# What is MCP elicitation and sampling? · Stacktree

Source: https://stacktr.ee/blog/what-is-mcp-elicitation

[Skip to content](#main) PFrom Product Hunt? Your first pages are free, no card. Code `PRODUCTHUNT` takes 50% off your first month of Studio.[Start free →](https://app.stacktr.ee/?join=1&from=producthunt)

×   A Stacktree customer sent you. Your first month is 50% off on any plan, taken off at checkout. [Start free →](https://app.stacktr.ee/?join=1&from=referral)

 ×    [Stacktree](/)[Developers](/developers)[Agents](/agents)[Docs](/docs)[Use cases](/use-cases)[Pricing](/pricing)[Blog](/blog)[Dashboard](https://app.stacktr.ee)[Sign in →](https://app.stacktr.ee)      By [ Steve Smith ](/about) · Founder, Stacktree  ·  Last updated May 30, 2026          blog

#  What is MCP elicitation and sampling?

   Two MCP capabilities let a server reach back to the client mid-call: elicitation asks the user for input, sampling asks the client model to reason. Here is how each works, how they combine, and why they make servers active participants rather than passive endpoints.

  [ Get started free ](https://app.stacktr.ee/?join=1&from=seo_blog_what_is_mcp_elicitation)   install npx stacktree-install
Copy
      No card · 3 pages free · about a minute

##  What are MCP elicitation and sampling?

Elicitation lets an MCP server request structured input from the user
      mid-operation through the elicitation/create method. Sampling lets a
      server request a language model completion from the client through
      sampling/createMessage. Both are human in the loop, and together they let
      a server pause, ask, and reason before finishing a tool call.

## Why servers need to reach back

A plain tool call is request and response: the client invokes
      tools/call, the server runs, the server returns a result. That works
      until the server hits something it cannot answer on its own. Maybe it
      needs a value the user never supplied, like which repository to publish
      to. Maybe it needs the model to summarize a document before it can
      proceed. Elicitation and sampling are the two channels the Model Context
      Protocol gives a server to handle exactly these cases without giving up
      control or holding secrets it should not have.

## Elicitation: asking the user

To request information from a user, a server sends an
      elicitation/create request. The result carries an action field with one
      of three values, accept, decline, or cancel, plus a content object that
      is present only on accept. This is stable, released behavior in the
      2025-11-25 specification.

An elicitation request has a mode. Form mode (the default if mode is
      omitted) carries a message and a requestedSchema, a JSON Schema
      restricted to a flat object of primitive types, so the client can render
      a simple form. URL mode, added in 2025-11-25, carries a message, a url,
      and an elicitationId for out-of-band flows. Form mode and URL mode exist
      to keep sensitive input off the form path.

The trust rules are normative, not advisory. Servers MUST NOT use form
      mode to request sensitive information such as passwords, API keys, access
      tokens, or payment credentials, and MUST use URL mode for those instead.
      Clients MUST provide UI that makes it clear which server is requesting
      information, and MUST respect user privacy with clear decline and cancel
      options. The user is always in the loop.

## Sampling: asking the client model

To request a language model generation, a server sends a
      sampling/createMessage request. The result returns a role and content
      plus the model used and a stopReason. As the spec puts it, sampling
      allows servers to implement agentic behaviors by enabling LLM calls to
      occur nested inside other MCP server features. A server can reason about
      its own inputs without ever shipping with model credentials.

Crucially, the client controls model selection, and the server never sees
      an API key. The client picks the model, can review and edit the prompt
      before sending, and can deny the request outright. The schema encodes
      this directly: the client has full discretion over which model to select,
      and should inform the user before sampling so they can inspect the request
      and decide whether to approve it. For trust and safety there SHOULD always
      be a human in the loop able to deny sampling requests.

Because the server should not hardcode a model name, sampling uses an
      abstract preference system. A request can carry modelPreferences with
      hints (advisory model-name substrings) plus costPriority, speedPriority,
      and intelligencePriority values from 0 to 1. Hints are advisory; the
      client makes the final model choice. A server says it wants something
      cheap and fast, or something capable, and the client maps that onto a
      model it trusts.

Sampling can go further. A sampling request can itself carry a tools
      array and an optional toolChoice (auto, required, or none), letting the
      client model call tools, receive results, and continue the conversation
      inside a single sampling flow. That is the agentic loop, and the spec
      gates it at every step with human-in-the-loop approval.

## How the two combine, and the draft round-trip pattern

In the released 2025-11-25 spec, both capabilities work as
      server-initiated JSON-RPC requests issued while an operation is in
      progress: the server sends elicitation/create or sampling/createMessage
      nested inside the call it is handling, and the client returns an
      ElicitResult or a CreateMessageResult. That keeps a connection open for
      the duration.

The upcoming next version reshapes this. As of the 2026-07-28 release
      candidate, the Multi Round-Trip Requests pattern (SEP-2322) replaces
      server-initiated requests such as roots/list, sampling/createMessage, and
      elicitation/create. The candidate is locked but not yet final, so treat
      these names as the draft schema, not a shipped release.

The mechanics, confirmed in the draft schema, work like this. A result
      can carry a resultType of input_required whose body is an
      InputRequiredResult. That interface has two optional fields: inputRequests
      (a map of server-initiated requests the client must fulfill) and
      requestState (an opaque blob the client must echo back unmodified on
      retry). At least one of the two MUST be present. The client must treat
      requestState as opaque and not interpret it in any way.

On retry, the client re-issues the original call carrying inputResponses
      (a map keyed identically to inputRequests) and the echoed requestState.
      InputRequiredResult is returned in place of the normal result for
      tools/call, prompts/get, and resources/read, so any of those calls can
      pause and demand input instead of completing. Each value in inputRequests
      is itself a full elicitation or sampling request, so one round-trip can
      batch an elicitation/create and a sampling/createMessage together, each
      keyed by a server-assigned id, and the matching inputResponses mirrors
      those keys with an ElicitResult and a CreateMessageResult.

The payoff is statelessness. Because all the resume state lives in
      requestState rather than in a held connection, the server does not need
      to keep an SSE stream open or share a session store across instances. Any
      instance behind a load balancer can pick up the retry, read the echoed
      state, and continue. (Note that the same release candidate deprecates the
      standalone Roots, Sampling, and Logging client features under SEP-2577,
      with the spec's twelve-month minimum deprecation window, so verify the
      exact status of each feature before depending on it.)

## What this enables for an agent-publishing flow

Consider a server that publishes HTML for an agent. The actions the model
      invokes, publish a site, update it, set a password or expiry, are tools,
      because tools are model-controlled. Listing the user's existing sites is
      a resource, because resources are application-controlled data the client
      reads. A saved workflow like "publish this report privately" fits a
      prompt, because prompts are user-controlled templates a person explicitly
      invokes.

Elicitation and sampling are what make that flow feel responsible rather
      than blind. If a publish call is missing the gating choice, the server
      elicits it: accept, decline, or cancel, with the user seeing exactly
      which server asked. If the report needs a one-line summary for its meta
      description, the server samples the client model rather than guessing or
      calling out to a model of its own. The user approves the model use, and
      no key ever leaves the client. The server stops being a passive endpoint
      and becomes a participant that asks before it acts.

     See it in one call, no account

```
`curl -X POST https://api.stacktr.ee/sites -F file=@index.html
# → a private URL, live for 24h. Claim it free to keep it.`
```

If your agents emit HTML, they need a durable publish target: publish once, then
`update_site`
on every revision keeps the same URL forever. MCP, REST, and skills all speak it:
        the map is at [agent.txt](https://stacktr.ee/agent.txt).

[
Get an API key free
](https://app.stacktr.ee/?join=1&from=bridge_blog_what_is_mcp_elicitation)
FAQ

## Frequent questions

     What is elicitation in the Model Context Protocol? +  Elicitation is when an MCP server requests structured input from the user mid-operation using the elicitation/create method. The result carries an action of accept, decline, or cancel, plus a content object on accept. It lets a server pause a tool call to gather a missing value.   What is sampling in MCP? +  Sampling is when an MCP server asks the client to run a language model completion via the sampling/createMessage method. The client picks the model and returns role, content, model, and stopReason. It lets a server nest reasoning inside its own features without holding any model API keys.   How do elicitation and sampling stay safe? +  Both are human in the loop by design. For sampling, the client controls model choice and a human can review, edit, or deny the prompt. For elicitation, clients must show which server is asking and offer decline and cancel. Servers must use URL mode, not form mode, for credentials.   What is the multi round-trip requests pattern in MCP? +  Multi round-trip requests (SEP-2322) is a draft pattern in the 2026-07-28 release candidate. Instead of a server-initiated request, a call returns an InputRequiredResult with inputRequests and an opaque requestState. The client gathers answers and re-issues the original call with inputResponses and the echoed state.   What is requestState used for in an InputRequiredResult? +  requestState is an opaque blob the server returns alongside inputRequests. The client must echo it back unmodified when re-issuing the original call. Because all resume state lives in the payload, any stateless server instance can continue the work without a held connection or a shared session store.   Can one round-trip combine elicitation and sampling? +  Yes. In the draft schema an InputRequiredResult carries inputRequests as a map, where each value is a full elicitation/create or sampling/createMessage request keyed by a server-assigned id. A single round-trip can batch a user prompt and a model completion, then receive both answers in the matching inputResponses map.
Keep reading

## Related guides

   -  [ Publish HTML over MCP Give an agent a tool to publish a private link in one call. ](/mcp-publish-html)
-  [ What changed in the 2026-07 MCP spec The stateless core, MCP Apps, Tasks, and Multi Round-Trip. ](/blog/mcp-2026-spec-changes)
-  [ Resources vs tools vs prompts The three server primitives and when to use each. ](/blog/mcp-resources-vs-tools-vs-prompts)
-  [ MCP servers explained for developers Tools, resources, prompts, and how a server fits together. ](/blog/mcp-servers-explained-for-developers)

References

## Sources and further reading

   -  [ Elicitation (MCP 2025-11-25) ↗ The released elicitation behavior, action values, and form/url safety rules. ](https://modelcontextprotocol.io/specification/2025-11-25/client/elicitation)
-  [ Sampling (MCP 2025-11-25) ↗ The released sampling behavior, model preferences, and human-in-the-loop model. ](https://modelcontextprotocol.io/specification/2025-11-25/client/sampling)
-  [ MCP draft schema.ts (SEP-2322) ↗ Source of truth for InputRequiredResult, inputRequests, and requestState. ](https://raw.githubusercontent.com/modelcontextprotocol/modelcontextprotocol/main/schema/draft/schema.ts)
-  [ Key Changes (draft changelog) ↗ Authoritative list of the draft changes and SEP numbers. ](https://modelcontextprotocol.io/specification/draft/changelog)
-  [ The 2026-07-28 MCP Specification Release Candidate ↗ The release-candidate announcement and ship-date framing. ](https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/)

##  Give your agent a tool that asks before it acts

 Stacktree publishes private-by-default HTML over MCP. Pair it with elicitation and sampling so your agent confirms gating and drafts copy before it ships a link.

 [ Sign up free → ](https://app.stacktr.ee/?join=1&from=cta_blog_what_is_mcp_elicitation)   install npx stacktree-install
Copy
       Private hosting for the HTML your agents make.

[](https://betalist.com/startups/stacktree?utm_campaign=badge-stacktree&utm_medium=badge&utm_source=badge-featured)[Featured on](https://devhunt.org/tool/stacktree)[](https://buildlist.io)[Get started free](https://app.stacktr.ee/?join=1)

## Product

- [Page video](/page-video)
- [Ask this page](/ask-this-page)
- [Client spaces](/client-spaces)
- [Templates](/templates)
- [Example deliverables](/examples)
- [Custom domains](/custom-domains)
- [Client feedback](/client-feedback-loop)
- [One-time links](/one-time-view-links)
- [See how pages get read](/page-engagement)
- [Made with Stacktree](/made-with)
- [Security](/security)
- [Watch the demo](/demo)

## Agents

- [All integrations](/agents)
- [Claude Code](/claude-code)
- [OpenAI Codex](/codex)
- [Cursor](/cursor)
- [Claude.ai connector](/claude-ai-connector)
- [Claude Cowork](/what-is-claude-cowork)
- [Meta Muse](/muse)
- [MCP server](/mcp-publish-html)
- [Deploy from Claude Code](/deploy-html-from-claude-code)
- [Skills](/skills)
- [Slack app](/slack)
- [n8n node](/n8n)
- [Agent payments (x402)](/x402)

## Alternatives

- [All comparisons](/alternatives)
- [Head-to-head comparisons](/compare)
- [Tiiny Host](/tiiny-host-alternative)
- [GitHub Pages (private)](/github-pages-private-alternative)
- [Vercel](/vercel-alternative-for-agents)
- [ngrok](/ngrok-alternative-for-html)
- [Display.dev](/display-dev-alternative)
- [Static.app](/static-app-alternative)
- [OpenAI Codex Sites](/openai-codex-sites-alternative)
- [here.now](/here-now-alternative)
- [Shippage](/shippage-ai-alternative)
- [Best private hosting](/best-private-html-hosting)

## Use cases

- [All use cases](/use-cases)
- [Share with clients](/share-with-clients)
- [Send a file to a client](/share-html-file-with-client)
- [Share Claude artifacts](/share-claude-artifacts)
- [Share Jupyter notebooks](/share-jupyter-notebook-html)
- [Host Storybook privately](/host-storybook-privately)
- [Architecture diagrams](/share-architecture-diagrams)
- [AI-generated reports](/host-ai-reports)
- [Internal HTML tools](/internal-tool-hosting)
- [Private HTML hosting](/private-html-hosting)
- [Vibe-coded page hosting](/vibe-coding-hosting)
- [Leave a website builder](/website-builder-migration)

## Learn

- [Blog](/blog)
- [Glossary](/glossary)
- [FAQ](/faq)
- [Where AI output should live](/where-ai-output-lives)
- [Agent-loop hosting](/agent-loop-hosting)
- [Why agents need a publish primitive](/blog/why-agents-need-a-publish-primitive)
- [MCP servers explained](/blog/mcp-servers-explained-for-developers)
- [What changed in the 2026-07 MCP spec](/blog/mcp-2026-spec-changes)
- [Sites in Codex explained](/blog/sites-in-codex-explained)
- [Private-by-default hosting](/blog/private-by-default-html-hosting)
- [An agent paid us $1 (x402)](/blog/agent-paid-to-provision-itself)
- [When a loop hits a paywall](/blog/loop-engineering-paywall)
- [Pricing](/pricing)
- [Self-host (new)](/self-host)
- [Changelog](/changelog)
- [Docs](https://stacktr.ee/docs)
- [About](/about)
© 2026 Stacktree · stacktr.ee

[Privacy](/privacy)[Terms](/terms)[Security](/security)[Dashboard](https://app.stacktr.ee)[npm](https://www.npmjs.com/package/stacktree-mcp)[Sitemap](/sitemap.xml)[llms.txt](/llms.txt)[API spec](/openapi.json)

---
Full markdown summary of the Stacktree marketing surface: https://stacktr.ee/llms-full.txt