You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This SEP proposes an extension to MCP (per SEP-1724) that enables servers to deliver interactive user interfaces to hosts. MCP Apps introduces a standardized pattern for declaring UI resources via the `ui://` URI scheme, associating them with tools through metadata, and facilitating bi-directional communication between the UI and the host using MCP's JSON-RPC base protocol. This extension addresses the growing community need for rich, interactive experiences in MCP-enabled applications, maintaining security, auditability, and alignment with MCP's core architecture. The initial specification focuses on HTML resources (`text/html;profile=mcp-app`) with a clear path for future extensions.
20
+
This SEP proposes an extension to MCP (per SEP-1724) that enables servers to deliver interactive
21
+
user interfaces to hosts. MCP Apps introduces a standardized pattern for declaring UI resources via
22
+
the `ui://` URI scheme, associating them with tools through metadata, and facilitating
23
+
bi-directional communication between the UI and the host using MCP's JSON-RPC base protocol. This
24
+
extension addresses the growing community need for rich, interactive experiences in MCP-enabled
25
+
applications, maintaining security, auditability, and alignment with MCP's core architecture. The
26
+
initial specification focuses on HTML resources (`text/html;profile=mcp-app`) with a clear path for
27
+
future extensions.
17
28
18
29
## Motivation
19
30
20
-
MCP lacks a standardized way for servers to deliver rich, interactive user interfaces to hosts. This gap blocks many use cases that require visual presentation and interactivity that go beyond plain text or structured data. As more hosts adopt this capability, the risk of fragmentation and interoperability challenges grows.
31
+
MCP lacks a standardized way for servers to deliver rich, interactive user interfaces to hosts.
32
+
This gap blocks many use cases that require visual presentation and interactivity that go beyond
33
+
plain text or structured data. As more hosts adopt this capability, the risk of fragmentation and
34
+
interoperability challenges grows.
21
35
22
-
[MCP-UI](https://mcpui.dev/) has demonstrated the viability and value of MCP apps built on UI resources and serves as a community playground for the UI spec and SDK. Fueled by a dedicated community, it developed the bi-directional communication model and the HTML, external URL, and remote DOM content types. MCP-UI's adopters, including hosts and providers such as Postman, HuggingFace, Shopify, Goose, and ElevenLabs, have provided critical insights and contributions to the community.
36
+
[MCP-UI](https://mcpui.dev/) has demonstrated the viability and value of MCP apps built on UI
37
+
resources and serves as a community playground for the UI spec and SDK. Fueled by a dedicated
38
+
community, it developed the bi-directional communication model and the HTML, external URL, and
39
+
remote DOM content types. MCP-UI's adopters, including hosts and providers such as Postman,
40
+
HuggingFace, Shopify, Goose, and ElevenLabs, have provided critical insights and contributions to
41
+
the community.
23
42
24
-
OpenAI's [Apps SDK](https://developers.openai.com/apps-sdk/), launched in November 2025, further validated the demand for rich UI experiences within conversational AI interfaces. The Apps SDK enables developers to build rich, interactive applications inside ChatGPT using MCP as its backbone.
43
+
OpenAI's [Apps SDK](https://developers.openai.com/apps-sdk/), launched in November 2025, further
44
+
validated the demand for rich UI experiences within conversational AI interfaces. The Apps SDK
45
+
enables developers to build rich, interactive applications inside ChatGPT using MCP as its
46
+
backbone.
25
47
26
-
The architecture of both the Apps SDK and MCP-UI has significantly informed the design of this specification.
48
+
The architecture of both the Apps SDK and MCP-UI has significantly informed the design of this
49
+
specification.
27
50
28
51
However, without formal standardization:
29
52
30
53
- Servers cannot reliably expect UI support via MCP
31
54
- Each host may implement slightly different behaviors
32
55
- Security and auditability patterns are inconsistent
33
-
- Developers must maintain separate implementations or adapters for different hosts (e.g., MCP-UI vs. Apps SDK)
56
+
- Developers must maintain separate implementations or adapters for different hosts (e.g., MCP-UI
57
+
vs. Apps SDK)
34
58
35
-
This SEP addresses the current limitations through an optional, backwards-compatible extension that unifies the approaches pioneered by MCP-UI and the Apps SDK into a single, open standard.
59
+
This SEP addresses the current limitations through an optional, backwards-compatible extension that
60
+
unifies the approaches pioneered by MCP-UI and the Apps SDK into a single, open standard.
36
61
37
62
## Specification
38
63
39
-
The full specification can be found at [modelcontextprotocol/ext-apps](https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/draft/apps.mdx).
At a high level, MCP Apps extends the Model Context Protocol to enable servers to deliver interactive user interfaces to hosts. This extension introduces:
67
+
At a high level, MCP Apps extends the Model Context Protocol to enable servers to deliver
68
+
interactive user interfaces to hosts. This extension introduces:
42
69
43
70
-**UI Resources:** Predeclared resources using the `ui://` URI scheme
44
71
-**Resource Discovery:** Tools reference UI resources via metadata
45
-
-**Bi-directional Communication:** UI iframes communicate with hosts using standard MCP JSON-RPC protocol
72
+
-**Bi-directional Communication:** UI iframes communicate with hosts using standard MCP JSON-RPC
73
+
protocol
46
74
-**Security Model:** Mandatory iframe sandboxing with auditable communication
47
75
48
-
This specification focuses on HTML content (`text/html;profile=mcp-app`) as the initial content type, with extensibility for future formats.
76
+
This specification focuses on HTML content (`text/html;profile=mcp-app`) as the initial content
77
+
type, with extensibility for future formats.
49
78
50
-
As an extension, MCP Apps is optional and must be explicitly negotiated between clients and servers through the extension capabilities mechanism (see Capability Negotiation section in the [full specification](https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/draft/apps.mdx)).
79
+
As an extension, MCP Apps is optional and must be explicitly negotiated between clients and servers
80
+
through the extension capabilities mechanism (see Capability Negotiation section in the
@@ -61,17 +92,23 @@ UI is modeled as predeclared resources (`ui://`), referenced by tools via metada
61
92
62
93
**Alternatives considered:**
63
94
64
-
-**Embedded resources:** Current MCP-UI approach, where resources are returned in tool results. Although it's more convenient for server development, it was deferred due to the gaps in performance optimization and the challenges in the UI review process.
65
-
-**Resource links:** Predeclare the resources but return links in tool results. Deferred due to the gaps in performance optimization.
95
+
-**Embedded resources:** Current MCP-UI approach, where resources are returned in tool results.
96
+
Although it's more convenient for server development, it was deferred due to the gaps in
97
+
performance optimization and the challenges in the UI review process.
98
+
-**Resource links:** Predeclare the resources but return links in tool results. Deferred due to
99
+
the gaps in performance optimization.
66
100
67
101
### Reusing MCP JSON-RPC instead of a custom protocol
-**Custom message protocol:** Current MCP-UI approach with message types like tool, intent, prompt, etc. These message types can be translated to a subset of the proposed JSON-RPC messages.
74
-
-**Global API object:** Rejected because it requires host-specific injection and doesn't work with external iframe sources. Syntactic sugar may still be added on the server/UI side.
108
+
-**Custom message protocol:** Current MCP-UI approach with message types like tool, intent,
109
+
prompt, etc. These message types can be translated to a subset of the proposed JSON-RPC messages.
110
+
-**Global API object:** Rejected because it requires host-specific injection and doesn't work with
111
+
external iframe sources. Syntactic sugar may still be added on the server/UI side.
-**Include external URLs in MVP:** This is one of the easiest content types for servers to adopt, as it's possible to embed regular apps. However, it was deferred due to concerns around model visibility, inability to screenshot content, and review process. It may effectively be supported with the SEP's new `externalIframes` capability.
123
+
-**Include external URLs in MVP:** This is one of the easiest content types for servers to adopt,
124
+
as it's possible to embed regular apps. However, it was deferred due to concerns around model
125
+
visibility, inability to screenshot content, and review process. It may effectively be supported
126
+
with the SEP's new `externalIframes` capability.
87
127
88
128
## Backward Compatibility
89
129
90
-
The proposal is an optional extension to the core protocol. Existing implementations continue working without changes.
130
+
The proposal is an optional extension to the core protocol. Existing implementations continue
Based on the threat model, MCP Apps proposes the following mitigations:
97
139
@@ -100,9 +142,12 @@ Based on the threat model, MCP Apps proposes the following mitigations:
100
142
-**Auditable messages**: All UI-to-host communication goes through loggable JSON-RPC
101
143
-**User consent**: Hosts can require explicit approval for UI-initiated tool calls
102
144
103
-
A full threat model analysis and mitigations are available in the [full specification](https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/draft/apps.mdx).
145
+
A full threat model analysis and mitigations are available in the
0 commit comments