Skip to content

SEP-1036: URL Mode Elicitation for secure out-of-band interactions #887

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pcarleton merged 87 commits into from
Nov 13, 2025
Merged

SEP-1036: URL Mode Elicitation for secure out-of-band interactions #887

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
87 commits
Select commit Hold shift + click to select a range
a17b173
Out of band elicitation
nbarbettini Jun 24, 2025
6906c2c
Revisions
wdawson Jun 28, 2025
0b661e8
Fixing errata
nbarbettini Jun 29, 2025
d576b03
Fix format
nbarbettini Jun 30, 2025
80c6ac4
Clean up document structure
nbarbettini Jun 30, 2025
155e02b
Implementation Considerations section
nbarbettini Jun 30, 2025
99ffabc
Cleanup
nbarbettini Jun 30, 2025
57430b1
Additional clarification on how OOBE is distinct from MCP auth
nbarbettini Jul 1, 2025
bf8ee42
Fix schema nits
nbarbettini Jul 1, 2025
fbd5268
Clean up nits
nbarbettini Jul 1, 2025
dc4fc3b
More nit cleanup
nbarbettini Jul 1, 2025
4095f63
Update changelog
nbarbettini Jul 1, 2025
de5491c
phishing applies outside of oauth
wdawson Jul 1, 2025
f587b90
update schema request params
wdawson Jul 1, 2025
a17686e
Update docs/specification/draft/client/elicitation.mdx
nbarbettini Jul 2, 2025
1ca1e58
More concise schema expr
nbarbettini Jul 2, 2025
6cd7204
Merge branch 'main' into feature/elicitation-out-of-band
nbarbettini Jul 2, 2025
b3a08b7
Update docs/specification/draft/client/elicitation.mdx
nbarbettini Jul 2, 2025
44de907
Change oob to url
wdawson Jul 2, 2025
7fab051
Clarify URL elicitation note language
wdawson Jul 2, 2025
f179987
Change requirements to recommendations for ssrf
wdawson Jul 2, 2025
c251783
Change bad elicitation/track from ignore to error
wdawson Jul 2, 2025
fc2a37d
Clarify user identification for stdio vs remote
wdawson Jul 2, 2025
373c569
make links relative for easier versioning switches
wdawson Jul 2, 2025
e0f127d
Merge remote-tracking branch 'mcp/main' into feature/elicitation-out-…
wdawson Jul 2, 2025
0c8886b
Fixes from review
nbarbettini Jul 5, 2025
f103616
Merge branch 'main' into feature/elicitation-out-of-band
nbarbettini Jul 5, 2025
67a980d
Merge branch 'main' into feature/elicitation-out-of-band
wdawson Jul 8, 2025
f36130e
add browser guidance
wdawson Jul 16, 2025
5c71bbc
Merge branch 'main' into feature/elicitation-out-of-band
wdawson Jul 16, 2025
05ba57c
update schema with new references
wdawson Jul 16, 2025
a747f34
add elicitation/track request to schema
wdawson Jul 16, 2025
2755bff
Merge branch 'main' into feature/elicitation-out-of-band
wdawson Jul 31, 2025
7dc7e52
fix broken links
wdawson Jul 31, 2025
1272fa9
Merge branch 'main' into feature/elicitation-out-of-band
nbarbettini Aug 4, 2025
30b71c4
typos
nbarbettini Aug 5, 2025
fec06f5
Consistent terminology
nbarbettini Aug 5, 2025
2846485
Update docs/specification/draft/client/elicitation.mdx
nbarbettini Aug 5, 2025
5d928d1
Updates from review
nbarbettini Aug 5, 2025
05f2a9a
Merge remote-tracking branch 'refs/remotes/origin/feature/elicitation…
nbarbettini Aug 5, 2025
5aebc27
Merge branch 'main' into feature/elicitation-out-of-band
nbarbettini Aug 5, 2025
27714a6
Merge branch 'main' into feature/elicitation-out-of-band
nbarbettini Aug 5, 2025
2465630
make third-party auth example less specific
wdawson Aug 6, 2025
95fc160
Merge branch 'main' into feature/elicitation-out-of-band
wdawson Aug 8, 2025
bea33ee
clarify user identification language
wdawson Aug 10, 2025
88458dc
Merge branch 'main' into feature/elicitation-out-of-band
wdawson Aug 10, 2025
0503fc2
Merge branch 'main' into feature/elicitation-out-of-band
nbarbettini Aug 11, 2025
2ced3ef
update error code to non-reserved
wdawson Aug 12, 2025
0fdff02
Merge branch 'main' into feature/elicitation-out-of-band
wdawson Aug 14, 2025
66bb94d
Merge branch 'main' into feature/elicitation-out-of-band
wdawson Aug 29, 2025
fb65648
minor wording clarifications
wdawson Aug 29, 2025
7483cbd
Add security consideration feedback for phishing flow around OAuth
wdawson Sep 15, 2025
7b4115f
Merge branch 'main' into feature/elicitation-out-of-band
wdawson Sep 15, 2025
e8998a7
Clarify elicitation request binding
wdawson Sep 18, 2025
89e1e6b
Merge branch 'main' into feature/elicitation-out-of-band
wdawson Sep 18, 2025
3190ba8
clarify client URL security responsibilities and remove SSRF section
wdawson Sep 19, 2025
c5ba18b
Merge branch 'main' into feature/elicitation-out-of-band
nbarbettini Sep 23, 2025
6a00dbb
disambiguate: downstream->external
nbarbettini Sep 23, 2025
6acd8ec
Update docs/specification/draft/client/elicitation.mdx
nbarbettini Sep 23, 2025
319c06a
Remove note about elicitation changing
nbarbettini Sep 23, 2025
b5a3b31
Clarify and link to progress utility page
nbarbettini Sep 23, 2025
55e91be
Merge branch 'main' into feature/elicitation-out-of-band
wdawson Oct 1, 2025
b9c7aaa
Merge branch 'main' into feature/elicitation-out-of-band
wdawson Oct 6, 2025
79cbfba
Merge branch 'main' into feature/elicitation-out-of-band
wdawson Oct 27, 2025
05acdea
Merge remote-tracking branch 'upstream/main' into feature/elicitation…
nbarbettini Nov 6, 2025
382ea07
Fixup changelog
nbarbettini Nov 6, 2025
4f7a794
More cleanup
nbarbettini Nov 6, 2025
a34ed11
Use notifications instead of progress
nbarbettini Nov 6, 2025
09831eb
Tweak client wording
nbarbettini Nov 6, 2025
8230cd2
Tweak safe URL handling, HTTPS guidance
nbarbettini Nov 6, 2025
d49c028
Wording of secure browser handling
nbarbettini Nov 6, 2025
96cfa31
Note that cancel includes browser failed
nbarbettini Nov 6, 2025
73f369f
Allow back compat on elicitation capability object
nbarbettini Nov 6, 2025
4ab1146
Use error code -32042, rename error to UrlElicitationRequiredError
nbarbettini Nov 6, 2025
90f4d7c
Clarify that UrlElicitationRequiredError only applies to URL elicitat…
nbarbettini Nov 6, 2025
31137b8
Clarify at least once delivery
nbarbettini Nov 6, 2025
64e88ed
Clarify pre-authenticated links are bad
nbarbettini Nov 6, 2025
3398cad
Rename notification
nbarbettini Nov 7, 2025
7d36a63
format check
nbarbettini Nov 7, 2025
6f86ff2
nit: Update notification name
nbarbettini Nov 8, 2025
bd8b1c4
Merge branch 'main' into feature/elicitation-out-of-band
nbarbettini Nov 8, 2025
5cd4d3a
fix formatting with prettier
nbarbettini Nov 8, 2025
cb443de
Merge branch 'main' into feature/elicitation-out-of-band
nbarbettini Nov 10, 2025
eb18175
Merge branch 'main' into feature/elicitation-out-of-band
nbarbettini Nov 13, 2025
7ec04b8
Fix schema categories
nbarbettini Nov 13, 2025
0bbcf3f
Auto-gen schema
nbarbettini Nov 13, 2025
9dede17
Clean up ElicitRequestParams schema
nbarbettini Nov 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions docs/legacy/concepts/architecture.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,6 +201,9 @@ enum ErrorCode {
MethodNotFound = -32601,
InvalidParams = -32602,
InternalError = -32603,

// MCP-specific error codes in the range [-32000, -32099]
UrlElicitationRequired = -32042,
}
```

Expand Down
5 changes: 4 additions & 1 deletion docs/specification/draft/basic/lifecycle.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,10 @@ The client **MUST** initiate this phase by sending an `initialize` request conta
"listChanged": true
},
"sampling": {},
"elicitation": {}
"elicitation": {
"form": {},
"url": {}
}
},
"clientInfo": {
"name": "ExampleClient",
Expand Down
1 change: 1 addition & 0 deletions docs/specification/draft/changelog.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ the previous revision, [2025-06-18](/specification/2025-06-18).
3. Enhance authorization flows with incremental scope consent via `WWW-Authenticate` ([SEP-835](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/835))
4. Provide guidance on tool names ([SEP-986](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/1603))
5. Update `ElicitResult` and `EnumSchema` to use a more standards-based approach and support titled, untitled, single-select, and multi-select enums ([SEP-1330](https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1330)).
6. Added support for [URL mode elicitation](/specification/draft/client/elicitation#url-elicitation-requests)([SEP-1036](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/887))

## Minor changes

Expand Down
Loading