Advanced MCP primitives

The Model Context Protocol intro covered the basics: a server exposes tools, resources, and prompts, and the host (the LLM app) invokes them. That makes MCP sound one-directional — host calls server. But the protocol is bidirectional and interactive: the server can call back to the host’s model, ask the user a question mid-operation, be confined to declared boundaries, and run long jobs with progress. These advanced primitives are what turn MCP from a tool-calling convention into a genuine agent ecosystem.

Sampling: the server borrows the host’s LLM

The most powerful advanced primitive is sampling: the server requests a completion from the client’s LLM. Instead of bringing its own model and API key, a server can delegate a reasoning sub-task back to the host — and the host stays in control, able to review, modify, or deny the request (human-in-the-loop). A server that, say, processes a document can ask the host model to summarize a section:

{
  "method": "sampling/createMessage",
  "params": {
    "messages": [{ "role": "user", "content": { "type": "text", "text": "Summarize the section above." } }],
    "maxTokens": 200,
    "modelPreferences": { "hints": [{ "name": "claude-sonnet" }] }
  }
}

This inverts the usual flow — the server is now prompting the host’s model — and it’s why MCP servers can be intelligent without each shipping (and paying for) their own LLM.

Roots, elicitation, async, and apps

• Roots (host → server): the client declares the filesystem paths or URIs the server is allowed to operate within. It’s both a convenience (the server knows the relevant workspace) and a security boundary (the server is scoped, not handed the whole disk).

• Elicitation (server → user): a server can pause and request structured input from the user mid-operation — a missing parameter, a confirmation, a choice — described by a schema, so it’s a typed prompt rather than free text:

  {
    "method": "elicitation/create",
    "params": {
      "message": "Which environment should I deploy to?",
      "requestedSchema": { "type": "object",
        "properties": { "env": { "type": "string", "enum": ["staging", "prod"] } } }
    }
  }

• Async tasks / progress: long-running operations send progress notifications and support cancellation, so a slow tool doesn’t just block silently.

• Apps / UI (emerging): the newest direction lets servers return rich, interactive UI components rather than only text — the “MCP apps” work — so a server can present a form or a chart inside the host.

In one breath

• Beyond host-invoked tools/resources/prompts, MCP is bidirectional: servers can initiate, which is what makes interactive, model-using servers possible.
• Sampling lets a server request a completion from the host’s LLM — so servers are intelligent without their own model/API key, and the host keeps human-in-the-loop control.
• Roots scope a server to declared filesystem/URI boundaries (convenience + security); elicitation lets a server request structured user input mid-operation (a typed prompt).
• Async tasks add progress notifications and cancellation for long jobs; the emerging apps/UI primitive lets servers return interactive components.
• These powers widen the attack surface — sampling/elicitation can be abused — so keep humans in the loop, scope with roots, and distrust server-initiated messages (MCP security).

Quick check

Next

These primitives sit alongside the cross-protocol view in MCP vs A2A vs ACP vs ANP, and the threats they introduce are covered in MCP security. To build a server that uses them, see FastMCP.