[BUG] Claude Code v2.1.237 does not advertise URL-mode elicitation on MCP 2026-07-28 (InputRequiredResult cannot be fulfilled)

Claude Code v2.1.237 does not advertise URL-mode elicitation on MCP 2026-07-28

On the 2026-07-28 handshake, Claude Code v2.1.237 advertises an empty elicitation capability:

"capabilities": { "roots": { "listChanged": true }, "elicitation": {} }

Per the 2026-07-28 spec, an empty elicitation: {} means "form mode only." So URL-mode elicitation is never usable: when a server drives the MRTR flow — returning an InputRequiredResult whose input_requests carries an elicitation/create with mode:"url" — no URL is ever surfaced to the user. This blocks OAuth / third-party auth / payment / credential flows.

How this was verified (two independent ways)

1. Remote server + wire-logging proxy. Placed a logging proxy between Claude Code and a remote Streamable-HTTP MCP server and captured the server/discover handshake on protocol 2026-07-28. The client-capabilities envelope it sent contained elicitation: {} — no url.
2. Local minimal server. A thin mcp>=2 stdio server whose one tool returns an InputRequiredResult carrying a mode:"url" elicitation/create (below). When the tool is called, the client cannot fulfill the URL elicitation and the call fails — no URL is surfaced.

Minimal repro server (official Python SDK v2 / 2026-07-28)

pip install "mcp>=2"

url-elicit-repro.py:

#!/usr/bin/env python3
"""Minimal MCP server (SDK v2 / protocol 2026-07-28): one tool that requires a
URL-mode elicitation, via the MRTR InputRequiredResult flow."""
from mcp.server.mcpserver import MCPServer
from mcp.types import ElicitRequest, ElicitRequestURLParams, InputRequiredResult

server = MCPServer("url-elicit-repro")


@server.tool()
def try_url_elicitation() -> InputRequiredResult:
    """Requires a URL-mode elicitation (authorization link) before proceeding."""
    return InputRequiredResult(
        input_requests={
            "authorize": ElicitRequest(
                params=ElicitRequestURLParams(
                    message="Open this URL to authorize (URL-mode elicitation reproduction).",
                    url="https://example.com/authorize?repro=1",
                )
            )
        },
        request_state="url-elicit-repro-1",
    )


if __name__ == "__main__":
    server.run()  # stdio

Steps

1. claude mcp add url-elicit-repro -- python /absolute/path/to/url-elicit-repro.py
2. Start Claude Code, then prompt: Call the try_url_elicitation tool from the url-elicit-repro server.

Expected vs actual

• Expected: Claude Code surfaces the URL from the elicitation/create and asks for consent to open it.
• Actual: the tool call fails and no URL is surfaced, because the client advertised elicitation: {} (no url). (An SDK v2 client with no URL support returns -32600 "Elicitation not supported" against this same server.)

Notably the CLI ships URL-elicitation UI (elicitation_url_dialog) and handlers, so the client can render URL mode — it just never advertises elicitation.url, so spec-compliant servers never send it.

Environment: Claude Code v2.1.237 (released 2026-08-20), negotiated MCP protocol 2026-07-28.

Fix: advertise elicitation: { "form": {}, "url": {} } and surface the URL for user consent.