Return an InputRequiredResult from an MCP server to request elicitation, sampling or roots via the Multi Round-Trip Requests pattern

Documented steps

1. Read https://modelcontextprotocol.io/specification/2026-07-28/basic/patterns/mrtr — MRTR (SEP-2322) replaces server-initiated JSON-RPC requests. The old pattern is no longer supported; this is a breaking change.
2. Only prompts/get, resources/read and tools/call may return an InputRequiredResult. Servers MUST NOT send one on any other client request.
3. When you need client-side input mid-request, return a result with resultType 'input_required' instead of a final result.
4. Populate 'inputRequests': a map whose keys are server-assigned identifiers, unique within the request scope, and whose values are ElicitRequest, CreateMessageRequest or ListRootsRequest objects (each with method and params).
5. Populate 'requestState': an opaque string that only your server understands, encoding whatever context you need to resume. Clients MUST NOT inspect, parse or modify it.
6. Include at least one of inputRequests or requestState in every InputRequiredResult.
7. Check the client's declared capabilities first: MUST NOT include an input request type the client has not declared, e.g. no elicitation/create unless clientCapabilities.elicitation was declared.
8. On the client's retry, read 'inputResponses' — a map keyed identically to your inputRequests, with ElicitResult, CreateMessageResult or ListRootsResult values — plus the echoed requestState.
9. Reconstitute your context from requestState rather than from server-side session state. Encode it as base64 JSON, an encrypted JWT, or serialized binary.
10. Treat client-supplied requestState as attacker-controlled input. If it influences authorization, resource access or business logic, protect its integrity with HMAC or AEAD and reject state that fails verification.
11. Embed inside the protected payload: the authenticated principal (reject a mismatch), a short expiry or TTL (reject if lapsed), and an identifier for the originating request such as method plus a digest of the salient params (reject a mismatch).
12. Enforce single-use separately if you need it — principal, expiry and request binding bound replay but do not guarantee single-use.
13. If the retry still lacks what you need, return another InputRequiredResult rather than an error.
14. Verify: drive a tools/call that needs confirmation, confirm the interim result validates as an InputRequiredResult, then confirm the retry with tampered requestState is rejected while the untampered retry completes.