diff --git a/docs/community/seps/1865-mcp-apps-interactive-user-interfaces-for-mcp.mdx b/docs/community/seps/1865-mcp-apps-interactive-user-interfaces-for-mcp.mdx new file mode 100644 index 000000000..707a5790a --- /dev/null +++ b/docs/community/seps/1865-mcp-apps-interactive-user-interfaces-for-mcp.mdx @@ -0,0 +1,162 @@ +--- +title: "SEP-1865: MCP Apps - Interactive User Interfaces for MCP" +sidebarTitle: "SEP-1865: MCP Apps - Interactive User Interfaces…" +description: "MCP Apps - Interactive User Interfaces for MCP" +--- + +import { Badge } from "/snippets/badge.mdx"; + +
+ Final + Extensions Track +
+ +| Field | Value | +| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| **SEP** | 1865 | +| **Title** | MCP Apps - Interactive User Interfaces for MCP | +| **Status** | Final | +| **Type** | Extensions Track | +| **Created** | 2025-11-21 | +| **Author(s)** | Ido Salomon ([@idosal](https://github.com/idosal)), Liad Yosef ([@liadyosef](https://github.com/liadyosef)), Olivier Chafik ([@olivierchafik](https://github.com/olivierchafik)), | +| **Sponsor** | None (seeking sponsor) | +| **PR** | [#1865](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/1865) | + +--- + +## Abstract + +This SEP proposes an extension to MCP (per SEP-1724) that enables servers to deliver interactive +user interfaces to hosts. MCP Apps introduces a standardized pattern for declaring UI resources via +the `ui://` URI scheme, associating them with tools through metadata, and facilitating +bi-directional communication between the UI and the host using MCP's JSON-RPC base protocol. This +extension addresses the growing community need for rich, interactive experiences in MCP-enabled +applications, maintaining security, auditability, and alignment with MCP's core architecture. The +initial specification focuses on HTML resources (`text/html;profile=mcp-app`) with a clear path for +future extensions. + +## Motivation + +MCP lacks a standardized way for servers to deliver rich, interactive user interfaces to hosts. +This gap blocks many use cases that require visual presentation and interactivity that go beyond +plain text or structured data. As more hosts adopt this capability, the risk of fragmentation and +interoperability challenges grows. + +[MCP-UI](https://mcpui.dev/) has demonstrated the viability and value of MCP apps built on UI +resources and serves as a community playground for the UI spec and SDK. Fueled by a dedicated +community, it developed the bi-directional communication model and the HTML, external URL, and +remote DOM content types. MCP-UI's adopters, including hosts and providers such as Postman, +HuggingFace, Shopify, Goose, and ElevenLabs, have provided critical insights and contributions to +the community. + +OpenAI's [Apps SDK](https://developers.openai.com/apps-sdk/), launched in November 2025, further +validated the demand for rich UI experiences within conversational AI interfaces. The Apps SDK +enables developers to build rich, interactive applications inside ChatGPT using MCP as its +backbone. + +The architecture of both the Apps SDK and MCP-UI has significantly informed the design of this +specification. + +However, without formal standardization: + +- Servers cannot reliably expect UI support via MCP +- Each host may implement slightly different behaviors +- Security and auditability patterns are inconsistent +- Developers must maintain separate implementations or adapters for different hosts (e.g., MCP-UI + vs. Apps SDK) + +This SEP addresses the current limitations through an optional, backwards-compatible extension that +unifies the approaches pioneered by MCP-UI and the Apps SDK into a single, open standard. + +## Specification + +The full specification can be found at +[modelcontextprotocol/ext-apps](https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/draft/apps.mdx). + +At a high level, MCP Apps extends the Model Context Protocol to enable servers to deliver +interactive user interfaces to hosts. This extension introduces: + +- **UI Resources:** Predeclared resources using the `ui://` URI scheme +- **Resource Discovery:** Tools reference UI resources via metadata +- **Bi-directional Communication:** UI iframes communicate with hosts using standard MCP JSON-RPC + protocol +- **Security Model:** Mandatory iframe sandboxing with auditable communication + +This specification focuses on HTML content (`text/html;profile=mcp-app`) as the initial content +type, with extensibility for future formats. + +As an extension, MCP Apps is optional and must be explicitly negotiated between clients and servers +through the extension capabilities mechanism (see Capability Negotiation section in the +[full specification](https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/draft/apps.mdx)). + +## Rationale + +### Predeclared resources vs. inline embedding + +UI is modeled as predeclared resources (`ui://`), referenced by tools via metadata. This allows: + +- Hosts to prefetch templates before tool execution, improving performance +- Separation of presentation (template) from data (tool results), facilitating caching +- Security review of UI resources + +**Alternatives considered:** + +- **Embedded resources:** Current MCP-UI approach, where resources are returned in tool results. + Although it's more convenient for server development, it was deferred due to the gaps in + performance optimization and the challenges in the UI review process. +- **Resource links:** Predeclare the resources but return links in tool results. Deferred due to + the gaps in performance optimization. + +### Reusing MCP JSON-RPC instead of a custom protocol + +Reuses existing MCP infrastructure (type definitions, SDKs, etc.). JSON-RPC offers advanced +capabilities (timeouts, errors, etc.). + +**Alternatives considered:** + +- **Custom message protocol:** Current MCP-UI approach with message types like tool, intent, + prompt, etc. These message types can be translated to a subset of the proposed JSON-RPC messages. +- **Global API object:** Rejected because it requires host-specific injection and doesn't work with + external iframe sources. Syntactic sugar may still be added on the server/UI side. + +### HTML-only MVP + +- HTML is universally supported and well-understood +- Simplest security model (standard iframe sandbox) +- Allows screenshot/preview generation (e.g., via html2canvas) +- Sufficient for most observed use cases +- Provides a clear baseline for future extensions + +**Alternatives considered:** + +- **Include external URLs in MVP:** This is one of the easiest content types for servers to adopt, + as it's possible to embed regular apps. However, it was deferred due to concerns around model + visibility, inability to screenshot content, and review process. It may effectively be supported + with the SEP's new `externalIframes` capability. + +## Backward Compatibility + +The proposal is an optional extension to the core protocol. Existing implementations continue +working without changes. + +## Security Implications + +Hosting interactive UI content from potentially untrusted MCP servers requires careful security +consideration. + +Based on the threat model, MCP Apps proposes the following mitigations: + +- **Iframe sandboxing**: All UI content runs in sandboxed iframes with restricted permissions +- **Predeclared templates**: Hosts can review HTML content before rendering +- **Auditable messages**: All UI-to-host communication goes through loggable JSON-RPC +- **User consent**: Hosts can require explicit approval for UI-initiated tool calls + +A full threat model analysis and mitigations are available in the +[full specification](https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/draft/apps.mdx). + +## Reference Implementation + +- [MCP-UI](https://github.com/idosal/mcp-ui) client and server SDKs support the patterns proposed + in this spec. +- [ext-apps](https://github.com/modelcontextprotocol/ext-apps) repository contains a prototype + implementation by Olivier Chafik. diff --git a/docs/community/seps/index.mdx b/docs/community/seps/index.mdx index b225d4e40..c91d91e0a 100644 --- a/docs/community/seps/index.mdx +++ b/docs/community/seps/index.mdx @@ -14,35 +14,36 @@ Specification Enhancement Proposals (SEPs) are the primary mechanism for proposi ## Summary -- **Final**: 23 +- **Final**: 24 ## All SEPs -| SEP | Title | Status | Type | Created | -| ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | ---------------------------------- | --------------- | ---------- | -| [SEP-2133](/community/seps/2133-extensions) | Extensions | Final | Standards Track | 2025-01-21 | -| [SEP-2085](/community/seps/2085-governance-succession-and-amendment) | Governance Succession and Amendment Procedures | Final | Process | 2025-12-05 | -| [SEP-1850](/community/seps/1850-pr-based-sep-workflow) | PR-Based SEP Workflow | Final | Process | 2025-11-20 | -| [SEP-1730](/community/seps/1730-sdks-tiering-system) | SDKs Tiering System | Final | Standards Track | 2025-10-29 | -| [SEP-1699](/community/seps/1699-support-sse-polling-via-server-side-disconnect) | Support SSE polling via server-side disconnect | Final | Standards Track | 2025-10-22 | -| [SEP-1686](/community/seps/1686-tasks) | Tasks | Final | Standards Track | 2025-10-20 | -| [SEP-1613](/community/seps/1613-establish-json-schema-2020-12-as-default-dialect-f) | Establish JSON Schema 2020-12 as Default Dialect for MCP | Final | Standards Track | 2025-10-06 | -| [SEP-1577](/community/seps/1577--sampling-with-tools) | Sampling With Tools | Final | Standards Track | 2025-09-30 | -| [SEP-1330](/community/seps/1330-elicitation-enum-schema-improvements-and-standards) | Elicitation Enum Schema Improvements and Standards Compliance | Final | Standards Track | 2025-08-11 | -| [SEP-1319](/community/seps/1319-decouple-request-payload-from-rpc-methods-definiti) | Decouple Request Payload from RPC Methods Definition | Final | Standards Track | 2025-08-08 | -| [SEP-1303](/community/seps/1303-input-validation-errors-as-tool-execution-errors) | Input Validation Errors as Tool Execution Errors | Final | Standards Track | 2025-08-05 | -| [SEP-1302](/community/seps/1302-formalize-working-groups-and-interest-groups-in-mc) | Formalize Working Groups and Interest Groups in MCP Governance | Final | Standards Track | 2025-08-05 | -| [SEP-1046](/community/seps/1046-support-oauth-client-credentials-flow-in-authoriza) | Support OAuth client credentials flow in authorization | Final | Standards Track | 2025-07-23 | -| [SEP-1036](/community/seps/1036-url-mode-elicitation-for-secure-out-of-band-intera) | URL Mode Elicitation for secure out-of-band interactions | Final | Standards Track | 2025-07-22 | -| [SEP-1034](/community/seps/1034--support-default-values-for-all-primitive-types-in) | Support default values for all primitive types in elicitation schemas | Final | Standards Track | 2025-07-22 | -| [SEP-1024](/community/seps/1024-mcp-client-security-requirements-for-local-server-) | MCP Client Security Requirements for Local Server Installation | Final | Standards Track | 2025-07-22 | -| [SEP-994](/community/seps/994-shared-communication-practicesguidelines) | Shared Communication Practices/Guidelines | Final | Process | 2025-07-17 | -| [SEP-991](/community/seps/991-enable-url-based-client-registration-using-oauth-c) | Enable URL-based Client Registration using OAuth Client ID Metadata Documents | Final | Standards Track | 2025-07-07 | -| [SEP-990](/community/seps/990-enable-enterprise-idp-policy-controls-during-mcp-o) | Enable enterprise IdP policy controls during MCP OAuth flows | Final | Standards Track | 2025-06-04 | -| [SEP-986](/community/seps/986-specify-format-for-tool-names) | Specify Format for Tool Names | Final | Standards Track | 2025-07-16 | -| [SEP-985](/community/seps/985-align-oauth-20-protected-resource-metadata-with-rf) | Align OAuth 2.0 Protected Resource Metadata with RFC 9728 | Final | Standards Track | 2025-07-16 | -| [SEP-973](/community/seps/973-expose-additional-metadata-for-implementations-res) | Expose additional metadata for Implementations, Resources, Tools and Prompts | Final | Standards Track | 2025-07-15 | -| [SEP-932](/community/seps/932-model-context-protocol-governance) | Model Context Protocol Governance | Final | Process | 2025-07-08 | +| SEP | Title | Status | Type | Created | +| ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | ---------------------------------- | ---------------- | ---------- | +| [SEP-2133](/community/seps/2133-extensions) | Extensions | Final | Standards Track | 2025-01-21 | +| [SEP-2085](/community/seps/2085-governance-succession-and-amendment) | Governance Succession and Amendment Procedures | Final | Process | 2025-12-05 | +| [SEP-1865](/community/seps/1865-mcp-apps-interactive-user-interfaces-for-mcp) | MCP Apps - Interactive User Interfaces for MCP | Final | Extensions Track | 2025-11-21 | +| [SEP-1850](/community/seps/1850-pr-based-sep-workflow) | PR-Based SEP Workflow | Final | Process | 2025-11-20 | +| [SEP-1730](/community/seps/1730-sdks-tiering-system) | SDKs Tiering System | Final | Standards Track | 2025-10-29 | +| [SEP-1699](/community/seps/1699-support-sse-polling-via-server-side-disconnect) | Support SSE polling via server-side disconnect | Final | Standards Track | 2025-10-22 | +| [SEP-1686](/community/seps/1686-tasks) | Tasks | Final | Standards Track | 2025-10-20 | +| [SEP-1613](/community/seps/1613-establish-json-schema-2020-12-as-default-dialect-f) | Establish JSON Schema 2020-12 as Default Dialect for MCP | Final | Standards Track | 2025-10-06 | +| [SEP-1577](/community/seps/1577--sampling-with-tools) | Sampling With Tools | Final | Standards Track | 2025-09-30 | +| [SEP-1330](/community/seps/1330-elicitation-enum-schema-improvements-and-standards) | Elicitation Enum Schema Improvements and Standards Compliance | Final | Standards Track | 2025-08-11 | +| [SEP-1319](/community/seps/1319-decouple-request-payload-from-rpc-methods-definiti) | Decouple Request Payload from RPC Methods Definition | Final | Standards Track | 2025-08-08 | +| [SEP-1303](/community/seps/1303-input-validation-errors-as-tool-execution-errors) | Input Validation Errors as Tool Execution Errors | Final | Standards Track | 2025-08-05 | +| [SEP-1302](/community/seps/1302-formalize-working-groups-and-interest-groups-in-mc) | Formalize Working Groups and Interest Groups in MCP Governance | Final | Standards Track | 2025-08-05 | +| [SEP-1046](/community/seps/1046-support-oauth-client-credentials-flow-in-authoriza) | Support OAuth client credentials flow in authorization | Final | Standards Track | 2025-07-23 | +| [SEP-1036](/community/seps/1036-url-mode-elicitation-for-secure-out-of-band-intera) | URL Mode Elicitation for secure out-of-band interactions | Final | Standards Track | 2025-07-22 | +| [SEP-1034](/community/seps/1034--support-default-values-for-all-primitive-types-in) | Support default values for all primitive types in elicitation schemas | Final | Standards Track | 2025-07-22 | +| [SEP-1024](/community/seps/1024-mcp-client-security-requirements-for-local-server-) | MCP Client Security Requirements for Local Server Installation | Final | Standards Track | 2025-07-22 | +| [SEP-994](/community/seps/994-shared-communication-practicesguidelines) | Shared Communication Practices/Guidelines | Final | Process | 2025-07-17 | +| [SEP-991](/community/seps/991-enable-url-based-client-registration-using-oauth-c) | Enable URL-based Client Registration using OAuth Client ID Metadata Documents | Final | Standards Track | 2025-07-07 | +| [SEP-990](/community/seps/990-enable-enterprise-idp-policy-controls-during-mcp-o) | Enable enterprise IdP policy controls during MCP OAuth flows | Final | Standards Track | 2025-06-04 | +| [SEP-986](/community/seps/986-specify-format-for-tool-names) | Specify Format for Tool Names | Final | Standards Track | 2025-07-16 | +| [SEP-985](/community/seps/985-align-oauth-20-protected-resource-metadata-with-rf) | Align OAuth 2.0 Protected Resource Metadata with RFC 9728 | Final | Standards Track | 2025-07-16 | +| [SEP-973](/community/seps/973-expose-additional-metadata-for-implementations-res) | Expose additional metadata for Implementations, Resources, Tools and Prompts | Final | Standards Track | 2025-07-15 | +| [SEP-932](/community/seps/932-model-context-protocol-governance) | Model Context Protocol Governance | Final | Process | 2025-07-08 | ## SEP Status Definitions diff --git a/docs/docs.json b/docs/docs.json index bf2a73725..0653707c2 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -397,6 +397,7 @@ "community/seps/1699-support-sse-polling-via-server-side-disconnect", "community/seps/1730-sdks-tiering-system", "community/seps/1850-pr-based-sep-workflow", + "community/seps/1865-mcp-apps-interactive-user-interfaces-for-mcp", "community/seps/2085-governance-succession-and-amendment", "community/seps/2133-extensions" ] diff --git a/docs/extensions.mdx b/docs/extensions.mdx index e2a87d14c..1857fdb24 100644 --- a/docs/extensions.mdx +++ b/docs/extensions.mdx @@ -30,9 +30,9 @@ Extensions for supplementary authorization mechanisms beyond the core specificat Extensions for interactive UI elements in conversational MCP clients. -| Extension | Description | Specification | -| --------- | ---------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- | -| MCP Apps | Allows MCP Servers to display interactive UI elements (charts, forms, video players) inline within conversations | [Link](https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/draft/apps.mdx) | +| Extension | Description | Specification | +| --------- | ---------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | +| MCP Apps | Allows MCP Servers to display interactive UI elements (charts, forms, video players) inline within conversations | [Link](https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/2026-01-26/apps.mdx) | ## Creating Extensions diff --git a/package-lock.json b/package-lock.json index 2620a6907..d62045fe9 100644 --- a/package-lock.json +++ b/package-lock.json @@ -19,7 +19,7 @@ "prettier": "^3.6.2", "remark-mdx": "^3.1.1", "remark-parse": "^11.0.0", - "tsx": "^4.19.1", + "tsx": "^4.21.0", "typedoc": "^0.28.14", "typescript": "^5.6.2", "typescript-eslint": "^8.0.0", diff --git a/package.json b/package.json index 67c2a3bce..7c8cde059 100644 --- a/package.json +++ b/package.json @@ -55,7 +55,7 @@ "prettier": "^3.6.2", "remark-mdx": "^3.1.1", "remark-parse": "^11.0.0", - "tsx": "^4.19.1", + "tsx": "^4.21.0", "typedoc": "^0.28.14", "typescript": "^5.6.2", "typescript-eslint": "^8.0.0", diff --git a/seps/1865-mcp-apps-interactive-user-interfaces-for-mcp.md b/seps/1865-mcp-apps-interactive-user-interfaces-for-mcp.md new file mode 100644 index 000000000..376eefcad --- /dev/null +++ b/seps/1865-mcp-apps-interactive-user-interfaces-for-mcp.md @@ -0,0 +1,153 @@ +# SEP-1865: MCP Apps - Interactive User Interfaces for MCP + +- **Status**: Final +- **Type**: Extensions Track +- **Created**: 2025-11-21 +- **Author(s)**: Ido Salomon (@idosal), Liad Yosef (@liadyosef), Olivier Chafik (@olivierchafik), + Jerome Swannack (@jeromeswannack), Jonathan Hefner (@jonathanhefner), + Anton Pidkuiko (@antonpidkuiko), Nick Cooper (@nickcooper), Bryan Ashley (@bryanashley), + Alexi Christakis (@alexichristakis) +- **Sponsor**: None (seeking sponsor) +- **PR**: https://github.com/modelcontextprotocol/modelcontextprotocol/pull/1865 + + +The full extension specification is maintained in the +[ext-apps repository](https://github.com/modelcontextprotocol/ext-apps/tree/main/specification). + + +## Abstract + +This SEP proposes an extension to MCP (per SEP-1724) that enables servers to deliver interactive +user interfaces to hosts. MCP Apps introduces a standardized pattern for declaring UI resources via +the `ui://` URI scheme, associating them with tools through metadata, and facilitating +bi-directional communication between the UI and the host using MCP's JSON-RPC base protocol. This +extension addresses the growing community need for rich, interactive experiences in MCP-enabled +applications, maintaining security, auditability, and alignment with MCP's core architecture. The +initial specification focuses on HTML resources (`text/html;profile=mcp-app`) with a clear path for +future extensions. + +## Motivation + +MCP lacks a standardized way for servers to deliver rich, interactive user interfaces to hosts. +This gap blocks many use cases that require visual presentation and interactivity that go beyond +plain text or structured data. As more hosts adopt this capability, the risk of fragmentation and +interoperability challenges grows. + +[MCP-UI](https://mcpui.dev/) has demonstrated the viability and value of MCP apps built on UI +resources and serves as a community playground for the UI spec and SDK. Fueled by a dedicated +community, it developed the bi-directional communication model and the HTML, external URL, and +remote DOM content types. MCP-UI's adopters, including hosts and providers such as Postman, +HuggingFace, Shopify, Goose, and ElevenLabs, have provided critical insights and contributions to +the community. + +OpenAI's [Apps SDK](https://developers.openai.com/apps-sdk/), launched in November 2025, further +validated the demand for rich UI experiences within conversational AI interfaces. The Apps SDK +enables developers to build rich, interactive applications inside ChatGPT using MCP as its +backbone. + +The architecture of both the Apps SDK and MCP-UI has significantly informed the design of this +specification. + +However, without formal standardization: + +- Servers cannot reliably expect UI support via MCP +- Each host may implement slightly different behaviors +- Security and auditability patterns are inconsistent +- Developers must maintain separate implementations or adapters for different hosts (e.g., MCP-UI + vs. Apps SDK) + +This SEP addresses the current limitations through an optional, backwards-compatible extension that +unifies the approaches pioneered by MCP-UI and the Apps SDK into a single, open standard. + +## Specification + +The full specification can be found at +[modelcontextprotocol/ext-apps](https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/draft/apps.mdx). + +At a high level, MCP Apps extends the Model Context Protocol to enable servers to deliver +interactive user interfaces to hosts. This extension introduces: + +- **UI Resources:** Predeclared resources using the `ui://` URI scheme +- **Resource Discovery:** Tools reference UI resources via metadata +- **Bi-directional Communication:** UI iframes communicate with hosts using standard MCP JSON-RPC + protocol +- **Security Model:** Mandatory iframe sandboxing with auditable communication + +This specification focuses on HTML content (`text/html;profile=mcp-app`) as the initial content +type, with extensibility for future formats. + +As an extension, MCP Apps is optional and must be explicitly negotiated between clients and servers +through the extension capabilities mechanism (see Capability Negotiation section in the +[full specification](https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/draft/apps.mdx)). + +## Rationale + +### Predeclared resources vs. inline embedding + +UI is modeled as predeclared resources (`ui://`), referenced by tools via metadata. This allows: + +- Hosts to prefetch templates before tool execution, improving performance +- Separation of presentation (template) from data (tool results), facilitating caching +- Security review of UI resources + +**Alternatives considered:** + +- **Embedded resources:** Current MCP-UI approach, where resources are returned in tool results. + Although it's more convenient for server development, it was deferred due to the gaps in + performance optimization and the challenges in the UI review process. +- **Resource links:** Predeclare the resources but return links in tool results. Deferred due to + the gaps in performance optimization. + +### Reusing MCP JSON-RPC instead of a custom protocol + +Reuses existing MCP infrastructure (type definitions, SDKs, etc.). JSON-RPC offers advanced +capabilities (timeouts, errors, etc.). + +**Alternatives considered:** + +- **Custom message protocol:** Current MCP-UI approach with message types like tool, intent, + prompt, etc. These message types can be translated to a subset of the proposed JSON-RPC messages. +- **Global API object:** Rejected because it requires host-specific injection and doesn't work with + external iframe sources. Syntactic sugar may still be added on the server/UI side. + +### HTML-only MVP + +- HTML is universally supported and well-understood +- Simplest security model (standard iframe sandbox) +- Allows screenshot/preview generation (e.g., via html2canvas) +- Sufficient for most observed use cases +- Provides a clear baseline for future extensions + +**Alternatives considered:** + +- **Include external URLs in MVP:** This is one of the easiest content types for servers to adopt, + as it's possible to embed regular apps. However, it was deferred due to concerns around model + visibility, inability to screenshot content, and review process. It may effectively be supported + with the SEP's new `externalIframes` capability. + +## Backward Compatibility + +The proposal is an optional extension to the core protocol. Existing implementations continue +working without changes. + +## Security Implications + +Hosting interactive UI content from potentially untrusted MCP servers requires careful security +consideration. + +Based on the threat model, MCP Apps proposes the following mitigations: + +- **Iframe sandboxing**: All UI content runs in sandboxed iframes with restricted permissions +- **Predeclared templates**: Hosts can review HTML content before rendering +- **Auditable messages**: All UI-to-host communication goes through loggable JSON-RPC +- **User consent**: Hosts can require explicit approval for UI-initiated tool calls + +A full threat model analysis and mitigations are available in the +[full specification](https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/draft/apps.mdx). + +## Reference Implementation + +- [MCP-UI](https://github.com/idosal/mcp-ui) client and server SDKs support the patterns proposed + in this spec. +- [ext-apps](https://github.com/modelcontextprotocol/ext-apps) repository contains a prototype + implementation by Olivier Chafik.