LumabyteCo/clarifyprompt-mcp

What's new in 1.9.0

Step #4 of the MCP modernization roadmap: clarify_with_user can collect answers through the host's native form UI via MCP elicitation. Opt-in, fully back-compat.

Interactive clarification

Pass elicit: true. On a client that supports MCP elicitation, the clarifying questions become a real form:

• each question is a field; options become enum dropdowns; each suggestedAnswer is the field default (one-click accept);
• the user answers inline; the engine returns answers: [{ question, dimension, answer, usedSuggested }] with elicited: true.

Without elicit, on a non-capable client, or if the round-trip errors, the tool returns the same raw-questions JSON it always has — every existing caller is unaffected. decline / cancel surface via elicitationAction.

This turns clarification from "here's a JSON blob of questions, you render it" into a first-class interactive moment in hosts like Claude Desktop. The mapping lives in a pure module (src/engine/clarification/elicit.ts), reusable by compose_prompt's pre-clarify stage later.

Security (folded in)

Two advisories published since 1.8.0 against unchanged dependencies, fixed here:

• js-yaml → 4.2.0 — quadratic-complexity DoS via repeated merge-key aliases (GHSA-h67p-54hq-rp68). Direct runtime dependency (parses platform packs); floor bumped to ^4.2.0. Verified all 60+ platform YAML packs still load.
• hono → 4.12.25 — transitive under the SDK's HTTP substack, which stdio-only ClarifyPrompt never loads (no runtime exposure); cleared so audit is green.

npm audit --omit=dev → 0 vulnerabilities.

Tests

New deterministic npm run test:elicit (tests/elicitation.mjs): pure-helper coverage (schema build, enum-vs-free-text, default-only-when-valid, blank→suggested fallback) plus a real server→client elicitation round-trip driven by a mock elicitation-capable client. Added to test:all.

Verified

test:elicit (pure + live loop) · clarify-* eval fixtures on gemma4:31b-cloud (non-elicit path intact) · wire · test:resources (YAML loads under js-yaml 4.2.0) · 0 prod vulnerabilities · all CI build/docker/secrets jobs · evals on gpt-4o-mini.

Install

```bash
npm install -g [email protected]
```