SEP-1036 introduces a URL Mode Elicitation mechanism to the Model Context Protocol — a new primitive that lets a server signal to a client that a specific interaction (authentication, confirmation, sensitive data entry) should happen outside the current agent session, via a user-controlled URL. Rather than embedding credential prompts or approval flows directly in the conversation, the server returns a structured elicitation object pointing to an external endpoint the human must visit. This keeps sensitive exchanges out of the model's context entirely.
From a UX design perspective, this is a meaningful architectural move. It formalizes a pattern that product teams have been hacking around — the need to pause an agent, hand off to a human for something the agent must not handle, and then resume. The spec treats this as a first-class protocol concern rather than an application-layer workaround, which means clients and host applications can build consistent, predictable UI around it rather than each implementing their own ad-hoc interrupt.
The security rationale is explicit: by routing sensitive interactions to a URL the user visits directly, the proposal reduces the risk of prompt injection or model-mediated credential theft. For designers, this creates a clear seam — the agent pauses, signals why, surfaces a link or deep-link, and waits. That seam is a design surface: how do you communicate to a user that their agent is blocked, what it's waiting for, and how to unblock it without losing task context?