MCP Elicitation: Keep Sensitive Steps Outside the Agent
How URL-mode elicitation creates safer boundaries for payments, credentials, consent, and third-party authorization in agent workflows.
Some steps should never pass through an agent conversation: entering a password, approving a payment, completing a third-party OAuth flow, or sharing a secret. URL-mode elicitation gives the server a way to direct the person to a trusted out-of-band page and later resume the workflow from a result.
Separate assistance from authority
The agent can explain why a step is needed and what will happen next. The sensitive page should own authentication, consent, validation, and submission. The agent receives only the minimum status required to continue.
- Show the destination and purpose before the user opens it
- Use a unique, short-lived correlation identifier
- Do not place credentials, payment details, or authorization codes in chat
- Bind the callback to the initiating user, session, and exact request
- Expire abandoned requests and make retry behavior explicit
Design the return path
A secure handoff still needs good product design. Tell the user when they can close the external page, show whether the action succeeded, and let the workflow recover cleanly from cancellation or expiry.
Use elicitation sparingly
Every handoff interrupts the flow. Reserve it for moments where a direct user interaction materially improves security, consent, or compliance, and keep ordinary low-risk inputs inside the main experience.
Primary sources
First-party documentation and announcements used to ground this field note.
