Explicit Scope and Stateless Elicitation
Roots are deprecated in MCP 2026-07-28 and were never a security sandbox. Put scope in visible tool arguments or resource URIs, authorize it on the server, and use MRTR when a tool genuinely needs user input. The user sees the decision, the model sees the handle, and any server instance can process the retry. Replace deprecated Roots with explicit workspace parameters, resource URIs, or server configuration. Separate scope hints from authorization, path containment, and operating-system sandboxing. Deliver form-mode elicitation/create through an MRTR inputrequired result. Advertise elicitation support in per-request client capabilities and reject unsupported modes. Validate accept, decline, and cancel as distinct outcomes. Bind destructive confirmation to an authenticated principal, original arguments, candidate set, and expiry. A notes tool receives this request: "Delete the old TPS report." The server must answer two different questions. Which workspace may this operation touch? Which of three matching notes did the user mean? The first is scope and authorization. The second is interactive disambiguation. Mixing them leads to dangerous designs, such as treating a client-provided folder as proof that the caller may delete everything inside it. Earlier MCP revisions let a client advertise Roots and notify a server when the list changed. Roots were informational guidance. They did not constrain what the server process could read, did not authorize the caller, and did not…
Explicit Scope and Stateless Elicitation: Roots are deprecated in MCP 2026-07-28 and were never a security sandbox. Put scope in visible tool arguments or…
This free lesson is part of the AI Engineering from Scratch curriculum. Read the full explanation, run the lesson code, and verify the result in the interactive reader or from the repository source.
Browse the complete course catalog or open this lesson on GitHub.