143 pages for consent.

Understanding MCP clients Model Context Protocol · in the page docs/draft/learn/client-concepts …ndling**: For URL mode, clients show the full URL and gather explicit consent before opening it, and never fetch the URL automatically. The client only learns whether the user consented. The interacti… Understanding MCP servers Model Context Protocol · in the page docs/draft/learn/server-concepts …ation with clearly defined inputs and outputs. Tools may require user consent prior to execution, helping to ensure users maintain control over actions taken by a model. **Protocol operations:** | M… Authorization Model Context Protocol · in the page docs/draft/tools/inspector/authorization …browser** The Inspector opens the authorization URL. You sign in and consent. **5. Receive the callback** The authorization server redirects to the Inspector's callback URL, carrying the authorizat… Understanding Authorization in MCP Model Context Protocol · in the page docs/draft/tutorials/security/authorization …ich actions * Your server grants access to its APIs that require user consent * You're building for enterprise environments with strict access controls * You want to rate-limit or track usage per user… Local Server Security Model Context Protocol · in the page docs/draft/tutorials/security/local-server-security …s/1024-mcp-client-security-requirements-for-local-server-.md)), but a consent dialog only helps if you know what to look for. That is what the rest of this guide is about. ### The stdio Trust Model… Security Best Practices Model Context Protocol · in the page docs/draft/tutorials/security/security_best_practices …s malicious clients to obtain authorization codes without proper user consent by exploiting the combination of static client IDs, dynamic client registration, and consent cookies. #### Terminology *… MCP Apps Model Context Protocol · in the page extensions/apps/overview …apabilities and tools the user has already connected (subject to user consent). Instead of every app implementing and maintaining direct integrations (e.g., email providers), the app can request an ou… Authorization Extensions Model Context Protocol · in the page extensions/auth/overview …and automated workflows need to authenticate without interactive user consent flows. * **Enterprise environments** often have centralized identity providers (IdPs) that enforce policy across all appli… Skills Model Context Protocol · in the page extensions/skills/overview …-tools` require explicit per-skill user approval. * Obtain fresh user consent before activating a nested skill. Reading its `SKILL.md` as supporting content does not activate it or its frontmatter.… SEP-1024: MCP Client Security Requirements for Local Server Installation Model Context Protocol · in the page seps/1024-mcp-client-security-requirements-for-local-server- …establishes a best practice for MCP clients, requiring explicit user consent before executing any local server installation commands and complete command transparency. ## Motivation The existing MC… SEP-1036: URL Mode Elicitation for secure out-of-band interactions Model Context Protocol · in the page seps/1036-url-mode-elicitation-for-secure-out-of-band-intera …``` The response with `action: "accept"` indicates that the user has consented to the interaction. The interaction occurs out of band and the client is not aware of the outcome unless the server send… SEP-1865: MCP Apps - Interactive User Interfaces for MCP Model Context Protocol · in the page seps/1865-mcp-apps-interactive-user-interfaces-for-mcp …All UI-to-host communication goes through loggable JSON-RPC * **User consent**: Hosts can require explicit approval for UI-initiated tool calls A full threat model analysis and mitigations are avail… SEP-2149: MCP Group Governance and Charter Template Model Context Protocol · in the page seps/2149-working-group-charter-template …minimum for minor items, 10 days for significant items) * Silence is consent * Any WG Member may block with documented objection * Blocks must propose alternatives or clear criteria for resolution *… SEP-2640: Skills Extension Model Context Protocol · in the page seps/2640-skills-extension …hosts MUST NOT act on its frontmatter. * **Activation requires fresh consent.** Approval is per skill: approving a skill approves that skill alone and says nothing about skills nested within it. Acti… SEP-991: Enable URL-based Client Registration using OAuth Client ID Metadata Documents Model Context Protocol · in the page seps/991-enable-url-based-client-registration-using-oauth-c …policy alt Validation Success Server->>User: Display consent page with client_name User->>Server: Approves access Server->>Client: Authorization code via redirect_… Architecture Model Context Protocol · in the page specification/2024-11-05/architecture/index …connection permissions and lifecycle * Enforces security policies and consent requirements * Handles user authorization decisions * Coordinates AI/LLM integration and sampling * Manages context aggreg… Roots Model Context Protocol · in the page specification/2024-11-05/client/roots …plementation Guidelines 1. Clients **SHOULD**: * Prompt users for consent before exposing roots to servers * Provide clear user interfaces for root management * Validate root accessibility b… Specification Model Context Protocol · in the page specification/2024-11-05/index …l implementors must carefully address. ### Key Principles 1. **User Consent and Control** * Users must explicitly consent to and understand all data access and operations * Users must retain c… Architecture Model Context Protocol · in the page specification/2025-03-26/architecture/index …connection permissions and lifecycle * Enforces security policies and consent requirements * Handles user authorization decisions * Coordinates AI/LLM integration and sampling * Manages context aggreg… Roots Model Context Protocol · in the page specification/2025-03-26/client/roots …plementation Guidelines 1. Clients **SHOULD**: * Prompt users for consent before exposing roots to servers * Provide clear user interfaces for root management * Validate root accessibility b… Specification Model Context Protocol · in the page specification/2025-03-26/index …l implementors must carefully address. ### Key Principles 1. **User Consent and Control** * Users must explicitly consent to and understand all data access and operations * Users must retain c… Architecture Model Context Protocol · in the page specification/2025-06-18/architecture/index …connection permissions and lifecycle * Enforces security policies and consent requirements * Handles user authorization decisions * Coordinates AI/LLM integration and sampling * Manages context aggreg… Authorization Model Context Protocol · in the page specification/2025-06-18/basic/authorization …tolen authorization codes, they can obtain access tokens without user consent. MCP proxy servers using static client IDs **MUST** obtain user consent for each dynamically registered client before for… Roots Model Context Protocol · in the page specification/2025-06-18/client/roots …plementation Guidelines 1. Clients **SHOULD**: * Prompt users for consent before exposing roots to servers * Provide clear user interfaces for root management * Validate root accessibility b… Specification Model Context Protocol · in the page specification/2025-06-18/index …l implementors must carefully address. ### Key Principles 1. **User Consent and Control** * Users must explicitly consent to and understand all data access and operations * Users must retain c… Architecture Model Context Protocol · in the page specification/2025-11-25/architecture/index …connection permissions and lifecycle * Enforces security policies and consent requirements * Handles user authorization decisions * Coordinates AI/LLM integration and sampling * Manages context aggreg… Authorization Model Context Protocol · in the page specification/2025-11-25/basic/authorization …ust policy alt Validation Success Server->>User: Display consent page with client_name User->>Server: Approves access Server->>Client: Authorization code via redirect_uri… Key Changes Model Context Protocol · in the page specification/2025-11-25/changelog …l/issues/973)). 3. Enhance authorization flows with incremental scope consent via `WWW-Authenticate` ([SEP-835](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/835)) 4. Provide guida… Elicitation Model Context Protocol · in the page specification/2025-11-25/client/elicitation …For URL mode, clearly display the target domain/host and gather user consent before navigation to the target URL ## Capabilities Clients that support elicitation **MUST** declare the `elicitation`… Roots Model Context Protocol · in the page specification/2025-11-25/client/roots …plementation Guidelines 1. Clients **SHOULD**: * Prompt users for consent before exposing roots to servers * Provide clear user interfaces for root management * Validate root accessibility b… Specification Model Context Protocol · in the page specification/2025-11-25/index …l implementors must carefully address. ### Key Principles 1. **User Consent and Control** * Users must explicitly consent to and understand all data access and operations * Users must retain c… Architecture Model Context Protocol · in the page specification/2026-07-28/architecture/index …connection permissions and lifecycle * Enforces security policies and consent requirements * Handles user authorization decisions * Coordinates AI/LLM integration and sampling * Manages context aggreg… Client Registration Model Context Protocol · in the page specification/2026-07-28/basic/authorization/client-registration …ust policy alt Validation Success Server->>User: Display consent page with client_name User->>Server: Approves access Server->>Client: Authorization code via redirect_uri… Authorization Security Considerations Model Context Protocol · in the page specification/2026-07-28/basic/authorization/security-considerations …tolen authorization codes, they can obtain access tokens without user consent. MCP proxy servers using static client IDs **MUST** obtain user consent for each [dynamically registered client](https://… Elicitation Model Context Protocol · in the page specification/2026-07-28/client/elicitation …For URL mode, clearly display the target domain/host and gather user consent before navigation to the target URL ## Capabilities Clients that support elicitation **MUST** declare the `elicitation`… Roots Model Context Protocol · in the page specification/2026-07-28/client/roots …plementation Guidelines 1. Clients **SHOULD**: * Prompt users for consent before exposing roots to servers * Provide clear user interfaces for root management * Validate root accessibility b… Specification Model Context Protocol · in the page specification/2026-07-28/index …l implementors must carefully address. ### Key Principles 1. **User Consent and Control** * Users must explicitly consent to and understand all data access and operations * Users must retain c… Architecture Model Context Protocol · in the page specification/draft/architecture/index …connection permissions and lifecycle * Enforces security policies and consent requirements * Handles user authorization decisions * Coordinates AI/LLM integration and sampling * Manages context aggreg… Client Registration Model Context Protocol · in the page specification/draft/basic/authorization/client-registration …ust policy alt Validation Success Server->>User: Display consent page with client_name User->>Server: Approves access Server->>Client: Authorization code via redirect_uri… Authorization Security Considerations Model Context Protocol · in the page specification/draft/basic/authorization/security-considerations …tolen authorization codes, they can obtain access tokens without user consent. MCP proxy servers using static client IDs **MUST** obtain user consent for each [dynamically registered client](https://… Elicitation Model Context Protocol · in the page specification/draft/client/elicitation …For URL mode, clearly display the target domain/host and gather user consent before navigation to the target URL ## Capabilities Clients that support elicitation **MUST** declare the `elicitation`… Roots Model Context Protocol · in the page specification/draft/client/roots …plementation Guidelines 1. Clients **SHOULD**: * Prompt users for consent before exposing roots to servers * Provide clear user interfaces for root management * Validate root accessibility b… Specification Model Context Protocol · in the page specification/draft/index …l implementors must carefully address. ### Key Principles 1. **User Consent and Control** * Users must explicitly consent to and understand all data access and operations * Users must retain c…