01 / The operating case
What changes in a real workflow?
A server requests sampling with a prompt that asks the client to invoke a separate customer-export tool.
- 01Client / task
- 02MCP server
- 03Tool call + arguments
- 04Downstream effect
02 / Decision contract
What the executor must check
Show or constrain the requested prompt and tool set, preserve originating server identity, and enforce separate task authorization before any client-side tool effect.
03 / Failure and evidence
What goes wrong, and what can be proven?
A trusted server request launders an unrelated tool action through the client’s model.
Keep originating request, sampling capability, reviewed prompt reference, selected tool and denial.
04 / Canonical scope
Why this reference stands alone
Tool poisoning concerns server metadata; this page owns server-initiated model use.
Protocol or attack trace
Sampling request provenance
Server asks client sampling/createMessage to call an unrelated customer-export tool.
Disable tool-enabled sampling capability or deny export without a separate task grant.
Primary references