Repository navigation
SEP-1036: URL Mode Elicitation for secure out-of-band interactions #692
Description
This is a tracking issue for modelcontextprotocol/modelcontextprotocol#887
This is a tracking issue for modelcontextprotocol/modelcontextprotocol#887
Activity
embesozzi commentedon Feb 6, 2026
It would be a valuable feature to support out-of-band interactions in the context of authentication or JIT authorization for users with the OAuth 2.0 Device Authorization Grant [1]
[1] https://datatracker.ietf.org/doc/html/rfc8628
sainathreddyb commentedon Apr 10, 2026
I am working on implementing this should have a PR shortly
Kehrlann commentedon Apr 10, 2026
@sainathreddyb please discuss the design here before fleshing out a full PR.
sainathreddyb commentedon Apr 10, 2026
Hey @Kehrlann, here's the design I'm proposing. Happy to iterate.
Context: The TypeScript SDK already implements URL mode elicitation. The Java SDK has the capability plumbing (#731) but not the actual protocol flow.
Approach: Flat record (matching TypeScript runtime behavior)
I considered two options:
Sealed interface (
ElicitRequestFormParams | ElicitRequestURLParamswith@JsonTypeInfo) — gives compile-time type safety but breaks the existing handler signatureFunction<ElicitRequest, Mono<ElicitResult>>and everycreateElicitation()call site. TheContentinterface uses this pattern, but it was designed that way from the start.Flat record (add
mode,url,elicitationIdto existingElicitRequest) — zero breaking changes, matches how the TypeScript SDK actually works at runtime (elicitInput()takes the union and switches onmode). Tradeoff: no compile-time enforcement that URL mode can't haverequestedSchema, but the builder validates at runtime.I went with option 2. The TypeScript SDK doesn't break its handler signature either — it keeps one handler that receives
ElicitRequestand branches onparams.mode.Changes :
McpSchema.ElicitRequest— addedmode,url,elicitationIdfields. Backward-compat constructors preserved. Builder validates mode="url" requires url+elicitationId.McpSchema.ElicitationCompleteNotification— new record fornotifications/elicitation/completeMcpSchema.ErrorCodes.URL_ELICITATION_REQUIRED= -32042McpAsyncServerExchange.createElicitation()— now checks URL capability when mode="url"McpAsyncServerExchange.sendElicitationComplete()— new methodMcpSyncServerExchange— sync wrapperelicitationCompleteConsumeron builder, notification handler inMcpAsyncClientOpen questions for you:
mode="url" + requestedSchema, or silently ignorerequestedSchema?sendElicitationCompletevsnotifyElicitationComplete)sainathreddyb commentedon Apr 20, 2026
@Kehrlann please let me know if you have need further details on design.
For now created a PR will iterate on it based on feedback #939