Elicitation Support for Roo Code - Enhanced Email Security Experience Example

[dipseth]

AI written, human dictated with instruction to reduce emoji usage by 50%.

What would this add to Roo Code?

I'd love to see elicitation support in Roo Code! This is an MCP protocol feature that enables interactive confirmation dialogs for sensitive operations like sending emails. Right now, when MCP servers want to ask for user confirmation, Roo Code can't display those prompts, so users miss out on a really nice security experience.

Why this would be awesome

Current Experience (Without Elicitation)

When I try to send an email to someone not on my trusted list:

1. 🤖 My MCP server detects the untrusted recipient
2. ⚠️ Roo Code can't show me a confirmation dialog
3. 📝 Email just gets saved as a draft automatically
4. 😅 I have to manually hunt down the draft and decide what to do

Dream Experience (With Elicitation)

What I'd love to see happen instead:

1. 🤖 My MCP server detects the untrusted recipient
2. 🎯 Roo Code shows me a nice dialog asking what I want to do
3. ✨ I can choose "Send", "Save as Draft", or "Cancel" right there
4. 🚀 My choice happens immediately - no draft hunting!

Real Example from FastMCP2

I've been working with an MCP server (FastMCP2) that has this elicitation system built in. Here's what the experience looks like:

When I try to send to an untrusted recipient, I get this nice interactive dialog that shows:

• 🛡️ Security notice telling me the recipient isn't trusted
• 📧 Email preview with subject, content type, and body
• 🎛️ Clear action buttons for Send/Save Draft/Cancel
• ⏱️ Auto-timeout after 5 minutes for security

The response I get back is really helpful too:

{
  "success": true,
  "message": "📝 **EMAIL SAVED AS DRAFT** (not sent)",
  "draftId": "r-5949208333949694620", 
  "recipientCount": 1,
  "elicitationRequired": true,
  "recipientsNotAllowed": ["[email protected]"],
  "action": "saved_draft"
}

What makes this experience great

• 🎯 No more accidental emails - I always get a chance to confirm
• ⚡ Immediate action - No hunting around for drafts later
• 🧠 Peace of mind - I can see exactly what I'm about to send and to whom
• 🔄 Flexible choices - Send now, save for later, or cancel completely
• ✅ Trusted contacts work seamlessly - People on my allow list still get emails instantly

Other use cases coming

This wouldn't just be for emails! The MCP protocol supports elicitation for any sensitive operation. I could see this being useful for:

• 🗃️ File operations - "Are you sure you want to delete these 50 files?"
• 💰 API calls with costs - "This will make 100+ API calls, proceed?"
• 🌐 External integrations - "Post this message to Slack/Teams?"
• 📧 Bulk operations - "Send this email to 25 people in your contact list?"

What I can offer

I can't promise to implement this (don't have the time right now), but I'd be happy to help test it once someone builds it! I've got the FastMCP2 setup working perfectly, so I can test the Roo Code integration thoroughly.

---

This would make Roo Code feel so much more polished and secure! 🚀

[Harsha-1008]

I know this is a really useful feature happy to discuss.

[dipseth]

Yeah I think so to, it seems like we will need some solid CODING use cases spelled out to get any traction on this.

My very quick coding example is just thinking of how elicitation could help improve the user experience with internal Roo tools (assuing they are mcp based and can leverage this). Maybe there could be an eliciation for the first time an internal tool is used explaining what this tool does and maybe asking to set some defaults (like codebase search for example my favorite).