Skip to content

feat(everything): add URL elicitation example (SEP-1036)#3895

Open
JosephDoUrden wants to merge 1 commit intomodelcontextprotocol:mainfrom
JosephDoUrden:feat/url-elicitation-example
Open

feat(everything): add URL elicitation example (SEP-1036)#3895
JosephDoUrden wants to merge 1 commit intomodelcontextprotocol:mainfrom
JosephDoUrden:feat/url-elicitation-example

Conversation

@JosephDoUrden
Copy link
Copy Markdown

Summary

Add a trigger-url-elicitation-request tool to the Everything server that demonstrates SEP-1036 URL Elicitation — the new url mode for secure out-of-band interactions.

Closes #3034

What is URL Elicitation?

SEP-1036 extends MCP elicitation with a url mode for scenarios where sensitive data (credentials, payment info) must not transit through the MCP client:

  • Third-party OAuth authorisation flows
  • Payment/subscription flows (PCI compliance)
  • Sensitive credential collection

The server sends elicitation/create with mode: "url", and the client navigates the user to the specified URL. The actual interaction happens out-of-band in the browser.

Changes

  • src/everything/tools/trigger-url-elicitation-request.ts: New tool that sends a URL elicitation request with an example GitHub OAuth URL
  • src/everything/tools/index.ts: Register the tool in registerConditionalTools (only when client declares elicitation.url capability)

Design

Follows the same pattern as the existing trigger-elicitation-request tool:

  • Conditionally registered based on client capabilities (elicitation.url)
  • Handles all three response actions (accept, decline, cancel)
  • Includes raw result for debugging
  • Uses ElicitResultSchema for response validation

Test plan

  • TypeScript compiles (npx tsc --noEmit)
  • All 95 existing Everything server tests pass (npx vitest run)

AI Disclosure

AI assistance (Claude) was used for issue research and understanding SEP-1036. The implementation was written and reviewed by the author.

Add a trigger-url-elicitation-request tool to the Everything server that
demonstrates SEP-1036 URL Elicitation. The tool sends an
elicitation/create request with mode "url", asking the client to
navigate the user to an external URL for out-of-band interaction (e.g.,
third-party OAuth authorization).

The tool is conditionally registered only when the client declares
elicitation.url capability, consistent with existing elicitation tools.

Closes modelcontextprotocol#3034
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add Example for SEP-1036: URL Elicitation to Everything Server

1 participant