Let a server use the agent's model (MCP sampling)
Allow an MCP server to ask the agent's model for a completion during a tool call, through the agent's budgets and policies, automatically or with the person's approval.
- Turn sampling on for one server
- Choose auto or approve
- Know what is refused
- Read the audit rows
During a tool call, an MCP server can ask the client's model for a completion. For example, a server might ask the model to summarise a document before it returns a result. MCP calls this sampling (sampling/createMessage). Liyagent answers with the agent's own model, under the agent's own governance.
Sampling is off by default. In that mode Liyagent does not advertise the capability, and a server that asks anyway is refused, exactly as before this feature existed.
Turn it on for a server
Set sampling on the server's record (PUT /api/mcp/servers/{name}):
| Value | What happens |
|---|---|
off | The default. No sampling capability is advertised. |
auto | Liyagent answers through the agent's governed model call, with no human step. |
approve | Liyagent asks the person behind the run first. |
TICKETIQ_MCP_SAMPLING_DEFAULT sets the mode for servers whose record names none. It is off unless you change it.
auto: through the agent's governance
A sampling request is one more model call by the agent. It goes through the same controls as the agent's own model calls:
- the Cedar
call_modelcheck on the agent's provider - rate limits and budgets, including budget fallback
- the kill switch
- usage and cost, charged to the agent
If any of these refuses, the server gets a rejection (error -1) with the reason.
Liyagent adds its own system prompt before the server's systemPrompt. It tells the model that the request comes from the server and that it must not reveal secrets or other conversations. maxTokens is capped at TICKETIQ_MCP_SAMPLING_MAX_TOKENS (default 1024).
approve: the person decides
The person is asked through the same flow as an elicitation, using a one-field form: allow the model call or not. The form names the server, the number of messages and the token cap.
- Interactive run (the playground, A2A or a Teams chat): the run waits at the call. When the person allows the request, the call is made again and the model answers.
- MCP task: the task's caller is asked (
input_required). - Nobody can answer (a trigger or cron run): the request is refused.
Always refused
- Sampling with tools. Liyagent does not advertise the
toolssampling capability. - Content other than text (images, audio).
- More than
TICKETIQ_MCP_SAMPLING_MAX_PER_CALLrequests (default 5) in one tool call. includeContext. It is ignored: Liyagent never adds other conversations or servers' context.
Audit
Every request writes an agent.sampling row. It records the server, the mode, the outcome (answered or refused) and the reason. It also records the message count, the requested and applied token limits, the tokens used and the cost. The prompt and the answer are never recorded.