Understanding MCP clients
MCP clients are instantiated by host applications to communicate with particular MCP servers. The host manages UX and coordinates multiple clients; each client handles one connection to one server.
Adapted from Understanding MCP clients.
Example client experience connecting to MCP servers. Source: modelcontextprotocol/docs (client-claude-cli-python.png).
Core client features
| Feature | Explanation | Example |
|---|---|---|
| Elicitation | Server requests structured (or out-of-band) input from the user | Confirm booking, seat preference |
| Roots | Client advertises filesystem directories of interest | Travel workspace folder — deprecated |
| Sampling | Server requests an LLM completion through the client | Pick best flight — deprecated |
Elicitation
Elicitation lets servers pause and gather missing information instead of failing.
| Mode | Behaviour |
|---|---|
| Form mode | Client builds a form from a schema; data returns through the protocol |
| URL mode | User opens a URL out of band (credentials, OAuth) — sensitive data never passes through the client/LLM |
Elicitation uses the Multi Round-Trip Requests (MRTR) pattern: the server returns InputRequiredResult with elicitation/create in inputRequests; the client collects input and retries the original request with inputResponses.
{
method: "elicitation/create",
params: {
mode: "form",
message: "Please confirm your Barcelona vacation booking details:",
requestedSchema: {
type: "object",
properties: {
confirmBooking: {
type: "boolean",
description: "Confirm the booking (Flights + Hotel = $3,000)"
},
seatPreference: {
type: "string",
enum: ["window", "aisle", "no preference"]
}
},
required: ["confirmBooking"]
}
}
}
Privacy rule: do not use form mode for passwords, API keys, tokens or payment credentials — use URL mode.
Clients should show which server is asking, why, and allow decline/cancel. Validate against the schema before returning.
Roots (deprecated)
Roots are deprecated as of 2026-07-28 and scheduled for removal. New implementations should pass directories or files via tool parameters, resource URIs, or server configuration.
Historically, roots were file:// URIs advertising workspace boundaries. They were a coordination mechanism, not a security boundary — OS permissions and sandboxing enforce real security.
Sampling (deprecated)
Sampling is deprecated as of 2026-07-28. New implementations should call LLM provider APIs directly from the server (or host orchestration) instead of sampling/createMessage.
Historically, sampling let servers request completions through the client with human-in-the-loop approval of both the prompt and the response. Prefer direct provider integration going forward.
Negative cases
- Form elicitation for secrets → treat as a security defect.
- Auto-opening URL elicitation without consent → forbidden; show URL and require explicit open.
- Relying on roots for isolation → incorrect; sandbox the process.
- Building new products on sampling → plan migration now; feature is deprecated.
Hosts should make MCP capabilities visible and controllable. Source: modelcontextprotocol/docs.
Discussion
Comments
Share feedback or questions about this page. No account required.
Loading comments…