✨ feat: Support MCP Elicitation (URL + Form) for Deferred Auth in Tool Calls

api/server/controllers/agents/client.js

@@ -73,6 +73,7 @@ const {
   isAgentsEndpoint,
   isEphemeralAgentId,
   removeNullishValues,
+  stripUiOnlyContentParts,
   DEFAULT_MEMORY_MAX_INPUT_TOKENS,
 } = require('librechat-data-provider');
 const { filterFilesByAgentAccess } = require('~/server/services/Files/permissions');
@@ -1231,6 +1232,16 @@ class AgentClient extends BaseClient {
                 : {}),
             }
           : undefined;
+      /**
+       * Strip UI-only content parts (elicitation cards) from the LLM payload
+       * before `formatAgentMessages` runs. Such parts are rendered and persisted
+       * for chat replay but carry no meaning for the model, so a persisted card
+       * must never leak into a completion request. Scoped to the payload (and the
+       * memory copy) — the persisted message and UI copy keep the card.
+       */
+      payload = stripUiOnlyContentParts(payload);
+      this.memoryPayload = stripUiOnlyContentParts(this.memoryPayload);
+
       let {
         messages: initialMessages,
         indexTokenCountMap,

api/server/controllers/agents/openai.js

@@ -7,6 +7,7 @@ const {
   PermissionBits,
   hasPermissions,
   AgentCapabilities,
+  stripUiOnlyContentParts,
 } = require('librechat-data-provider');
 const {
   writeSSE,
@@ -515,7 +516,8 @@ const OpenAIChatCompletionController = async (req, res) => {
     const openaiMessages = convertMessages(request.messages);
 
     const toolSet = buildToolSet(primaryConfig);
-    const formatted = formatAgentMessages(openaiMessages, {}, toolSet);
+    // Elicitation cards are UI-only; strip them so a persisted card never leaks to the model.
+    const formatted = formatAgentMessages(stripUiOnlyContentParts(openaiMessages), {}, toolSet);
     const formattedMessages = formatted.messages;
     const initialSummary = formatted.summary;
     let indexTokenCountMap = formatted.indexTokenCountMap;

api/server/controllers/agents/responses.js

@@ -8,6 +8,7 @@ const {
   PermissionBits,
   hasPermissions,
   AgentCapabilities,
+  stripUiOnlyContentParts,
 } = require('librechat-data-provider');
 const {
   createRun,
@@ -621,7 +622,8 @@ const createResponse = async (req, res) => {
     const allMessages = [...previousMessages, ...inputMessages];
 
     const toolSet = buildToolSet(primaryConfig);
-    const formatted = formatAgentMessages(allMessages, {}, toolSet);
+    // Elicitation cards are UI-only; strip them so a persisted card never leaks to the model.
+    const formatted = formatAgentMessages(stripUiOnlyContentParts(allMessages), {}, toolSet);
     const formattedMessages = formatted.messages;
     const initialSummary = formatted.summary;
     let indexTokenCountMap = formatted.indexTokenCountMap;