What is MCP Elicitation?
A protocol feature allowing MCP servers to request additional structured input from users during an interaction, creating a dynamic feedback channel that can be exploited for social engineering if ungoverned.
WHY IT MATTERS
Some tools need information they can't get from the agent alone — an OAuth token, a confirmation, a file path. Elicitation lets the server ask the user directly, bypassing the agent's context window.
This creates a new attack surface. A malicious server could use elicitation to phish credentials, trick users into confirming dangerous actions, or extract sensitive information under the guise of a legitimate request. Elicitation requests need the same policy scrutiny as tool calls.
HOW POLICYLAYER USES THIS
PolicyLayer can inspect and gate elicitation requests, ensuring servers can only request information that matches expected patterns for their declared purpose.