@agent-native/core 0.72.2 → 0.72.4

package/corpus/core/src/embedding/bridge.ts

@@ -1,3 +1,7 @@
+import {
+  MCP_APP_CHAT_BRIDGE_QUERY_PARAM,
+  EMBED_MODE_QUERY_PARAM,
+} from "../shared/embed-auth.js";
 import {
   AGENT_NATIVE_EMBED_MESSAGE_TYPES,
   createAgentNativeEmbedEnvelope,
@@ -61,10 +65,38 @@ type PendingRequest = {
 
 function resolveParentOrigin(win: Window, explicit?: string): string | null {
   if (explicit) return explicit;
+  if (shouldUseOpaqueParentTarget(win)) return "*";
   const referrerOrigin = embeddedAppOrigin(win.document?.referrer ?? "");
   return referrerOrigin;
 }
 
+function shouldUseOpaqueParentTarget(win: Window): boolean {
+  try {
+    const url = new URL(win.location.href);
+    const chatBridge = url.searchParams.get(MCP_APP_CHAT_BRIDGE_QUERY_PARAM);
+    const embedMode = url.searchParams.get(EMBED_MODE_QUERY_PARAM);
+    return (
+      chatBridge === "1" ||
+      chatBridge === "true" ||
+      embedMode === "1" ||
+      embedMode === "true"
+    );
+  } catch {
+    return false;
+  }
+}
+
+function defaultAllowedOrigins(
+  parentOrigin: string | null,
+  referrerOrigin: string | null,
+): string[] {
+  if (!parentOrigin) return [];
+  if (parentOrigin === "*") {
+    return ["null", ...(referrerOrigin ? [referrerOrigin] : [])];
+  }
+  return [parentOrigin];
+}
+
 function postToParent(
   win: Window,
   parent: Window | null,
@@ -83,9 +115,10 @@ export function createEmbeddedAppBridge(
 ): EmbeddedAppBridge {
   const win = options.currentWindow ?? window;
   const parentOrigin = resolveParentOrigin(win, options.parentOrigin);
+  const referrerOrigin = embeddedAppOrigin(win.document?.referrer ?? "");
   const allowedOrigins =
     options.allowedOrigins ??
-    (parentOrigin && parentOrigin !== "*" ? [parentOrigin] : []);
+    defaultAllowedOrigins(parentOrigin, referrerOrigin);
   const pending = new Map<string, PendingRequest>();
   let destroyed = false;
 

package/corpus/core/src/mcp/build-server.ts

@@ -152,6 +152,8 @@ export interface MCPCallerIdentity {
   oauthScopes?: string[];
   /** Present only for standard remote MCP OAuth access tokens. */
   oauthClientId?: string;
+  /** Present only for framework-minted first-party MCP client tokens. */
+  firstPartyMcp?: boolean;
 }
 
 /** Per-request context used to turn an action's relative deep link into the
@@ -748,7 +750,7 @@ function safeUiSegment(value: string | undefined, fallback: string): string {
 
 // ChatGPT and Claude cache MCP App resource HTML by `ui://` URI. Bump this
 // when the shared shell changes in a way that must invalidate host caches.
-const MCP_APP_RESOURCE_SHELL_VERSION = "shell-v46";
+const MCP_APP_RESOURCE_SHELL_VERSION = "shell-v51";
 
 function legacyDefaultMcpAppUri(config: MCPConfig, actionName: string): string {
   const app = safeUiSegment(config.appId ?? config.name, "agent-native");
@@ -1785,6 +1787,7 @@ function addSecretCandidate(
 
 async function verifyA2AJwtForMcp(
   token: string,
+  resourceUrl?: string | string[],
 ): Promise<Record<string, unknown> | null> {
   const jose = await import("jose");
   let unverifiedPayload: Record<string, unknown> | null = null;
@@ -1813,21 +1816,43 @@ async function verifyA2AJwtForMcp(
     }
   }
 
+  const firstPartyMcp = unverifiedPayload.agent_native_first_party_mcp === true;
+  const audiences = firstPartyMcp ? mcpAudienceList(resourceUrl) : null;
+  if (firstPartyMcp && !audiences?.length) return null;
+
   for (const secret of candidateSecrets) {
-    try {
-      const { payload } = await jose.jwtVerify(
-        token,
-        new TextEncoder().encode(secret),
-      );
-      return payload as Record<string, unknown>;
-    } catch {
-      // Try the next candidate without exposing which secret matched.
+    const encodedSecret = new TextEncoder().encode(secret);
+    for (const audience of audiences ?? [undefined]) {
+      try {
+        const { payload } = await jose.jwtVerify(
+          token,
+          encodedSecret,
+          audience ? { audience } : undefined,
+        );
+        return payload as Record<string, unknown>;
+      } catch {
+        // Try the next candidate without exposing which secret matched.
+      }
     }
   }
 
   return null;
 }
 
+function mcpAudienceList(resource: string | string[] | undefined): string[] {
+  const raw = Array.isArray(resource) ? resource : resource ? [resource] : [];
+  const seen = new Set<string>();
+  const out: string[] = [];
+  for (const value of raw) {
+    const normalized = value.replace(/\/+$/, "");
+    if (normalized && !seen.has(normalized)) {
+      seen.add(normalized);
+      out.push(normalized);
+    }
+  }
+  return out;
+}
+
 async function isConnectTokenAllowed(
   jti: string | undefined,
 ): Promise<boolean> {
@@ -1941,7 +1966,7 @@ export async function verifyAuth(
 
   // Try an A2A JWT via the shared A2A_SECRET first, then the caller org's
   // synced A2A secret when the token carries org_domain.
-  const payload = await verifyA2AJwtForMcp(token);
+  const payload = await verifyA2AJwtForMcp(token, options.resourceUrl);
   if (payload) {
     const tokenScope =
       typeof payload.scope === "string" ? payload.scope : undefined;
@@ -1976,6 +2001,9 @@ export async function verifyAuth(
           typeof payload.org_domain === "string"
             ? (payload.org_domain as string)
             : undefined,
+        ...(payload.agent_native_first_party_mcp === true
+          ? { firstPartyMcp: true }
+          : {}),
       },
       // Verified JWT (connect-minted or A2A delegation) — a real caller.
       fullSurface: true,

package/corpus/core/src/mcp/embed-app.ts

@@ -114,6 +114,7 @@ export function embedApp(
     const frameReadyMessageDelays = [0, 200, 500, 1500, 3000, 7000, 15000, 30000];
     const frameReadyTimeoutMs = 45000;
     const frameLoadTimeoutMs = 45000;
+    const maxEmbedSessionRefreshAttempts = 2;
     const defaultOpenAiBridgeWaitMs = 200;
     const chatGptOpenAiBridgeWaitMs = 5000;
     const openAiBridgePollMs = 50;
@@ -121,6 +122,7 @@ export function embedApp(
     const nativeBridgeRequestTimeoutMs = 30000;
     const wrapperRequestTimeoutMs = 5000;
     let app = null;
+    let appConnectPromise = null;
     let openAiBridge = null;
     let wrapperRequestId = 0;
     const wrapperRequests = new Map();
@@ -134,6 +136,7 @@ export function embedApp(
     let appFrameReadyTimer = null;
     let appFrameLoadTimer = null;
     let lastFrameSrc = "";
+    let embedSessionRefreshAttempts = 0;
 
     function esc(value) {
       return String(value ?? "")
@@ -269,9 +272,9 @@ export function embedApp(
         record.deepLinkUrl,
         record.deepLink,
         record.openUrl,
-        record.url,
         structuredOpenLinkUrl,
-        metaUrl
+        metaUrl,
+        record.url
       ]);
     }
 
@@ -324,6 +327,12 @@ export function embedApp(
       try { appFrame.contentWindow.postMessage(message, "*"); } catch {}
     }
 
+    function notifyOuterMcpAppReady() {
+      try {
+        window.parent.postMessage({ type: "agentNative.embeddedAppReady" }, "*");
+      } catch {}
+    }
+
     function nextWrapperRequestId() {
       wrapperRequestId += 1;
       return "mcp-wrapper-" + Date.now() + "-" + wrapperRequestId;
@@ -640,6 +649,21 @@ export function embedApp(
       );
     }
 
+    function importHeadChildrenWithBase(source, baseHref) {
+      const base = document.createElement("base");
+      base.href = baseHref;
+      const nodes = Array.from(source.childNodes).filter((node) => {
+        return !(
+          node.nodeType === 1 &&
+          String(node.nodeName || "").toLowerCase() === "base"
+        );
+      });
+      document.head.replaceChildren(
+        base,
+        ...nodes.map((node) => document.importNode(node, true))
+      );
+    }
+
     function isModuleScript(script) {
       return (script.getAttribute("type") || "").trim().toLowerCase() === "module";
     }
@@ -835,10 +859,7 @@ export function embedApp(
       );
       const scripts = Array.from(parsed.querySelectorAll("script"));
       copyDocumentElementAttributes(parsed.documentElement);
-      importChildren(parsed.head, document.head);
-      const base = document.createElement("base");
-      base.href = config.baseHref;
-      document.head.prepend(base);
+      importHeadChildrenWithBase(parsed.head, config.baseHref);
       importChildren(parsed.body, document.body);
       installExternalOpenControl(appUrl);
       for (const script of scripts) {
@@ -920,6 +941,7 @@ export function embedApp(
         window.history.replaceState(window.history.state, "", localPathFromUrl(appUrl, false));
       } catch {}
       await mountTransplantedHtml(html, appUrl);
+      embedSessionRefreshAttempts = 0;
       notifyHostHeightRepeatedly();
     }
 
@@ -1159,6 +1181,7 @@ export function embedApp(
       frame.addEventListener("load", () => {
         if (appFrame !== frame) return;
         clearFrameLoadTimer();
+        notifyOuterMcpAppReady();
         sendFrameReadyMessages(frame);
         startFrameReadyTimer(frame);
       });
@@ -1177,6 +1200,13 @@ export function embedApp(
         renderFrameFallback();
         return;
       }
+      if (embedSessionRefreshAttempts >= maxEmbedSessionRefreshAttempts) {
+        renderAppLaunchError(
+          "Embedded app session expired. Reopen the app to mint a fresh session."
+        );
+        return;
+      }
+      embedSessionRefreshAttempts += 1;
       openStartUrl = "";
       startedFor = "";
       lastFrameSrc = "";
@@ -1193,19 +1223,6 @@ export function embedApp(
       return true;
     }
 
-    // We have connected to a standards-track MCP Apps host (Codex, Cursor,
-    // Claude over the SDK, our own renderer, …) through the postMessage
-    // \`ui/*\` bridge rather than ChatGPT's \`window.openai\` global. These hosts
-    // render the resource in a strict sandboxed iframe (typically
-    // \`sandbox="allow-scripts"\`, opaque origin). Self-navigating that iframe to
-    // the real app origin tears down the host bridge and loses the opaque-origin
-    // auth context, which shows up as a permanent / flashing loading state.
-    // Transplanting the app document into the shell keeps the bridge alive and
-    // works under the opaque origin via embed-token auth, exactly like Claude.
-    function isNativeMcpAppsBridgeHost() {
-      return !!app && !openAiBridge;
-    }
-
     function shouldTransplantAppDocument() {
       const render = renderModeSource();
       const mode = render.mode;
@@ -1215,7 +1232,6 @@ export function embedApp(
       return (
         isClaudeMcpContentHost() ||
         isChatGptSandboxHost() ||
-        isNativeMcpAppsBridgeHost() ||
         mode === "transplant" ||
         render.frame === "transplant"
       );
@@ -1240,10 +1256,29 @@ export function embedApp(
     }
 
     function shouldRenderControlledAppFrame() {
-      return !!openAiBridge || isChatGptSandboxHost();
+      return !!openAiBridge || !!app || isChatGptSandboxHost();
+    }
+
+    function shouldDirectRenderKnownAppRoute(src) {
+      return !!app && !openAiBridge && !isEmbedStartUrl(src) && !shouldTransplantAppDocument();
+    }
+
+    function isCurrentFrameUrl(src) {
+      try {
+        return new URL(src, window.location.href).href === window.location.href;
+      } catch {
+        return false;
+      }
     }
 
     function navigateToAppFrame(src) {
+      if (isCurrentFrameUrl(src)) {
+        clearFrameReadyTimer();
+        clearFrameLoadTimer();
+        setMessage("App opened");
+        notifyHostHeightRepeatedly();
+        return;
+      }
       clearFrameReadyTimer();
       clearFrameLoadTimer();
       appFrame = null;
@@ -1257,6 +1292,24 @@ export function embedApp(
       }
     }
 
+    async function ensureHostAppConnected() {
+      if (!app || typeof app.connect !== "function") return;
+      if (!appConnectPromise) {
+        appConnectPromise = Promise.resolve(app.connect())
+          .then(async (value) => {
+            // Let the host process ui/notifications/initialized before follow-up calls.
+            await new Promise((resolve) => window.setTimeout(resolve, 0));
+            await new Promise((resolve) => window.setTimeout(resolve, 0));
+            return value;
+          })
+          .catch((err) => {
+            appConnectPromise = null;
+            throw err;
+          });
+      }
+      await appConnectPromise;
+    }
+
     async function updateHostModelContext(data) {
       const params = {};
       if (Array.isArray(data && data.content)) params.content = data.content;
@@ -1271,6 +1324,7 @@ export function embedApp(
         return { ok: true };
       }
       if (!app || typeof app.updateModelContext !== "function") return { ok: false };
+      await ensureHostAppConnected();
       await app.updateModelContext(params);
       return { ok: true };
     }
@@ -1356,6 +1410,7 @@ export function embedApp(
             agentNativeModelContext: modelContext
           });
         } else if (app && typeof app.updateModelContext === "function") {
+          await ensureHostAppConnected();
           await app.updateModelContext(modelContext);
         }
       } catch (err) {
@@ -1372,6 +1427,7 @@ export function embedApp(
         }
         let result = null;
         if (app && typeof app.sendMessage === "function") {
+          await ensureHostAppConnected();
           result = await app.sendMessage({
             role: "user",
             content
@@ -1412,8 +1468,10 @@ export function embedApp(
       const data = event.data.data || {};
       if (event.data.type === "agentNative.embeddedAppReady") {
         appFrameReady = true;
+        embedSessionRefreshAttempts = 0;
         clearFrameLoadTimer();
         clearFrameReadyTimer();
+        notifyOuterMcpAppReady();
         return;
       }
       if (event.data.type === "agentNative.embedSessionExpired") {
@@ -1454,7 +1512,7 @@ export function embedApp(
     }
 
     async function launchEmbed() {
-      const launchUrl = openStartUrl || openUrl;
+      let launchUrl = openStartUrl || openUrl;
       if (!launchUrl) {
         renderAppLaunchError("Open link was not available.");
         return;
@@ -1463,11 +1521,11 @@ export function embedApp(
         setMessage("Ready to open.");
         return;
       }
-      if (startedFor === launchUrl) return;
-      startedFor = launchUrl;
       setMessage("Loading app");
       try {
         const selfNavigate = shouldSelfNavigateToApp();
+        if (startedFor === launchUrl) return;
+        startedFor = launchUrl;
         const embedUrl = withChatBridgeParam(launchUrl);
         if (selfNavigate && isEmbedStartUrl(embedUrl)) {
           if (shouldTransplantAppDocument()) {
@@ -1483,6 +1541,10 @@ export function embedApp(
           renderFrame(embedUrl);
           return;
         }
+        if (shouldDirectRenderKnownAppRoute(embedUrl)) {
+          renderFrame(embedUrl);
+          return;
+        }
         const result = await callEmbedSessionTool(embedSessionArgsFor(embedUrl));
         const data = parseToolResult(result);
         if (typeof data.startUrl !== "string" || !data.startUrl) {
@@ -1640,7 +1702,7 @@ export function embedApp(
 
     function createNativeMcpAppsBridge() {
       let rpcId = 0;
-      let connected = false;
+      let connectPromise = null;
       let hostContext = {};
       const pendingRequests = new Map();
 
@@ -1708,26 +1770,32 @@ export function embedApp(
           return hostContext.protocolVersion || "mcp-apps-postmessage";
         },
         async connect() {
-          if (connected) return hostContext;
-          connected = true;
-          window.addEventListener("message", onMessage, { passive: true });
-          const result = await rpcRequest(
-            "ui/initialize",
-            {
-              appInfo: { name: "Agent Native Embed", version: "1.0.0" },
-              appCapabilities: {},
-              protocolVersion: "2026-01-26"
-            },
-            nativeBridgeInitializeTimeoutMs
-          );
-          hostContext = objectValue(result);
-          rpcNotify("ui/notifications/initialized", {});
-          if (typeof nativeApp.onhostcontextchanged === "function") {
-            nativeApp.onhostcontextchanged(hostContext);
-          }
-          return hostContext;
+          if (connectPromise) return await connectPromise;
+          connectPromise = (async () => {
+            window.addEventListener("message", onMessage, { passive: true });
+            const result = await rpcRequest(
+              "ui/initialize",
+              {
+                appInfo: { name: "Agent Native Embed", version: "1.0.0" },
+                appCapabilities: {},
+                protocolVersion: "2026-01-26"
+              },
+              nativeBridgeInitializeTimeoutMs
+            );
+            hostContext = objectValue(result);
+            rpcNotify("ui/notifications/initialized", {});
+            if (typeof nativeApp.onhostcontextchanged === "function") {
+              nativeApp.onhostcontextchanged(hostContext);
+            }
+            return hostContext;
+          })().catch((err) => {
+            connectPromise = null;
+            throw err;
+          });
+          return await connectPromise;
         },
         async callServerTool(request) {
+          await nativeApp.connect();
           const record = objectValue(request);
           return await rpcRequest("tools/call", {
             name: record.name,
@@ -1735,6 +1803,7 @@ export function embedApp(
           });
         },
         async updateModelContext(params) {
+          await nativeApp.connect();
           return await rpcRequest("ui/update-model-context", objectValue(params));
         },
         async openLink(params) {
@@ -1749,12 +1818,14 @@ export function embedApp(
           return opened ? { ok: true } : { isError: true };
         },
         async requestDisplayMode(params) {
+          await nativeApp.connect();
           return await rpcRequest("ui/request-display-mode", objectValue(params));
         },
         sendSizeChanged(params) {
           rpcNotify("ui/notifications/size-changed", objectValue(params));
         },
         async sendMessage(params) {
+          await nativeApp.connect();
           return await rpcRequest("ui/message", objectValue(params));
         }
       };
@@ -1798,6 +1869,7 @@ export function embedApp(
 
     async function startNativeMcpAppsBridge() {
       app = createNativeMcpAppsBridge();
+      appConnectPromise = null;
       app.ontoolinput = (params) => {
         toolInput = params.arguments || {};
       };
@@ -1815,7 +1887,8 @@ export function embedApp(
         notifyHostHeight();
         sendHostContext();
       };
-      await app.connect();
+      await ensureHostAppConnected();
+      notifyOuterMcpAppReady();
       updateDisplayButton();
       notifyHostHeight();
       sendHostContext();
@@ -1828,6 +1901,7 @@ export function embedApp(
         {},
         { autoResize: false }
       );
+      appConnectPromise = null;
       app.ontoolinput = (params) => {
         toolInput = params.arguments || {};
       };
@@ -1845,7 +1919,8 @@ export function embedApp(
         notifyHostHeight();
         sendHostContext();
       };
-      await app.connect();
+      await ensureHostAppConnected();
+      notifyOuterMcpAppReady();
       updateDisplayButton();
       notifyHostHeight();
       sendHostContext();

package/corpus/core/src/mcp/index.ts

@@ -37,3 +37,8 @@ export {
   findWorkspaceRoot,
 } from "./workspace-resolve.js";
 export type { ResolvedApp, ResolvedWorkspace } from "./workspace-resolve.js";
+export {
+  fetchOrgApps,
+  resolveOrgDirectoryOrigin,
+  type OrgApp,
+} from "./org-directory.js";

package/corpus/core/src/mcp/org-directory.ts

@@ -146,6 +146,10 @@ function scopedCacheKey(
   ].join("|");
 }
 
+function serviceScopedCacheKey(origin: string, orgId: string): string {
+  return [origin, `service-org:${orgId}`].join("|");
+}
+
 /**
  * Fetch the org's first-party sibling apps from the org directory.
  *
@@ -162,6 +166,7 @@ function scopedCacheKey(
 export async function fetchOrgApps(opts?: {
   selfId?: string;
   selfOrigin?: string;
+  serviceOrgId?: string;
   env?: NodeJS.ProcessEnv;
 }): Promise<OrgApp[]> {
   const env = opts?.env ?? process.env;
@@ -182,24 +187,32 @@ export async function fetchOrgApps(opts?: {
   let cacheKey: string | null = null;
   let apps: OrgApp[] = [];
   let ttl = EMPTY_TTL_MS;
+  const serviceOrgId = opts?.serviceOrgId?.trim();
+  if (serviceOrgId) {
+    const serviceCacheKey = serviceScopedCacheKey(origin, serviceOrgId);
+    const cached = cache.get(serviceCacheKey);
+    if (cached && cached.expiresAt > Date.now()) {
+      return stripSelf(cached.apps);
+    }
+    cacheKey = serviceCacheKey;
+  }
   try {
-    // Reuse the existing A2A caller-auth: it reads userEmail + orgId from the
-    // request context, loads the org A2A secret via getOrgA2ASecret (falling
-    // back to the global A2A_SECRET env), and signs the same bearer JWT A2A
-    // peers already use. No new secret loading is invented here.
-    const { resolveA2ACallerAuth } = await import("../a2a/caller-auth.js");
-    const auth = await resolveA2ACallerAuth();
+    const auth = serviceOrgId
+      ? await resolveOrgDirectoryServiceAuth(serviceOrgId)
+      : await resolveOrgDirectoryCallerAuth();
     if (!auth.apiKey) {
       // No signed token available (no A2A secret / no caller identity) — the
       // directory requires the org bearer, so degrade silently to local-only.
       return [];
     }
 
-    const now = Date.now();
-    cacheKey = scopedCacheKey(origin, auth);
-    const cached = cache.get(cacheKey);
-    if (cached && cached.expiresAt > now) {
-      return stripSelf(cached.apps);
+    if (!cacheKey) {
+      const now = Date.now();
+      cacheKey = scopedCacheKey(origin, auth);
+      const cached = cache.get(cacheKey);
+      if (cached && cached.expiresAt > now) {
+        return stripSelf(cached.apps);
+      }
     }
 
     const res = await fetch(`${origin}/_agent-native/org/apps`, {
@@ -236,3 +249,49 @@ export async function fetchOrgApps(opts?: {
 export function _resetOrgDirectoryCache(): void {
   cache.clear();
 }
+
+async function resolveOrgDirectoryCallerAuth(): Promise<{
+  apiKey?: string;
+  userEmail?: string;
+  orgId?: string;
+  orgDomain?: string;
+}> {
+  // Reuse the existing A2A caller-auth: it reads userEmail + orgId from the
+  // request context, loads the org A2A secret via getOrgA2ASecret (falling
+  // back to the global A2A_SECRET env), and signs the same bearer JWT A2A
+  // peers already use. No new secret loading is invented for normal callers.
+  const { resolveA2ACallerAuth } = await import("../a2a/caller-auth.js");
+  return resolveA2ACallerAuth();
+}
+
+async function resolveOrgDirectoryServiceAuth(orgId: string): Promise<{
+  apiKey?: string;
+  userEmail?: string;
+  orgId?: string;
+  orgDomain?: string;
+}> {
+  const trimmedOrgId = orgId.trim();
+  if (!trimmedOrgId) return {};
+  let orgDomain: string | undefined;
+  let orgSecret: string | undefined;
+  try {
+    const { getOrgDomain, getOrgA2ASecret } = await import("../org/context.js");
+    orgDomain = (await getOrgDomain(trimmedOrgId)) ?? undefined;
+    orgSecret = (await getOrgA2ASecret(trimmedOrgId)) ?? undefined;
+  } catch {}
+  try {
+    const [{ signA2AToken }, { serviceIdentityEmail }] = await Promise.all([
+      import("../a2a/client.js"),
+      import("./connect-store.js"),
+    ]);
+    const userEmail = serviceIdentityEmail("mcp-client", trimmedOrgId);
+    const apiKey = await signA2AToken(userEmail, orgDomain, orgSecret, {
+      expiresIn: "5m",
+      preferGlobalSecret: !orgSecret,
+      extraClaims: { org_id: trimmedOrgId },
+    });
+    return { apiKey, userEmail, orgId: trimmedOrgId, orgDomain };
+  } catch {
+    return { orgId: trimmedOrgId, orgDomain };
+  }
+}

package/corpus/core/src/mcp/server.ts

@@ -103,6 +103,14 @@ function deriveRequestMeta(event: H3Event): MCPRequestMeta {
     fullCatalogHeader === "1" ||
     fullCatalogHeader === "true" ||
     fullCatalogHeader === "yes";
+  const inlineAppsHeader = getRequestHeader(
+    event,
+    "x-agent-native-mcp-inline-apps",
+  )?.toLowerCase();
+  const inlineAppsRequested =
+    inlineAppsHeader === "1" ||
+    inlineAppsHeader === "true" ||
+    inlineAppsHeader === "yes";
   const basePath = getConfiguredAppBasePath();
   return {
     origin,
@@ -111,6 +119,7 @@ function deriveRequestMeta(event: H3Event): MCPRequestMeta {
     clientName,
     clientHint,
     ...(fullCatalog ? { fullCatalog } : {}),
+    ...(inlineAppsRequested ? { inlineMcpApps: true } : {}),
   };
 }
 
@@ -357,6 +366,11 @@ export async function handleMcpRequest(
   const server = await createMCPServerForRequest(config, authResult.identity, {
     ...requestMeta,
     fullSurface: authResult.fullSurface === true,
+    inlineMcpApps:
+      requestMeta.inlineMcpApps === true &&
+      authResult.identity?.firstPartyMcp === true
+        ? true
+        : undefined,
     // When the caller minted their token with --full-catalog (catalog_scope:
     // "full" JWT claim), bypass the connector-catalog tier filter.
     ...(authResult.fullCatalog === true ? { fullCatalog: true } : {}),