SEP-1036: URL Mode Elicitation for secure out-of-band interactions (modelcontextprotocol#887)

* Out of band elicitation

* Revisions

* Fixing errata

* Fix format

* Clean up document structure

* Implementation Considerations section

* Cleanup

* Additional clarification on how OOBE is distinct from MCP auth

* Fix schema nits

* Clean up nits

* More nit cleanup

* Update changelog

* phishing applies outside of oauth

* update schema request params

* Update docs/specification/draft/client/elicitation.mdx

Co-authored-by: Geoff Goodman <[email protected]>

* More concise schema expr

* Update docs/specification/draft/client/elicitation.mdx

Co-authored-by: Josh Cunningham <[email protected]>

* Change oob to url

* Clarify URL elicitation note language

* Change requirements to recommendations for ssrf

* Change bad elicitation/track from ignore to error

* Clarify user identification for stdio vs remote

* make links relative for easier versioning switches

* Fixes from review

* add browser guidance

* update schema with new references

* add elicitation/track request to schema

* fix broken links

* typos

* Consistent terminology

* Update docs/specification/draft/client/elicitation.mdx

Co-authored-by: Den Delimarsky 🌺 <[email protected]>

* Updates from review

* make third-party auth example less specific

* clarify user identification language

* update error code to non-reserved

* minor wording clarifications

* Add security consideration feedback for phishing flow around OAuth

* Clarify elicitation request binding

* clarify client URL security responsibilities and remove SSRF section

* disambiguate: downstream->external

* Update docs/specification/draft/client/elicitation.mdx

Co-authored-by: Paul Carleton <[email protected]>

* Remove note about elicitation changing

* Clarify and link to progress utility page

* Fixup changelog

* More cleanup

* Use notifications instead of progress

* Tweak client wording

* Tweak safe URL handling, HTTPS guidance

* Wording of secure browser handling

* Note that cancel includes browser failed

* Allow back compat on elicitation capability object

* Use error code -32042, rename error to UrlElicitationRequiredError

* Clarify that UrlElicitationRequiredError only applies to URL elicitations

* Clarify at least once delivery

* Clarify pre-authenticated links are bad

* Rename notification

* format check

* nit: Update notification name

* fix formatting with prettier

* Fix schema categories

* Auto-gen schema

* Clean up ElicitRequestParams schema

---------

Co-authored-by: Wils Dawson <[email protected]>
Co-authored-by: Geoff Goodman <[email protected]>
Co-authored-by: Josh Cunningham <[email protected]>
Co-authored-by: Den Delimarsky 🌺 <[email protected]>
Co-authored-by: Paul Carleton <[email protected]>

Author: 6 people

docs/legacy/concepts/architecture.mdx

@@ -201,6 +201,9 @@ enum ErrorCode {
   MethodNotFound = -32601,
   InvalidParams = -32602,
   InternalError = -32603,
+
+  // MCP-specific error codes in the range [-32000, -32099]
+  UrlElicitationRequired = -32042,
 }
 ```
 

docs/specification/draft/basic/lifecycle.mdx

@@ -64,7 +64,10 @@ The client **MUST** initiate this phase by sending an `initialize` request conta
         "listChanged": true
       },
       "sampling": {},
-      "elicitation": {}
+      "elicitation": {
+        "form": {},
+        "url": {}
+      }
     },
     "clientInfo": {
       "name": "ExampleClient",

docs/specification/draft/changelog.mdx

@@ -14,6 +14,7 @@ the previous revision, [2025-06-18](/specification/2025-06-18).
 3. Enhance authorization flows with incremental scope consent via `WWW-Authenticate` ([SEP-835](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/835))
 4. Provide guidance on tool names ([SEP-986](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/1603))
 5. Update `ElicitResult` and `EnumSchema` to use a more standards-based approach and support titled, untitled, single-select, and multi-select enums ([SEP-1330](https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1330)).
+6. Added support for [URL mode elicitation](/specification/draft/client/elicitation#url-elicitation-requests)([SEP-1036](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/887))
 
 ## Minor changes