URL-mode elicitation for third-party MCP servers (decouple from the under-development `auth_elicitation` flag)

What variant of Codex are you using?

Codex CLI (latest). The relevant gating lives in codex-rs/core, so it affects every surface that builds the MCP client capability.

What feature would you like to see?

Codex already has MCP url-mode elicitation built — rmcp 1.7.0's ElicitationCapability carries form + url, and Codex constructs ElicitationCapability { form: Some(…), url: Some(…) } in core/src/config/mod.rs and core/src/session/session.rs. But it's gated behind Feature::AuthElicitation, which features/src/tests.rs::auth_elicitation_is_under_development pins to Stage::UnderDevelopment + default_enabled() == false. So a default build advertises elicitation: {} to MCP servers — which the 2025-11-25 spec defines as form-mode only — and mcp_tool_call.rs early-returns from the elicitation path unless the flag is on.

auth_elicitation is documented as "Prompt Codex Apps connector auth failures through MCP URL elicitations" — i.e. scoped to Codex's own Apps-connector auth UX (there's a dedicated auth_elicitation.rs with CodexAppsConnectorAuthFailure). But that same flag also gates the client elicitation.url capability Codex advertises to every MCP server.

The ask: either (a) stabilize auth_elicitation to default-on, or — cleaner — (b) decouple the advertised elicitation: { url: {} } capability + generic url-elicitation handling from the Apps-connector-specific flag, so a third-party MCP server can drive url-mode elicitation + URLElicitationRequiredError (-32042) independent of the Codex Apps connector UX.

Why it matters: url-mode + -32042 is the spec-native way to do human-in-the-loop confirmation of high-risk tool calls and out-of-band OAuth/3LO, without secrets passing through the client or model context. We run an MCP gateway and need it to deliver "require confirmation before a sensitive tool runs" as one blocking, resumable step. Form mode can't carry that securely (the spec forbids it for sensitive data).

Reference: VS Code's Copilot MCP client ships generic url-mode end-to-end (advertises { form, url }, opens the URL via its opener service, handles the -32042 retry) — a working blueprint.

Additional information

Acceptance:

• A default build advertises elicitation: { form: {}, url: {} }.
• A third-party server's elicitation/create with mode: "url" shows the user the URL, gets consent, opens out-of-band, and returns accept/decline/cancel.
• URLElicitationRequiredError (-32042) from a third-party server is handled (run the elicitation, then retry the tool call).

Related: #13405 (form-mode tool approval — the complementary mode), #23725 (auth_elicitation desktop feature-mismatch skew), openai/codex-plugin-cc#258 (plugin rejects server-initiated elicitation).