Skip to content

Commit 2af3410

Browse files
cliffhallgithub-actions[bot]github-advanced-security[bot]olaservo
authored
Add MCP Apps support to Inspector (#1044)
* Fix MCP Apps rendering issue and add comprehensive logging - Fixed AppRenderer useEffect dependency array to include resourceContent This ensures the component re-evaluates when resource content arrives - Added detailed console logging throughout the app lifecycle: * Resource fetch and response tracking in App.tsx * Setup conditions and AppBridge creation in AppRenderer.tsx * HTML parsing and iframe rendering steps * PostMessageTransport and AppBridge connection status * App tool filtering and selection in AppsTab.tsx - Refactored AppsTab selectedTool rendering for better tracking The issue was that resourceContent prop updates weren't triggering the AppRenderer setup effect. Now the effect properly responds to both resourceUri and resourceContent changes. Co-authored-by: Cliff Hall <cliffhall@users.noreply.github.com> * Fix MCP Apps iframe rendering issue The app was getting stuck on 'Loading MCP App...' because the iframe was hidden (display: none) until the oninitialized event fired. However, the PostMessage handshake requires the iframe to be visible to complete. This fix: - Sets loading to false immediately after writing HTML to the iframe - Makes the iframe visible before establishing PostMessage transport - Allows the AppBridge initialization handshake to complete successfully - Removes redundant setLoading(false) from oninitialized callback The iframe is now visible and ready for PostMessage communication before the AppBridge connect() call, enabling proper initialization. Co-authored-by: Cliff Hall <cliffhall@users.noreply.github.com> * Fix MCP Apps HTML extraction to match spec The AppRenderer was incorrectly checking for a 'type' field in resource contents, but TextResourceContents objects only have uri, mimeType, and text fields according to the MCP specification. Fixed by checking for the presence of the 'text' field directly instead of checking a non-existent 'type' field. This allows the HTML content to be properly extracted and rendered in the iframe. Co-authored-by: Cliff Hall <cliffhall@users.noreply.github.com> * Add comprehensive tests for MCP Apps support - Add tests for AppsTab component (13 tests) - Add tests for AppRenderer component (17 tests) - Update jest.config.cjs to handle ES modules from @modelcontextprotocol/ext-apps - All 478 tests pass successfully Co-authored-by: Cliff Hall <cliffhall@users.noreply.github.com> * Add MCP Apps support to Inspector - Add AppsTab component for detecting and listing MCP apps - Add AppRenderer component with full AppBridge integration - Implement UI resource fetching and sandboxed iframe rendering - Add PostMessage transport for bidirectional JSON-RPC communication - Include comprehensive test coverage (30 new tests) - Auto-populate apps when tab becomes active - Support theme awareness and configurable permissions Co-authored-by: Cliff Hall <cliffhall@users.noreply.github.com> * Prefer structuredContent over content field in tool responses Some MCP servers return different data in structuredContent vs content fields. This change ensures that when structuredContent is present, it is used exclusively for display instead of showing both fields. Changes: - Modified ToolResults.tsx to only show content when structuredContent is absent - Removed unused checkContentCompatibility function - Updated test cases to reflect new behavior Co-authored-by: Cliff Hall <cliffhall@users.noreply.github.com> * Revert "Prefer structuredContent over content field in tool responses" This reverts commit 3b054b4. Claude did not do the right thing. * feat: integrate @mcp-ui/client for MCP application rendering This commit implements the integration of `@mcp-ui/client` to handle the rendering of Model Context Protocol (MCP) applications within the inspector. It includes refactoring the rendering logic, improving resource fetching in the main application state, and setting up a secure sandbox environment. Changes per file: - client/package.json: - Added `@mcp-ui/client` as a dependency. - client/src/components/AppRenderer.tsx: - Refactored to use `McpUiAppRenderer` from `@mcp-ui/client`. - Implemented HTML parsing logic for MCP resource responses. - Configured host context (theme) and sandbox URL for the renderer. - Replaced iframe-based manual rendering with the official component. - client/src/App.tsx: - Added `fetchingResources` state to prevent duplicate concurrent resource requests. - Enhanced `readResource` with better error handling and state tracking. - Optimized resource content mapping to better support application state. - client/src/components/AppsTab.tsx: - Updated to use `getToolUiResourceUri` utility from `@modelcontextprotocol/ext-apps` instead of manual metadata property access. - Simplified tool filtering and selection logic. - client/public/sandbox_proxy.html: - Added a sandbox proxy page to facilitate secure communication between the inspector and the rendered MCP applications. - client/bin/client.js: - Added server rewrites to ensure `sandbox_proxy.html` is served correctly. - Implemented specific `Cache-Control` headers for `sandbox_proxy.html` to prevent stale cached versions. - client/vite.config.ts: - Explicitly configured `publicDir: "public"` to ensure the sandbox proxy is included in the build output. - client/src/components/__tests__/AppRenderer.test.tsx: - Updated tests to mock the new `@mcp-ui/client` component. - Adjusted assertions to verify correct props are passed to the renderer. - Enhanced mock MCP client to include required methods like `getServerCapabilities`. * Potential fix for code scanning alert no. 37: Client-side cross-site scripting Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Update package-lock.json - npm install - npm audit fix * Potential fix for code scanning alert no. 38: Client-side cross-site scripting Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 39: Client-side cross-site scripting Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * prettier * Update client/src/components/AppsTab.tsx Co-authored-by: Ola Hungerford <olahungerford@gmail.com> * prettier * In AppsTab.test.tsx, fetch button by aria-label * relative imports * Remove sanitization logic from sandbox_proxy.html. It's breaking the app rendering. Will sort out what best practices for this HTML is later * In sandbox_proxy.html,formatting In AppsTab.tsx - Add app window - when an app is selected, - show input form for apps that have an input schema - button shows app - if app is shown, show maximize button - if maximized, - show minimize button - hide app list * In AppsTab.test.tsx - test new layout and controls * In AppRenderer.tsx - accept toolInput - pass to McpUiAppRenderer * In AppsTab.tsx, if an app has no inputSchema, just show it, otherwise show the form and the "back to form" button when showing the app. * In AppsTab.test.tsx - test new behavior * In ListPane.tsx - remove the Clear button * In ListPane.test.tsx - remove test for clear button * In AppRenderer.tsx, - remove onReadResource and resourceContent, not needed since mcpClient is being passed * In App.tsx and AppsTab.tsx, - remove the passing of these variables * In AppRenderer.test.tsx, and AppsTab.test.tsx - remove tests that fail after having removed onReadResource and resourceContent * Serving the sandbox_proxy.html from a separate port, using the proxy instead of the webclient server. * In App.tsx - pass the path to the sandbox endpoint on the proxy to the AppsTab * In AppsTab.tsx - accept the sandboxPath property and pass it to the AppRenderer * In AppRenderer.tsx - accept the sandboxPath property and pass it to the McpUiAppRenderer * In client.js - remove the rewrite and header config for sandbox_proxy.html * In server/src/index.ts - add a /sandbox endpoint that reads and returns the sandbox_proxy.html file with no-cache header * In server/package.json - add shx for cross-platform copy function - in build script, copy static folder to build folder * Moved sandbox_proxy.html from client/public to server/static * In client.js - return to original state * In vite.config.ts - return to original state * Potential fix for code scanning alert no. 41: Missing rate limiting Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * In AppRenderer.tsx - add open link handler that handles link requests from the UI. Makes sure that the URL starts with http or https * In sandbox_proxy.html - refactor to match [basic-host](https://github.com/modelcontextprotocol/ext-apps/tree/main/examples/basic-host) example - creates an nested iframe for security. - in this implementation, for simplicity the sandbox.ts is inlined in sandbox_proxy.html as javascript * prettier * In AppRenderer.tsx - add support for handling McpUiMessageRequest messages from the UI - show message in a toast * Add logging message handler to AppRenderer In App.tsx - pass an onNotification function to the AppsTab that adds a notification to the notification array In AppsTab.tsx - Accept the onNotification function and pass it to the AppRenderer In AppRenderer.tsx - Accept the onNotification function - added an handleLoggingMessage function that takes a LoggingMessageNotificationParams object, wraps it with a method and params prop to make it a ServerNotification shape, and pass it to the onNotification function - pass handleLoggingMessage to McpUiAppRenderer * In ResourcesTab.test.tsx - fix @ import that wasn't resolving * In AppRenderer.tsx - remove fetch and evaluation of resourceUri, as the mcpClient handles that (review request) * In AppRenderer.test.tsx - remove test for no resourceUri found * Merge branch 'main' into full-apps-support-final Resolved Conflicts: - package-lock.json * Fixed mismatch with sanboxRateLimiter and the express version --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Cliff Hall <cliffhall@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Ola Hungerford <olahungerford@gmail.com>
1 parent 98f0587 commit 2af3410

16 files changed

Lines changed: 2090 additions & 196 deletions

cli/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
"test:cli-metadata": "vitest run metadata.test.ts"
2626
},
2727
"devDependencies": {
28-
"@types/express": "^5.0.6",
28+
"@types/express": "^5.0.0",
2929
"tsx": "^4.7.0",
3030
"vitest": "^4.0.17"
3131
},

client/jest.config.cjs

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,15 @@ module.exports = {
1313
tsconfig: "tsconfig.jest.json",
1414
},
1515
],
16+
"^.+\\.m?js$": [
17+
"ts-jest",
18+
{
19+
tsconfig: "tsconfig.jest.json",
20+
},
21+
],
1622
},
1723
extensionsToTreatAsEsm: [".ts", ".tsx"],
24+
transformIgnorePatterns: ["node_modules/(?!(@modelcontextprotocol)/)"],
1825
testRegex: "(/__tests__/.*|(\\.|/)(test|spec))\\.(jsx?|tsx?)$",
1926
// Exclude directories and files that don't need to be tested
2027
testPathIgnorePatterns: [

client/package.json

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@
2525
"cleanup:e2e": "node e2e/global-teardown.js"
2626
},
2727
"dependencies": {
28+
"@mcp-ui/client": "^6.0.0",
29+
"@modelcontextprotocol/ext-apps": "^1.0.0",
2830
"@modelcontextprotocol/sdk": "^1.25.2",
2931
"@radix-ui/react-checkbox": "^1.1.4",
3032
"@radix-ui/react-dialog": "^1.1.3",

client/src/App.tsx

Lines changed: 75 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ import {
5151
import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
5252
import { Button } from "@/components/ui/button";
5353
import {
54+
AppWindow,
5455
Bell,
5556
Files,
5657
FolderTree,
@@ -75,6 +76,7 @@ import SamplingTab, { PendingRequest } from "./components/SamplingTab";
7576
import Sidebar from "./components/Sidebar";
7677
import ToolsTab from "./components/ToolsTab";
7778
import TasksTab from "./components/TasksTab";
79+
import AppsTab from "./components/AppsTab";
7880
import { InspectorConfig } from "./lib/configurationTypes";
7981
import {
8082
getMCPProxyAddress,
@@ -126,6 +128,9 @@ const App = () => {
126128
const [resourceContentMap, setResourceContentMap] = useState<
127129
Record<string, string>
128130
>({});
131+
const [fetchingResources, setFetchingResources] = useState<Set<string>>(
132+
new Set(),
133+
);
129134
const [prompts, setPrompts] = useState<Prompt[]>([]);
130135
const [promptContent, setPromptContent] = useState<string>("");
131136
const [tools, setTools] = useState<Tool[]>([]);
@@ -308,11 +313,13 @@ const App = () => {
308313
...(serverCapabilities?.prompts ? ["prompts"] : []),
309314
...(serverCapabilities?.tools ? ["tools"] : []),
310315
...(serverCapabilities?.tasks ? ["tasks"] : []),
316+
"apps",
311317
"ping",
312318
"sampling",
313319
"elicitations",
314320
"roots",
315321
"auth",
322+
"metadata",
316323
];
317324

318325
if (!validTabs.includes(originatingTab)) return;
@@ -440,11 +447,13 @@ const App = () => {
440447
...(serverCapabilities?.prompts ? ["prompts"] : []),
441448
...(serverCapabilities?.tools ? ["tools"] : []),
442449
...(serverCapabilities?.tasks ? ["tasks"] : []),
450+
"apps",
443451
"ping",
444452
"sampling",
445453
"elicitations",
446454
"roots",
447455
"auth",
456+
"metadata",
448457
];
449458

450459
const isValidTab = validTabs.includes(hash);
@@ -473,6 +482,13 @@ const App = () => {
473482
// eslint-disable-next-line react-hooks/exhaustive-deps
474483
}, [mcpClient, activeTab]);
475484

485+
useEffect(() => {
486+
if (mcpClient && activeTab === "apps" && serverCapabilities?.tools) {
487+
void listTools();
488+
}
489+
// eslint-disable-next-line react-hooks/exhaustive-deps
490+
}, [mcpClient, activeTab, serverCapabilities?.tools]);
491+
476492
useEffect(() => {
477493
localStorage.setItem("lastCommand", command);
478494
}, [command]);
@@ -757,11 +773,13 @@ const App = () => {
757773
...(serverCapabilities?.prompts ? ["prompts"] : []),
758774
...(serverCapabilities?.tools ? ["tools"] : []),
759775
...(serverCapabilities?.tasks ? ["tasks"] : []),
776+
"apps",
760777
"ping",
761778
"sampling",
762779
"elicitations",
763780
"roots",
764781
"auth",
782+
"metadata",
765783
];
766784

767785
if (validTabs.includes(originatingTab)) {
@@ -851,22 +869,48 @@ const App = () => {
851869
};
852870

853871
const readResource = async (uri: string) => {
872+
if (fetchingResources.has(uri) || resourceContentMap[uri]) {
873+
return;
874+
}
875+
876+
console.log("[App] Reading resource:", uri);
877+
setFetchingResources((prev) => new Set(prev).add(uri));
854878
lastToolCallOriginTabRef.current = currentTabRef.current;
855879

856-
const response = await sendMCPRequest(
857-
{
858-
method: "resources/read" as const,
859-
params: { uri },
860-
},
861-
ReadResourceResultSchema,
862-
"resources",
863-
);
864-
const content = JSON.stringify(response, null, 2);
865-
setResourceContent(content);
866-
setResourceContentMap((prev) => ({
867-
...prev,
868-
[uri]: content,
869-
}));
880+
try {
881+
const response = await sendMCPRequest(
882+
{
883+
method: "resources/read" as const,
884+
params: { uri },
885+
},
886+
ReadResourceResultSchema,
887+
"resources",
888+
);
889+
console.log("[App] Resource read response:", {
890+
uri,
891+
responseLength: JSON.stringify(response).length,
892+
hasContents: !!(response as { contents?: unknown[] }).contents,
893+
});
894+
const content = JSON.stringify(response, null, 2);
895+
setResourceContent(content);
896+
setResourceContentMap((prev) => ({
897+
...prev,
898+
[uri]: content,
899+
}));
900+
} catch (error) {
901+
console.error(`[App] Failed to read resource ${uri}:`, error);
902+
const errorString = (error as Error).message ?? String(error);
903+
setResourceContentMap((prev) => ({
904+
...prev,
905+
[uri]: JSON.stringify({ error: errorString }),
906+
}));
907+
} finally {
908+
setFetchingResources((prev) => {
909+
const next = new Set(prev);
910+
next.delete(uri);
911+
return next;
912+
});
913+
}
870914
};
871915

872916
const subscribeToResource = async (uri: string) => {
@@ -1308,6 +1352,10 @@ const App = () => {
13081352
<ListTodo className="w-4 h-4 mr-2" />
13091353
Tasks
13101354
</TabsTrigger>
1355+
<TabsTrigger value="apps">
1356+
<AppWindow className="w-4 h-4 mr-2" />
1357+
Apps
1358+
</TabsTrigger>
13111359
<TabsTrigger value="ping">
13121360
<Bell className="w-4 h-4 mr-2" />
13131361
Ping
@@ -1497,6 +1545,19 @@ const App = () => {
14971545
error={errors.tasks}
14981546
nextCursor={nextTaskCursor}
14991547
/>
1548+
<AppsTab
1549+
sandboxPath={`${getMCPProxyAddress(config)}/sandbox`}
1550+
tools={tools}
1551+
listTools={() => {
1552+
clearError("tools");
1553+
listTools();
1554+
}}
1555+
error={errors.tools}
1556+
mcpClient={mcpClient}
1557+
onNotification={(notification) => {
1558+
setNotifications((prev) => [...prev, notification]);
1559+
}}
1560+
/>
15001561
<ConsoleTab />
15011562
<PingTab
15021563
onPingClick={() => {
Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
import { useMemo, useState } from "react";
2+
import { Client } from "@modelcontextprotocol/sdk/client/index.js";
3+
import {
4+
Tool,
5+
ContentBlock,
6+
ServerNotification,
7+
LoggingMessageNotificationParams,
8+
} from "@modelcontextprotocol/sdk/types.js";
9+
import {
10+
AppRenderer as McpUiAppRenderer,
11+
type McpUiHostContext,
12+
type RequestHandlerExtra,
13+
} from "@mcp-ui/client";
14+
import {
15+
type McpUiMessageRequest,
16+
type McpUiMessageResult,
17+
} from "@modelcontextprotocol/ext-apps/app-bridge";
18+
import { Alert, AlertDescription } from "@/components/ui/alert";
19+
import { AlertCircle } from "lucide-react";
20+
import { useToast } from "@/lib/hooks/useToast";
21+
22+
interface AppRendererProps {
23+
sandboxPath: string;
24+
tool: Tool;
25+
mcpClient: Client | null;
26+
toolInput?: Record<string, unknown>;
27+
onNotification?: (notification: ServerNotification) => void;
28+
}
29+
30+
const AppRenderer = ({
31+
sandboxPath,
32+
tool,
33+
mcpClient,
34+
toolInput,
35+
onNotification,
36+
}: AppRendererProps) => {
37+
const [error, setError] = useState<string | null>(null);
38+
const { toast } = useToast();
39+
40+
const hostContext: McpUiHostContext = useMemo(
41+
() => ({
42+
theme: document.documentElement.classList.contains("dark")
43+
? "dark"
44+
: "light",
45+
}),
46+
[],
47+
);
48+
49+
const handleOpenLink = async ({ url }: { url: string }) => {
50+
let isError = true;
51+
if (url.startsWith("https://") || url.startsWith("http://")) {
52+
window.open(url, "_blank");
53+
isError = false;
54+
}
55+
return { isError };
56+
};
57+
58+
const handleMessage = async (
59+
params: McpUiMessageRequest["params"],
60+
// eslint-disable-next-line @typescript-eslint/no-unused-vars
61+
_extra: RequestHandlerExtra,
62+
): Promise<McpUiMessageResult> => {
63+
const message = params.content
64+
.filter((block): block is ContentBlock & { type: "text" } =>
65+
Boolean(block.type === "text"),
66+
)
67+
.map((block) => block.text)
68+
.join("\n");
69+
70+
if (message) {
71+
toast({
72+
description: message,
73+
});
74+
}
75+
76+
return {};
77+
};
78+
79+
const handleLoggingMessage = (params: LoggingMessageNotificationParams) => {
80+
if (onNotification) {
81+
onNotification({
82+
method: "notifications/message",
83+
params,
84+
} as ServerNotification);
85+
}
86+
};
87+
88+
if (!mcpClient) {
89+
return (
90+
<Alert>
91+
<AlertCircle className="h-4 w-4" />
92+
<AlertDescription>Waiting for MCP client...</AlertDescription>
93+
</Alert>
94+
);
95+
}
96+
97+
return (
98+
<div className="flex flex-col h-full">
99+
{error && (
100+
<Alert variant="destructive" className="mb-4">
101+
<AlertCircle className="h-4 w-4" />
102+
<AlertDescription>{error}</AlertDescription>
103+
</Alert>
104+
)}
105+
106+
<div
107+
className="flex-1 border rounded overflow-hidden"
108+
style={{ minHeight: "400px" }}
109+
>
110+
<McpUiAppRenderer
111+
client={mcpClient}
112+
onOpenLink={handleOpenLink}
113+
onMessage={handleMessage}
114+
onLoggingMessage={handleLoggingMessage}
115+
toolName={tool.name}
116+
hostContext={hostContext}
117+
toolInput={toolInput}
118+
sandbox={{
119+
url: new URL(sandboxPath, window.location.origin),
120+
}}
121+
onError={(err) => setError(err.message)}
122+
/>
123+
</div>
124+
</div>
125+
);
126+
};
127+
128+
export default AppRenderer;

0 commit comments

Comments
 (0)