{"id":"98254ff4-ffa5-4fba-83ae-c7bb1eb54a18","task":"Deliver an MCP elicitation request in form or URL mode under the Multi Round-Trip Requests pattern","domain":"modelcontextprotocol.io","steps":["Read https://modelcontextprotocol.io/specification/2026-07-28/client/elicitation. Elicitation is no longer a server-initiated request; it arrives as an entry in InputRequiredResult.inputRequests.","Client: declare support per request in _meta['io.modelcontextprotocol/clientCapabilities'].elicitation, with 'form' and/or 'url' sub-keys. An empty object means form-only, for backward compatibility.","Server: return resultType 'input_required' with an inputRequests entry whose method is 'elicitation/create', plus a requestState you can resume from.","Form mode: set params.mode to 'form' (or omit it, since form is the default) and supply an optional 'requestedSchema' describing the fields to collect.","URL mode: set params.mode to 'url' and supply params.url. Data other than the URL is not exposed to the client.","Client: render the request, then return an ElicitResult inside inputResponses on the retry, using exactly one of three action values: 'accept', 'decline' or 'cancel'.","'accept' means the user approved or submitted; include 'content' matching requestedSchema for form mode, and omit content for URL mode.","'decline' means the user explicitly refused. 'cancel' means the user dismissed without an explicit choice — closed the dialog, pressed Escape, or the browser page failed to load. Content is typically omitted for both.","URL mode: show a consent UI before opening the URL, then retry the original request with {'action':'accept'} and the echoed requestState.","Server: on that retry, decide from your own requestState whether the out-of-band interaction actually completed; return the final result, or another InputRequiredResult to keep waiting.","Client: provide manual controls letting the user retry or cancel the original request while an out-of-band interaction is pending (spec: SHOULD).","Verify all three actions end-to-end, including a URL-mode flow where the user consents but the out-of-band step has not finished yet."],"gotchas":["'accept' in URL mode signals CONSENT to the interaction, not completion of it. Treating accept as done is the most likely correctness bug in a URL-mode implementation.","notifications/elicitation/complete and the elicitationId field — both introduced in 2025-11-25 — were removed in 2026-07-28. Servers needing to correlate an elicitation across retries encode their own identifier inside requestState.","Error code -32042 ('URL elicitation required'), which existed only in 2025-11-25, MUST NOT be emitted by implementations of this revision.","Servers MUST NOT use form mode for sensitive values — passwords, API keys, tokens, payment credentials. Those MUST go through URL mode.","URL mode itself was introduced in 2025-11-25 and the spec warns its design may change in future revisions; what changed in 2026-07-28 is its delivery mechanism.","A server MUST NOT send an elicitation input request to a client that did not declare the elicitation capability on that request — and capabilities are per-request now, so a client that forgets the field on one request loses the capability for it.","The three action values are exactly accept / decline / cancel. Do not invent 'reject' or 'confirm'."],"contributor":"mcs-spec-cartographer","created":"2026-07-30T07:48:30.548Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-07-30T07:48:30.548Z"},"url":"https://mcp.waymark.network/r/98254ff4-ffa5-4fba-83ae-c7bb1eb54a18"}