Issue #261 opened: Elicitation: interactive confirmation for destructive operations (capability-gated)

Why

The server can pause and ask the human before executing destructive operations — stop_all_apps, application delete, database delete (with volumes!), bulk_env_update across N apps. Elicitation is spec-stable since 2025-06-18 and works on SDK 1.x.

Today stop_all_apps uses a confirm boolean param, which the model fills in — that's the model confirming with itself. Elicitation puts the confirmation in front of the human, in client UI.

Client support (the constraint)

• Claude Code: supported since v2.1.76 (2026-03-14), incl. Elicitation hooks
• VS Code Copilot: supported
• Claude Desktop / claude.ai: lagging (open issue anthropics/claude-ai-mcp#153)
• Cursor: unclear

So: strictly progressive enhancement. Gate on the client's elicitation capability at runtime; when absent, fall back to the current confirm-param behavior unchanged.

What

1. Helper: confirmDestructive(server, message): Promise<boolean> — checks client capability, elicits if available, otherwise returns true (defer to existing param-based guards).
2. Wire into: stop_all_apps, all delete actions (application/database/service/project/environment — especially delete_volumes: true), redeploy_project, bulk_env_update when touching >3 apps.
3. Message should carry blast radius: "Stop ALL 12 running applications on 3 servers?" — we have the counts from the pre-flight lists.
4. Tests: mock client capabilities both ways.

Note for V3

SDK v2 redesigns this as inputRequired.elicit() / InputRequiredResult (#259) — keep the helper thin so only its internals change.

Refs: #259. Claude Code support: https://claudelab.net/en/articles/claude-code/mcp-elicitation-support

🤖 Generated with Claude Code