Elicitation changedspecification/2026-07-28/client/elicitation
Nearest release: v2.1.305, published under an hour before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 20 Oct 2026 20:02 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 20 Oct 2026 20:07 UTC.
Upstream edited
Recorded here
Lines+43added
Lines−45removed
From line
1
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits3to this page, all time
The whole hunk
from line 1, old and new numbered
/
from line 1
11# Elicitation
22
3<div id="enable-section-numbers" />
4
53The Model Context Protocol (MCP) provides a standardized way for servers to request additional
64information from users through the client during interactions. This flow allows clients to
75maintain control over user interactions and data sharing while enabling servers to gather
from line 19
2119their needs—the protocol itself does not mandate any specific user interaction
2220model.
2321
24<Warning>
25 For trust & safety and security:
22> [!WARNING]
23>
24> For trust & safety and security:
25>
26> * Servers **MUST NOT** use form mode elicitation to request sensitive information such as
27> passwords, API keys, access tokens, or payment credentials
28> * Servers **MUST** use [URL mode](#url-mode-elicitation-requests) for interactions involving
29> such sensitive information
30>
31> "Sensitive information" in this context refers to secrets and credentials that grant access or
32> authorize transactions. General contact or profile information (such as a name, email address,
33> or username) is not categorically prohibited; whether to request such data via form mode is at
34> the discretion of the server and subject to the user's ability to review and decline.
35>
36> MCP clients **MUST**:
37>
38> * Provide UI that makes it clear which server is requesting information
39> * Respect user privacy and provide clear decline and cancel options
40> * For form mode, allow users to review and modify their responses before sending
41> * For URL mode, clearly display the target domain/host and gather user consent before navigation to the target URL
2642
27 * Servers **MUST NOT** use form mode elicitation to request sensitive information such as
28 passwords, API keys, access tokens, or payment credentials
29 * Servers **MUST** use [URL mode](#url-mode-elicitation-requests) for interactions involving
30 such sensitive information
31
32 "Sensitive information" in this context refers to secrets and credentials that grant access or
33 authorize transactions. General contact or profile information (such as a name, email address,
34 or username) is not categorically prohibited; whether to request such data via form mode is at
35 the discretion of the server and subject to the user's ability to review and decline.
36
37 MCP clients **MUST**:
38
39 * Provide UI that makes it clear which server is requesting information
40 * Respect user privacy and provide clear decline and cancel options
41 * For form mode, allow users to review and modify their responses before sending
42 * For URL mode, clearly display the target domain/host and gather user consent before navigation to the target URL
43</Warning>
44
4543## Capabilities
4644
4745Clients that support elicitation **MUST** declare the `elicitation` capability in
from line 315
317315
318316### URL Mode Elicitation Requests
319317
320<Note>
321 **New feature:** URL mode elicitation is introduced in the `2025-11-25` version of the MCP specification. Its design and implementation may change in future protocol revisions.
322</Note>
318> [!NOTE]
319>
320> **New feature:** URL mode elicitation is introduced in the `2025-11-25` version of the MCP specification. Its design and implementation may change in future protocol revisions.
323321
324322URL mode elicitation enables servers to direct users to external URLs for out-of-band interactions that must not pass through the MCP client. This is essential for auth flows, payment processing, and other sensitive or secure operations.
325323
from line 329
331329
332330The `url` parameter **MUST** contain a valid URL.
333331
334<Note>
335 **Important**: URL mode elicitation is *not* for authorizing the MCP client's
336 access to the MCP server (that's handled by [MCP
337 authorization](../basic/authorization)). Instead, it's used when the MCP
338 server needs to obtain sensitive information or third-party authorization on
339 behalf of the user. The MCP client's bearer token remains unchanged. The
340 client's only responsibility is to provide the user with context about the
341 elicitation URL the server wants them to open.
342</Note>
332> [!NOTE]
333>
334> **Important**: URL mode elicitation is *not* for authorizing the MCP client's
335> access to the MCP server (that's handled by [MCP
336> authorization](../basic/authorization)). Instead, it's used when the MCP
337> server needs to obtain sensitive information or third-party authorization on
338> behalf of the user. The MCP client's bearer token remains unchanged. The
339> client's only responsibility is to provide the user with context about the
340> elicitation URL the server wants them to open.
343341
344342#### Example: Request Sensitive Data
345343
from line 469
471469* State storage **MUST** be protected against unauthorized access
472470* For remote MCP servers, user identification **MUST** be derived from credentials acquired via [MCP authorization](../basic/authorization) when possible (e.g. `sub` claim)
473471
474<Note>
475 The examples in this section are non-normative and illustrate potential uses
476 of elicitation. Implementers should adapt these patterns to their specific
477 requirements while maintaining security best practices.
478</Note>
472> [!NOTE]
473>
474> The examples in this section are non-normative and illustrate potential uses
475> of elicitation. Implementers should adapt these patterns to their specific
476> requirements while maintaining security best practices.
479477
480478### URL Mode Elicitation for Sensitive Data
481479
from line 519
521519
522520Credentials obtained via URL mode elicitation are distinct from the MCP server credentials used by the MCP client. The MCP server **MUST NOT** transmit credentials obtained through URL mode elicitation to the MCP client.
523521
524<Note>
525 For additional background, refer to the [token passthrough
526 section](/docs/2026-07-28/tutorials/security/security_best_practices#token-passthrough)
527 of the Security Best Practices document to understand why MCP servers cannot
528 act as pass-through proxies.
529</Note>
522> [!NOTE]
523>
524> For additional background, refer to the [token passthrough
525> section](/docs/2026-07-28/tutorials/security/security_best_practices#token-passthrough)
526> of the Security Best Practices document to understand why MCP servers cannot
527> act as pass-through proxies.
530528
531529#### Implementation Pattern
532530
No line in this hunk matches that.