol is still being followed ^[13].