Secure Elicitation.
Secure elicitation is collecting a secret or approval from the user during an AI agent session, such as a password, passkey, MFA code or payment detail, in a channel the agent and the language model cannot read.
Agents break a quiet assumption of login design: that the user types secrets into a page the service controls. In a chat, the obvious place to type is the chat box, which feeds a model, a transcript, and possibly a third-party tool. Secure elicitation keeps the old boundary. The agent can ask for something, but the user supplies it to the service directly.
There are three shapes in use. Redirect the user out of band, as MCP URL mode does. Render a sandboxed component inside the chat whose contents the agent cannot read, as Auth0 describes. Or have the authorization server describe the challenge in structured form so the agent runtime can present it, as the expired IETF draft proposed. Sources: MCP elicitation, 2025-11-25, draft-embesozzi-oauth-agent-native-authorization-00, and Auth0's Oktane 2026 recap.
Our reading. Treat any secret that reaches model context as exposed. Prefer passkeys, which give the agent nothing reusable, and bind the elicitation to the user who started it to avoid the phishing case the MCP spec describes. The MCP server identity model guide covers the surrounding auth design.
Common questions
What is secure elicitation for AI agents?
Secure elicitation is the practice of asking the user for a secret or approval during an agent session through a channel the agent and model cannot see, such as a separate browser page, a passkey prompt, or a sandboxed form. The secret goes to the service that needs it, not into the chat transcript.
Can an MCP server ask for a password through elicitation?
Not through form mode. The MCP 2025-11-25 specification says servers must not use form mode to request passwords, API keys, access tokens or payment credentials, and must use URL mode for those interactions so the data never passes through the MCP client.
What is MCP URL mode elicitation?
URL mode, added in the 2025-11-25 MCP specification, lets a server send the user to an external URL for a sensitive step such as an OAuth sign-in or payment. The client shows the full URL and asks consent before opening it, and the server must verify the user who opens the link is the same user who started the request.
Is secure elicitation the same as step-up authentication?
They overlap. Step-up asks for stronger proof before a sensitive action. Secure elicitation is about the channel: whatever the agent needs from the user, including a step-up challenge, is collected outside the model's context.
Related terms
In the guides
AI Agent Identity and MCP: Authenticating Non-Human Identities
How CIAM evolves for AI agents in 2026: MCP, OAuth 2.1 Dynamic Client Registration, scoped agent tokens, and patterns separating agent from human identity.
Authentication for AI Agents: OAuth Patterns for Non-Human Identity
How AI agents authenticate in 2026. The on-behalf-of pattern, delegated agent identity, OAuth 2.1 Dynamic Client Registration, and where the patterns are still being invented.
MCP Server Identity Model: Authentication, Authorization, and Trust for the Model Context Protocol
MCP is OAuth 2.1 with discovery. How MCP clients identify themselves (CIMD first, DCR as fallback), how servers scope access, and what the spec leaves to you.