elicitly
Elicitly is a local MCP server for human-in-the-loop prompts, letting an AI agent ask users questions, collect form input, diagnose elicitation support, and show rendered content.
Confirm a decision with
elicit_confirm: ask an OK/Cancel question, optionally relabel buttons and set a timeout; returnsconfirmedas true, false, or null.Collect structured input with
elicit_form: present a user-filled form from a caller-supplied flat JSON schema and return the action plus submitted content.Check host support with
elicit_doctor: report whether elicitation, forms, URL elicitation, sampling, and roots are supported, optionally running a live elicitation probe.Display rich output with
elicit_display: render a LiquidJS HTML template with JSON context inline in hosts that support MCP Apps, with title, summary, and an external-resource allowlist.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@elicitlyconfirm with the user before shipping this change to production"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Elicitly — Free Edition
Your AI has questions. Your users have answers. Elicitly connects them — human-in-the-loop for prompts and Agent Skills over MCP elicitation.
This repository is the open-source Free Edition: the elicitly local MCP
server and the @elicitly/tools library. The hosted Pro Edition — durable
approvals with review pages, an audit trail, and organization dashboards —
lives at elicitly.ai.
Quick start
Run the local (stdio) MCP server straight from npm — no clone, no config:
npx -y elicitlyRegister it in your MCP host (Claude Code shown; any stdio host works):
claude mcp add elicitly -- npx -y elicitlyOr skip the command line: in Claude Desktop, download elicitly.mcpb from
the latest release
and open it — a one-click, self-contained
desktop extension.
Then ask your agent to call elicit_confirm ("Ship it?"), elicit_form
(your own JSON schema), elicit_doctor (does this host actually support
elicitation?), or elicit_display (show a LiquidJS template rendered inline as an
MCP App).
Related MCP server: MCP-Confirm
Packages
Package | What it is |
The local stdio MCP server ( | |
Embeddable toolkit: register the elicitation tools on your own |
Why
MCP has a native answer for asking a human — elicitation — but host support is
inconsistent, and only an MCP server can trigger it. Nobody wants to roll
their own server just to ask a question. Elicitly is that server (or, via
@elicitly/tools, the toolkit inside yours), plus the diagnostic
(elicit_doctor) that makes real-world host support visible — feeding the
public Support Matrix.
Develop
pnpm install
pnpm build # tsdown builds both packages
pnpm test # vitest
pnpm test:coverage # vitest + v8 coverage (thresholds enforced; HTML report in coverage/)
pnpm typecheck # tsc
pnpm check # biomeLicense
Elicitly™ is a trademark of Preneur LLC — see TRADEMARKS.md.
Available Tools
4 toolselicit_confirmAsk the user to confirm (OK/Cancel)A
Ask the user an OK/Cancel confirmation via elicitation (convenience wrapper over elicit_form), modeled on JavaScript's confirm(). Use this for a single yes/no question; use elicit_form to collect arbitrary fields. Returns three-state {confirmed}: true = proceed, false = a human explicitly said no, null = no answer was obtained (reason: "dismissed" | "error") — ask again later.
| Name | Required | Description | Default |
|---|---|---|---|
| labels | No | Relabel or localize the OK/Cancel buttons. Each label is trimmed, 1-40 characters; unknown keys are rejected. Button placement and styling stay fixed. | |
| message | Yes | The yes/no question shown to the user in the host's elicitation dialog. | |
| timeoutSeconds | No | How long to wait for the answer, in seconds (default 300, clamped 60-3600). |
Output Schema
| Name | Required | Description |
|---|---|---|
| reason | No | Present only when confirmed is null: "dismissed" = the elicitation was closed unanswered (including timeout), "error" = it failed. |
| confirmed | Yes | true = the user chose OK; false = an explicit no (Cancel choice or declined elicitation); null = no answer was obtained. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare openWorldHint=false and destructiveHint=false, so the description does real work by disclosing the three-state return semantics and the meaning of null ("dismissed" | "error") plus the follow-up advice to ask again later. It adds handling guidance rather than merely restating structured data, though it says nothing about the blocking/timeout behavior of the call itself.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, front-loaded with what the tool does and its alternative before the longer return-value contract. Every clause carries information an agent needs; nothing is padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists so return values need not be re-specified, yet the description still clarifies the ambiguous null case. Combined with the alternatives routing and full param documentation, an agent has everything required to call and interpret this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema already documents message, labels (with length bounds and trimming rules), and timeoutSeconds clamping. The description's echoes of "OK/Cancel" and "single yes/no question" add only framing, not new parameter semantics, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb ("Ask the user") plus precise resource (OK/Cancel confirmation via elicitation) and it explicitly positions itself as a convenience wrapper over elicit_form. An agent can distinguish it from elicit_form, elicit_doctor, and elicit_display without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit routing rule: "Use this for a single yes/no question; use elicit_form to collect arbitrary fields." It gives both the when and the named alternative, leaving nothing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
elicit_displayShow the user rendered contentARead-only
Show information to the user as rendered HTML instead of Markdown: pass a LiquidJS template and a JSON context, and hosts that support MCP Apps render it inline in the conversation. Use it for tables, reports, and summaries the user should scan; it does not collect a decision (use elicit_confirm or elicit_form for that). Values interpolated with {{ context.* }} are HTML-escaped; truthiness is JavaScript-style. Templates may load Tailwind (https://cdn.jsdelivr.net/npm/@tailwindcss/browser@4) and DaisyUI (https://cdn.jsdelivr.net/npm/daisyui@5) with their own / tags; the view follows the host's light/dark theme via data-theme. External images, scripts, styles, and fonts load only from: https://cdn.jsdelivr.net — anything else is blocked. Use data: URIs for images you already have that are not publicly reachable (generated, read from a local file, or from a private source the user gave you), passed in context rather than the template (64 KB vs 32 KB). Don't download a public image just to work around the allowlist: if its origin isn't allowed, leave it out and tell the user which origin to allow. The rendered HTML is not returned to you — the result only says whether it could be shown.
| Name | Required | Description | Default |
|---|---|---|---|
| title | No | Heading shown above the render. | |
| context | No | JSON data exposed to the template as `context`. Max 64 KB serialized. | |
| summary | No | One or two sentences describing what is shown; returned as the tool's text result. | |
| template | Yes | LiquidJS template producing an HTML fragment, rendered against {{ context.* }}. Max 32768 characters. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well past the readOnlyHint/openWorldHint annotations: HTML-escaping of {{ context.* }}, JS-style truthiness, permitted external origins (only cdn.jsdelivr.net), Tailwind/DaisyUI loading, data: URI fallback with differing size budgets, and the fact that the rendered HTML is never returned. The openWorldHint=false annotation is consistent with the allowlist disclosure, not contradicted.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose, then constraints, then the return behavior — a sensible ordering with no filler. It is dense and the image guidance spans two overlapping sentences, but nearly every clause carries operational information an agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description covers the return contract explicitly ('the result only says whether it could be shown') plus all rendering constraints, escaping rules, and size limits. Nothing an agent needs to invoke this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3; the description still adds real meaning by explaining how template and context interact ({{ context.* }} interpolation, escaping rules), why images should go in context rather than the template (64 KB vs 32 KB), and that summary becomes the tool's text result.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (show information as rendered HTML) and the mechanism (LiquidJS template + JSON context), and explicitly distinguishes itself from the decision-collecting siblings elicit_confirm/elicit_form. An agent can identify this tool without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use (tables, reports, summaries the user should scan) and when-not (it does not collect a decision), naming the alternatives that do. The host-support caveat ('hosts that support MCP Apps render it inline') further bounds applicability.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
elicit_doctorDiagnose the host's elicitation supportARead-only
Check whether the connected MCP host actually supports elicitation (and sampling/roots) before relying on it — advertising a capability is not the same as it working. Use it to decide whether to call elicit_form/elicit_confirm, to explain why a prompt did or didn't appear, or to contribute a host capability fingerprint. Returns a passive report derived from the initialize handshake; set probeElicitation: true to also run one live form round-trip (the user may see a dialog) and classify what really happened. Read-only; safe to call anytime.
| Name | Required | Description | Default |
|---|---|---|---|
| probeElicitation | No | Also fire one live form-elicitation round-trip (the user may see a dialog) and report the outcome under probes.elicitationForm. Default false: passive capability report only, no prompt. |
Output Schema
| Name | Required | Description |
|---|---|---|
| probes | No | Present only when probeElicitation was true: the live round-trip's attempted/action/latencyMs/verdict. |
| support | Yes | Elicitly's derived support booleans, inferred from the advertised capabilities. |
| initialize | Yes | The MCP initialize handshake echoed verbatim: { request: { clientInfo, capabilities }, response: { protocolVersion, capabilities, serverInfo } }. |
| deprecations | Yes | Spec-level deprecation advisories (MCP 2026-07-28, SEP-2577) for the client features the report surfaces. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes beyond the readOnlyHint/openWorldHint annotations by disclosing that the default is a passive report derived from the initialize handshake, and that probeElicitation:true fires a live round-trip the user may see a dialog for. That side-effect disclosure is the key behavioral fact an agent needs. Doesn't cover cost/latency or persistence of the contributed fingerprint, so not a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded in the first clause and every sentence carries information (motivation, usage routing, return behavior, opt-in probe, safety). It is dense and slightly overstuffed for a one-parameter tool, but nothing is truly redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description needn't enumerate return fields, yet it still names probes.elicitationForm and distinguishes passive vs. probed output. Read-only safety, default behavior, and routing to siblings are all covered — nothing an agent needs to call this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Coverage is 100% and the schema description already explains probeElicitation, its default, and where the result lands (probes.elicitationForm). The description largely restates this, adding only the user-visible-dialog consequence, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource: 'Check whether the connected MCP host actually supports elicitation (and sampling/roots)'. It explicitly frames itself as the diagnostic step preceding elicit_form/elicit_confirm, so an agent can separate it from the sibling action tools without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives three concrete when-to-use cases ('decide whether to call elicit_form/elicit_confirm', 'explain why a prompt did or didn't appear', 'contribute a host capability fingerprint'), which is essentially a routing statement to the siblings. The 'advertising a capability is not the same as it working' note explains the failure mode that motivates the call.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
elicit_formAsk the user to fill a formA
Trigger a form elicitation with a caller-supplied JSON schema; returns the raw {action, content}. For a plain OK/Cancel question, prefer elicit_confirm. MUST NOT be used to request secrets, credentials, or other sensitive information.
| Name | Required | Description | Default |
|---|---|---|---|
| message | Yes | The instruction shown to the user above the form fields. | |
| timeoutSeconds | No | How long to wait for the answer, in seconds (default 300, clamped 60-3600) — raise it for forms with several fields. | |
| requestedSchema | Yes | JSON Schema for the form, restricted to the MCP elicitation requestedSchema subset: a flat object whose properties are strings, numbers/integers, booleans, or enums — no nested objects, arrays of objects, $ref, or allOf. See https://modelcontextprotocol.io/specification/2025-11-25/client/elicitation#requested-schema |
Output Schema
| Name | Required | Description |
|---|---|---|
| action | Yes | accept = the user submitted the form; decline = an explicit no; cancel = dismissed unanswered (including timeout); error = the elicitation failed. |
| content | Yes | On accept, the submitted values keyed by requestedSchema property name; null for every other action. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish this is non-destructive and not open-world, but the description goes further by disclosing the raw {action, content} return shape and a meaningful policy constraint against collecting secrets or credentials. Since an output schema exists, the return-shape sentence adds less than it otherwise would, leaving this just short of 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences that front-load the core action, followed by the alternative and the misuse guard. No filler and every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With annotations covering the safety profile, an output schema covering return values, and full parameter documentation in the schema, the description supplies the remaining routing and misuse-prevention context. An agent has everything needed to call it correctly and to know when not to.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents message, timeoutSeconds (including default and clamp range), and the requestedSchema subset restriction in detail. The description adds the phrase 'caller-supplied JSON schema' but no syntax or semantics beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Trigger a form elicitation with a caller-supplied JSON schema') and explicitly names the return shape. It also differentiates itself from the sibling elicit_confirm by routing plain OK/Cancel questions there.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives both an alternative ('For a plain OK/Cancel question, prefer elicit_confirm') and a hard exclusion ('MUST NOT be used to request secrets, credentials, or other sensitive information'). The when-to-use and when-not-to-use conditions are explicit rather than implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v0.1.2- Changed
elicit_confirm1 field changed- changed
Output schema / additionalPropertiesPrevious value: -falseNew value: +{}
- Added
elicit_display - Changed
elicit_doctor3 fields changed- changed
Output schema / additionalPropertiesPrevious value: -falseNew value: +{} - changed
Output schema / properties / probes / additionalPropertiesPrevious value: -falseNew value: +{} - changed
Output schema / properties / support / additionalPropertiesPrevious value: -falseNew value: +{}
- Changed
elicit_form1 field changed- changed
Output schema / additionalPropertiesPrevious value: -falseNew value: +{}
3 tool updates
v0.1.0- First observed
elicit_confirm - First observed
elicit_doctor - First observed
elicit_form
TDQS
Scored across 4 tools
elicit_confirm and elicit_form both perform user elicitation and could be confused, but the descriptions clearly distinguish the yes/no convenience wrapper from the arbitrary-schema form. elicit_doctor and elicit_display have distinct, non-overlapping purposes (diagnostics vs. rendering), making the set mostly unambiguous.
All tools follow the same pattern: elicit_ prefix followed by a descriptive noun (confirm, doctor, form, display). Consistent snake_case throughout with no deviations.
Four tools is well-scoped for a focused elicitation/display utility server. Each tool has a clear, non-redundant role: yes/no confirmation, arbitrary form elicitation, HTML display, and capability diagnostics.
The surface covers the full elicitation lifecycle: simple confirmations, schema-driven forms, rich display, and a diagnostic tool to verify host support. No obvious gaps or dead ends for the stated domain.
Maintenance
Related MCP Connectors
MCP server for building and testing AI agents with multi-model experimentation and insights.
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
Related MCP Servers
- AlicenseCqualityDmaintenanceA demonstration server that showcases how to collect user input dynamically using the Model Context Protocol (MCP) elicitation system across tools, resources, and prompts.10303,711 npmMIT
- AlicenseAqualityDmaintenanceAn MCP server implementing AI-user confirmation protocols, providing tools for LLMs to seek user confirmation when uncertain through yes/no questions, action confirmations, intent clarification, understanding verification, and satisfaction ratings.85 npmMIT
- AlicenseAqualityAmaintenanceAn MCP server that enables AI agents to pause and request human approval or information via Slack, Telegram, or macOS dialogs before proceeding with actions.215Apache 2.0
- AlicenseBqualityDmaintenanceAn MCP server that provides elicitation tools to interactively request user input, such as selecting options, providing information, or performing manual tests.31MIT