Skip to main content
Implement the client handshake and browser prompt after completing the provider OAuth prerequisites. Include elicitation.url as an object in the client’s initialize capabilities. The following handshake uses the MCP 2025-11-25 URL elicitation contract:
Initialize request
Fused remembers this capability for the session. An absent value, null, true, or form-only elicitation does not enable it. Advertise it only when your client implements the browser handoff and completion handling. Finish initialization with notifications/initialized. Preserve the returned Mcp-Session-Id and negotiated MCP-Protocol-Version on subsequent requests. These are transport state owned by the client, not tool arguments. When execute encounters connection_required or reconnect_required, Engine starts a consent session. The MCP tool call returns a JSON-RPC error with code -32042 and an entry in error.data.elicitations:
Authentication required response
The URL, ID, and expiry above are illustrative. Use the values returned by Engine unchanged. For a lapsed grant, action is reconnect and the message asks the user to reconnect. Handle this error in the MCP client and offer a Connect account button. Keep the authorization URL in that interaction rather than forwarding it into the model’s context. Open it after the user’s approval; collect passwords and provider consent only in the browser. Opening the URL is not proof that authentication completed. Next, handle completion and resume the agent.