AID-H-028.008: Server-Requested Sampling Compatibility Isolation (Deprecated MCP Capability)

Version 1.20261015 · Actionable sub-technique

Permit MCP sampling/createMessage only as a signed expiring exception inside MCP v2 2026-07-28. Bind the exception to the verified server, client capability, model route, visible purpose, isolated context, and token, request, iteration, tool, and cost budgets. Deny privileged tools by default and prefer direct provider integration for new designs.

Pillars: app

Lifecycle: building, operation

Scope boundary

Owns client-side admission and isolation of deprecated sampling/createMessage as a signed, expiring, server-bound exception with visible purpose and strict model, context, token, tool, iteration, and cost limits. It is not a general agent-action authorization mechanism.

AID-H-018.002: AID-H-028.008 decides whether a deprecated server-requested sampling exception is enabled and bounded at the client; AID-H-018.002 authorizes ordinary runtime capabilities and actions under policy. The deprecated exception must remain narrower than the agent's general capability policy.

AID-H-034: AID-H-028.008 owns the client's deprecated sampling exception; AID-H-034 owns the MCP server boundary and must not assume that a client permits removed server-initiated capabilities. New server designs should use direct provider integration rather than depend on this exception.

Implementation guidance

AID-H-028.008-G001

Permit deprecated sampling/createMessage only as an approved MCP 2026-07-28 deprecated-capability exception with isolated context, user visibility, and policy-derived rate, token, iteration, and tool budgets.
Concept

Roots, sampling, and logging remain present but deprecated in MCP 2026-07-28. An approved use is a narrow exception governed by that exact version's per-request metadata and security policy. For server-to-client sampling, require the current request's client capabilities, a signed exception, explicit user visibility, isolated context, and bounded model/tool use.

MCP v2 exception gate
// File: src/deprecated/samplingException.js
const VERSION = "2026-07-28";
const SAMPLING = "sampling/createMessage";

export function authorizeDeprecatedSampling(input) {
  const meta = input.requestParams?._meta;
  const capabilities = meta?.["io.modelcontextprotocol/clientCapabilities"];
  if (meta?.["io.modelcontextprotocol/protocolVersion"] !== VERSION ||
      !capabilities?.sampling || input.method !== SAMPLING) {
    throw new Error("deprecated_sampling_not_declared_on_current_request");
  }
  const rule = input.signedPolicy?.exceptions?.find(item =>
    item.protocolVersion === VERSION && item.method === SAMPLING &&
    item.serverOrigin === input.serverOrigin && item.clientId === input.clientId
  );
  if (!rule || Date.parse(rule.expiresAt) <= Date.now() || !rule.approvalId ||
      !Number.isSafeInteger(rule.maxTokens) || rule.maxTokens <= 0 ||
      !Number.isSafeInteger(rule.maxIterations) || rule.maxIterations <= 0 ||
      !Number.isSafeInteger(rule.maxRequestsPerMinute) ||
      rule.maxRequestsPerMinute <= 0) {
    throw new Error("approved_deprecated_capability_exception_required");
  }
  if (input.requestedMaxTokens > rule.maxTokens ||
      input.requestedTools?.some(tool => !rule.allowedTools.includes(tool.name))) {
    throw new Error("deprecated_sampling_budget_or_tool_denied");
  }
  return Object.freeze({
    protocolVersion: VERSION,
    exceptionId: rule.approvalId,
    maxTokens: rule.maxTokens,
    maxIterations: rule.maxIterations,
    allowedTools: Object.freeze([...rule.allowedTools])
  });
}

Action: deny by default. When approved, meter separately, prevent ambient secrets or privileged tools from entering sampling context, show which server requested model use, and preserve request, policy, approval, budget, tool, and outcome digests. Apply the same signed-exception pattern to deprecated roots and logging surfaces that remain enabled.

Independent verification

Exercise absent per-request capability, expired or wrong-server exception, token/iteration/rate overflow, unapproved tool, hidden invocation, context crossover, and revocation. Confirm that every accepted request is bound to protocol version 2026-07-28.

AID-H-028.008-G002

Audit every sampling exception and invocation with exact server, user, model route, context, budget, policy, and outcome bindings.
Sampling exception audit

Emit requested, allowed, and rejected events bound to the originating request, server identity, user and tenant digests, exact capability metadata, exception ID and expiry, model route, context digest, visibility receipt, budget reservations, policy version, and terminal status. Never log complete prompts, hidden reasoning, credentials, or reusable authorization. Test expired or wrong-server exceptions, hidden UI, context injection, privileged tools, nested sampling, concurrent exhaustion, cancellation, unknown outcomes, and sink failure.

Open-source tools

Commercial / hosted tools

Threat mappings

MITRE ATLAS

MAESTRO

OWASP LLM Top 10 2026

OWASP ML Top 10 2023

OWASP Top 10 for Agentic Applications 2026

NIST Adversarial Machine Learning 2025

Cisco Integrated AI Security and Safety Framework

Google Secure AI Framework 2.0 - Risks

Databricks AI Security Framework 3.0

AID-H-028.008: Server-Requested Sampling Compatibility Isolation (Deprecated MCP Capability) | AIDEFEND

Loading interactive view…

AIDEFEND™

A Practical Knowledge Base for AI Security Defenses

Version

GitHub MCP Service