Elicitation changedspecification/2025-11-25/client/elicitation
Nearest release: v2.1.305, published under an hour before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 20 Oct 2026 20:02 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 20 Oct 2026 20:07 UTC.
Upstream edited
Recorded here
Lines+43added
Lines−45removed
From line
1
where the diff opens
First seen
26 Aug 2026
this site's first read of the page
Recorded edits3to this page, all time
The whole hunk
from line 1, old and new numbered
/
from line 1
11# Elicitation
22
3<div id="enable-section-numbers" />
4
53The Model Context Protocol (MCP) provides a standardized way for servers to request additional
64information from users through the client during interactions. This flow allows clients to
75maintain control over user interactions and data sharing while enabling servers to gather
from line 19
2119their needs—the protocol itself does not mandate any specific user interaction
2220model.
2321
24<Warning>
25 For trust & safety and security:
22> [!WARNING]
23>
24> For trust & safety and security:
25>
26> * Servers **MUST NOT** use form mode elicitation to request sensitive information such as
27> passwords, API keys, access tokens, or payment credentials
28> * Servers **MUST** use [URL mode](#url-mode-elicitation-requests) for interactions involving
29> such sensitive information
30>
31> "Sensitive information" in this context refers to secrets and credentials that grant access or
32> authorize transactions. General contact or profile information (such as a name, email address,
33> or username) is not categorically prohibited; whether to request such data via form mode is at
34> the discretion of the server and subject to the user's ability to review and decline.
35>
36> MCP clients **MUST**:
37>
38> * Provide UI that makes it clear which server is requesting information
39> * Respect user privacy and provide clear decline and cancel options
40> * For form mode, allow users to review and modify their responses before sending
41> * For URL mode, clearly display the target domain/host and gather user consent before navigation to the target URL
2642
27 * Servers **MUST NOT** use form mode elicitation to request sensitive information such as
28 passwords, API keys, access tokens, or payment credentials
29 * Servers **MUST** use [URL mode](#url-mode-elicitation-requests) for interactions involving
30 such sensitive information
31
32 "Sensitive information" in this context refers to secrets and credentials that grant access or
33 authorize transactions. General contact or profile information (such as a name, email address,
34 or username) is not categorically prohibited; whether to request such data via form mode is at
35 the discretion of the server and subject to the user's ability to review and decline.
36
37 MCP clients **MUST**:
38
39 * Provide UI that makes it clear which server is requesting information
40 * Respect user privacy and provide clear decline and cancel options
41 * For form mode, allow users to review and modify their responses before sending
42 * For URL mode, clearly display the target domain/host and gather user consent before navigation to the target URL
43</Warning>
44
4543## Capabilities
4644
4745Clients that support elicitation **MUST** declare the `elicitation` capability during
from line 323
325323
326324### URL Mode Elicitation Requests
327325
328<Note>
329 **New feature:** URL mode elicitation is introduced in the `2025-11-25` version of the MCP specification. Its design and implementation may change in future protocol revisions.
330</Note>
326> [!NOTE]
327>
328> **New feature:** URL mode elicitation is introduced in the `2025-11-25` version of the MCP specification. Its design and implementation may change in future protocol revisions.
331329
332330URL mode elicitation enables servers to direct users to external URLs for out-of-band interactions that must not pass through the MCP client. This is essential for auth flows, payment processing, and other sensitive or secure operations.
333331
from line 338
340338
341339The `url` parameter **MUST** contain a valid URL.
342340
343<Note>
344 **Important**: URL mode elicitation is *not* for authorizing the MCP client's
345 access to the MCP server (that's handled by [MCP
346 authorization](../basic/authorization)). Instead, it's used when the MCP
347 server needs to obtain sensitive information or third-party authorization on
348 behalf of the user. The MCP client's bearer token remains unchanged. The
349 client's only responsibility is to provide the user with context about the
350 elicitation URL the server wants them to open.
351</Note>
341> [!NOTE]
342>
343> **Important**: URL mode elicitation is *not* for authorizing the MCP client's
344> access to the MCP server (that's handled by [MCP
345> authorization](../basic/authorization)). Instead, it's used when the MCP
346> server needs to obtain sensitive information or third-party authorization on
347> behalf of the user. The MCP client's bearer token remains unchanged. The
348> client's only responsibility is to provide the user with context about the
349> elicitation URL the server wants them to open.
352350
353351#### Example: Request Sensitive Data
354352
from line 573
575573* State storage **MUST** be protected against unauthorized access
576574* For remote MCP servers, user identification **MUST** be derived from credentials acquired via [MCP authorization](../basic/authorization) when possible (e.g. `sub` claim)
577575
578<Note>
579 The examples in this section are non-normative and illustrate potential uses
580 of elicitation. Implementers should adapt these patterns to their specific
581 requirements while maintaining security best practices.
582</Note>
576> [!NOTE]
577>
578> The examples in this section are non-normative and illustrate potential uses
579> of elicitation. Implementers should adapt these patterns to their specific
580> requirements while maintaining security best practices.
583581
584582### URL Mode Elicitation for Sensitive Data
585583
from line 623
625623
626624Credentials obtained via URL mode elicitation are distinct from the MCP server credentials used by the MCP client. The MCP server **MUST NOT** transmit credentials obtained through URL mode elicitation to the MCP client.
627625
628<Note>
629 For additional background, refer to the [token passthrough
630 section](../basic/security_best_practices#token-passthrough) of the Security
631 Best Practices document to understand why MCP servers cannot act as
632 pass-through proxies.
633</Note>
626> [!NOTE]
627>
628> For additional background, refer to the [token passthrough
629> section](../basic/security_best_practices#token-passthrough) of the Security
630> Best Practices document to understand why MCP servers cannot act as
631> pass-through proxies.
634632
635633#### Implementation Pattern
636634
No line in this hunk matches that.