PRODUCTION SCENARIO
An MCP server for a payments dashboard needs a user's payment-provider API key before it can issue refunds. The developer plans to collect it with a form-mode elicitation/create call so the client renders a text field.
How must the server collect the key under the MCP specification?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: Use URL mode elicitation so the key is entered on a page the server itself hosts
The spec forbids form mode for secrets such as passwords, API keys, access tokens and payment credentials and requires URL mode, so the value is typed on a page the server controls and never reaches the MCP client or the model's context. The same section forbids putting sensitive data in the elicitation URL or handing over a pre-authenticated URL. Form mode supports only the email, uri, date and date-time formats, so there is no password format to set. And a tool argument transits the client, which is the exposure being avoided.