Skip to content

v1.9.0 — interactive clarification via elicitation (roadmap #4)

Choose a tag to compare

View all tags
@a-radwan-20 a-radwan-20 released this 17 Jun 15:49
v1.9.0
a31d7a1

What's new in 1.9.0

Step #4 of the MCP modernization roadmap: clarify_with_user can collect answers through the host's native form UI via MCP elicitation. Opt-in, fully back-compat.

Interactive clarification

Pass elicit: true. On a client that supports MCP elicitation, the clarifying questions become a real form:

  • each question is a field; options become enum dropdowns; each suggestedAnswer is the field default (one-click accept);
  • the user answers inline; the engine returns answers: [{ question, dimension, answer, usedSuggested }] with elicited: true.

Without elicit, on a non-capable client, or if the round-trip errors, the tool returns the same raw-questions JSON it always has — every existing caller is unaffected. decline / cancel surface via elicitationAction.

This turns clarification from "here's a JSON blob of questions, you render it" into a first-class interactive moment in hosts like Claude Desktop. The mapping lives in a pure module (src/engine/clarification/elicit.ts), reusable by compose_prompt's pre-clarify stage later.

Security (folded in)

Two advisories published since 1.8.0 against unchanged dependencies, fixed here:

  • js-yaml → 4.2.0 — quadratic-complexity DoS via repeated merge-key aliases (GHSA-h67p-54hq-rp68). Direct runtime dependency (parses platform packs); floor bumped to ^4.2.0. Verified all 60+ platform YAML packs still load.
  • hono → 4.12.25 — transitive under the SDK's HTTP substack, which stdio-only ClarifyPrompt never loads (no runtime exposure); cleared so audit is green.

npm audit --omit=dev → 0 vulnerabilities.

Tests

New deterministic npm run test:elicit (tests/elicitation.mjs): pure-helper coverage (schema build, enum-vs-free-text, default-only-when-valid, blank→suggested fallback) plus a real server→client elicitation round-trip driven by a mock elicitation-capable client. Added to test:all.

Verified

test:elicit (pure + live loop) · clarify-* eval fixtures on gemma4:31b-cloud (non-elicit path intact) · wire · test:resources (YAML loads under js-yaml 4.2.0) · 0 prod vulnerabilities · all CI build/docker/secrets jobs · evals on gpt-4o-mini.

Install

```bash
npm install -g clarifyprompt-mcp@1.9.0
```

Assets 2
Loading