# Let a server use the agent's model (MCP sampling)

Allow an MCP server to ask the agent's model for a completion during a tool call, through the agent's budgets and policies, automatically or with the person's approval.

During a tool call, an MCP server can ask the client's model for a completion. For example, a server might ask the model to summarise a document before it returns a result. MCP calls this **sampling** (`sampling/createMessage`). Liyagent answers with the agent's own model, under the agent's own governance.

Sampling is **off** by default. In that mode Liyagent does not advertise the capability, and a server that asks anyway is refused, exactly as before this feature existed.

## Turn it on for a server

Set `sampling` on the server's record (`PUT /api/mcp/servers/{name}`):

| Value | What happens |
|---|---|
| `off` | The default. No sampling capability is advertised. |
| `auto` | Liyagent answers through the agent's governed model call, with no human step. |
| `approve` | Liyagent asks the person behind the run first. |

`TICKETIQ_MCP_SAMPLING_DEFAULT` sets the mode for servers whose record names none. It is `off` unless you change it.

## auto: through the agent's governance

A sampling request is one more model call by the agent. It goes through the same controls as the agent's own model calls:

- the Cedar `call_model` check on the agent's provider
- rate limits and budgets, including budget fallback
- the kill switch
- usage and cost, charged to the agent

If any of these refuses, the server gets a rejection (error `-1`) with the reason.

Liyagent adds its own system prompt before the server's `systemPrompt`. It tells the model that the request comes from the server and that it must not reveal secrets or other conversations. `maxTokens` is capped at `TICKETIQ_MCP_SAMPLING_MAX_TOKENS` (default 1024).

## approve: the person decides

The person is asked through the same flow as an elicitation, using a one-field form: allow the model call or not. The form names the server, the number of messages and the token cap.

- **Interactive run** (the playground, A2A or a Teams chat): the run waits at the call. When the person allows the request, the call is made again and the model answers.
- **MCP task:** the task's caller is asked (`input_required`).
- **Nobody can answer** (a trigger or cron run): the request is refused.

## Always refused

- Sampling with tools. Liyagent does not advertise the `tools` sampling capability.
- Content other than text (images, audio).
- More than `TICKETIQ_MCP_SAMPLING_MAX_PER_CALL` requests (default 5) in one tool call.
- `includeContext`. It is ignored: Liyagent never adds other conversations or servers' context.

## Audit

Every request writes an `agent.sampling` row. It records the server, the mode, the outcome (`answered` or `refused`) and the reason. It also records the message count, the requested and applied token limits, the tokens used and the cost. **The prompt and the answer are never recorded.**