ref.mcp.apps · implementation
MCP Apps — Embedded Interactive Tool UI
Official MCP extension documentation for the Apps layer: ui:// resources, sandboxed iframe rendering, CSP and permissions policy, JSON-RPC host communication, tool-call approval, context updates, and guidance on when an embedded app surface is preferable to a normal link. Review frequently as the extension evolves.
https://modelcontextprotocol.io/extensions/apps/overview
What this source teaches
- Apply a hostile-boundary threat model for every MCP App surface: least-privilege capability grant, explicit CSP allowlist, origin isolation between host and embedded app, and tool-call approval UX before any external action.
- Accessible iframe implementation requires: descriptive title attribute, focus management on open/close, keyboard-reachable close/fallback, and responsive host sizing.
- Provide fallback content for every embedded surface so MCP Apps are additive, not required, for core task completion.
- Define a teardown and cleanup contract for every App lifecycle event.
Where AwesomeDS applied it
rule.ai.generative-boundaries— Agents compose approved contractsrule.ai.ux-streaming-contract— Treat streaming as semantic asynchronous staterule.trust.embedded-ui-boundary— Treat every embedded agent UI as a hostile capability boundary
Implementations and artifacts
No directly linked artifacts.
Caveats & anti-imitation
Adopt the hostile-boundary threat model and explicit CSP/permission patterns; do not assume embedded UI is safe without explicit origin isolation and tool-call approval.