vinkius-labs/mcp-fusion

MCP Fusion 4.4.0 — Return-Based Elicitation for the MCP 2026-07-28 Stateless Protocol

The MCP 2026-07-28 protocol revision makes the transport stateless and removes the server→client request channel that the imperative await ask(...) relies on. This release introduces the 2026-native replacement for ask() while keeping ask() fully functional during its deprecation window. No breaking changes.

Added — @mcpfusion/core

• requireInput({ inputRequests, requestState? }) — Return-based elicitation. A handler returns the input it needs instead of blocking mid-execution with await; the framework fulfills the request and re-enters the handler with the answers. Works on both protocol eras — the framework drives the round-trip on 2025-era connections, the client/SDK drives it on 2026-era connections. Same discriminated-response interception pattern as handoff().
• requireInput.elicit(message, fields) — Form-input request built from the existing ask.* field descriptors (unchanged DSL).
• requireInput.url(message, url) — URL-redirect request for OAuth / sensitive-data flows.
• readInput<T>(key) — Reads the accepted content on re-entry, or undefined when missing / declined / cancelled.
• inputResponse(key) — Discriminated view for decline/cancel detection.
• readRequestState<T>() — Reads the opaque continuation token for multi-round wizard state.
• isInputRequiredResponse(value) — Type guard for the branded response.
• Elicitation runtime driver — Bridges the return-based model onto the transport at runtime: fulfills each input over the live channel and re-enters (bounded, default 8 rounds → ELICITATION_ROUNDS_EXCEEDED); returns a clean ELICITATION_UNSUPPORTED error on stateless connections with no channel instead of hanging.
• Zero added overhead — non-interactive tools and existing ask() handlers take the exact same execution path as before.

Deprecated

• ask() and ask.redirect() — Deprecated as of MCP 2026-07-28. Prefer requireInput() + readInput(), which is stateless and serves both eras. ask() keeps working unchanged on 2025-era and streaming (stdio / sessionful HTTP) connections throughout the deprecation window — existing code does not break. The ask.* field factories are not deprecated (reused by requireInput.elicit()).

Fixed

• Premature cache invalidation on interactive mutations — State Sync decoration is now skipped for non-terminal input-required responses; invalidation fires on the terminal response after the elicitation round-trip resolves.

Changed

• All @mcpfusion/* cross-dependencies updated to ^4.4.0.

Documentation

• docs/elicitation.md — deprecation notice for ask() + a new "Return-Based Elicitation (2026-native)" section.

Full details in CHANGELOG.md.