@modelcontextprotocol/ext-apps 0.3.0 → 0.4.0

package/dist/src/spec.types.d.ts

@@ -111,12 +111,9 @@ export interface McpUiSandboxResourceReadyNotification {
         /** @description Optional override for the inner iframe's sandbox attribute. */
         sandbox?: string;
         /** @description CSP configuration from resource metadata. */
-        csp?: {
-            /** @description Origins for network requests (fetch/XHR/WebSocket). */
-            connectDomains?: string[];
-            /** @description Origins for static resources (scripts, images, styles, fonts). */
-            resourceDomains?: string[];
-        };
+        csp?: McpUiResourceCsp;
+        /** @description Sandbox permissions from resource metadata. */
+        permissions?: McpUiResourcePermissions;
     };
 }
 /**
@@ -262,6 +259,27 @@ export interface McpUiHostContextChangedNotification {
     /** @description Partial context update containing only changed fields. */
     params: McpUiHostContext;
 }
+/**
+ * @description Request to update the agent's context without requiring a follow-up action (Guest UI -> Host).
+ *
+ * Unlike `notifications/message` which is for debugging/logging, this request is intended
+ * to update the Host's model context. Each request overwrites the previous context sent by the Guest UI.
+ * Unlike messages, context updates do not trigger follow-ups.
+ *
+ * The host will typically defer sending the context to the model until the next user message
+ * (including `ui/message`), and will only send the last update received.
+ *
+ * @see {@link app.App.updateModelContext} for the method that sends this request
+ */
+export interface McpUiUpdateModelContextRequest {
+    method: "ui/update-model-context";
+    params: {
+        /** @description Context content blocks (text, image, etc.). */
+        content?: ContentBlock[];
+        /** @description Structured content for machine-readable context data. */
+        structuredContent?: Record<string, unknown>;
+    };
+}
 /**
  * @description Request for graceful shutdown of the Guest UI (Host -> Guest UI).
  * @see {@link app-bridge.AppBridge.teardownResource} for the host method that sends this
@@ -280,6 +298,20 @@ export interface McpUiResourceTeardownResult {
      */
     [key: string]: unknown;
 }
+export interface McpUiSupportedContentBlockModalities {
+    /** @description Host supports text content blocks. */
+    text?: {};
+    /** @description Host supports image content blocks. */
+    image?: {};
+    /** @description Host supports audio content blocks. */
+    audio?: {};
+    /** @description Host supports resource content blocks. */
+    resource?: {};
+    /** @description Host supports resource link content blocks. */
+    resourceLink?: {};
+    /** @description Host supports structured content. */
+    structuredContent?: {};
+}
 /**
  * @description Capabilities supported by the host application.
  * @see {@link McpUiInitializeResult} for the initialization result that includes these capabilities
@@ -301,6 +333,17 @@ export interface McpUiHostCapabilities {
     };
     /** @description Host accepts log messages. */
     logging?: {};
+    /** @description Sandbox configuration applied by the host. */
+    sandbox?: {
+        /** @description Permissions granted by the host (camera, microphone, geolocation). */
+        permissions?: McpUiResourcePermissions;
+        /** @description CSP domains approved by the host. */
+        csp?: McpUiResourceCsp;
+    };
+    /** @description Host accepts context updates (ui/update-model-context) to be included in the model's context for future turns. */
+    updateModelContext?: McpUiSupportedContentBlockModalities;
+    /** @description Host supports receiving content messages (ui/message) from the Guest UI. */
+    message?: McpUiSupportedContentBlockModalities;
 }
 /**
  * @description Capabilities provided by the Guest UI (App).
@@ -365,6 +408,25 @@ export interface McpUiResourceCsp {
     connectDomains?: string[];
     /** @description Origins for static resources (scripts, images, styles, fonts). */
     resourceDomains?: string[];
+    /** @description Origins for nested iframes (frame-src directive). */
+    frameDomains?: string[];
+    /** @description Allowed base URIs for the document (base-uri directive). */
+    baseUriDomains?: string[];
+}
+/**
+ * @description Sandbox permissions requested by the UI resource.
+ * Hosts MAY honor these by setting appropriate iframe `allow` attributes.
+ * Apps SHOULD NOT assume permissions are granted; use JS feature detection as fallback.
+ */
+export interface McpUiResourcePermissions {
+    /** @description Request camera access (Permission Policy `camera` feature). */
+    camera?: {};
+    /** @description Request microphone access (Permission Policy `microphone` feature). */
+    microphone?: {};
+    /** @description Request geolocation access (Permission Policy `geolocation` feature). */
+    geolocation?: {};
+    /** @description Request clipboard write access (Permission Policy `clipboard-write` feature). */
+    clipboardWrite?: {};
 }
 /**
  * @description UI Resource metadata for security and rendering configuration.
@@ -372,6 +434,8 @@ export interface McpUiResourceCsp {
 export interface McpUiResourceMeta {
     /** @description Content Security Policy configuration. */
     csp?: McpUiResourceCsp;
+    /** @description Sandbox permissions requested by the UI. */
+    permissions?: McpUiResourcePermissions;
     /** @description Dedicated origin for widget sandbox. */
     domain?: string;
     /** @description Visual boundary preference - true if UI prefers a visible border. */

package/dist/src/types.d.ts

@@ -8,9 +8,9 @@
  * @see generated/schema.ts for auto-generated Zod schemas
  * @see generated/schema.test.ts for compile-time verification
  */
-export { LATEST_PROTOCOL_VERSION, OPEN_LINK_METHOD, MESSAGE_METHOD, SANDBOX_PROXY_READY_METHOD, SANDBOX_RESOURCE_READY_METHOD, SIZE_CHANGED_METHOD, TOOL_INPUT_METHOD, TOOL_INPUT_PARTIAL_METHOD, TOOL_RESULT_METHOD, TOOL_CANCELLED_METHOD, HOST_CONTEXT_CHANGED_METHOD, RESOURCE_TEARDOWN_METHOD, INITIALIZE_METHOD, INITIALIZED_METHOD, REQUEST_DISPLAY_MODE_METHOD, type McpUiTheme, type McpUiDisplayMode, type McpUiStyleVariableKey, type McpUiStyles, type McpUiHostCss, type McpUiHostStyles, type McpUiOpenLinkRequest, type McpUiOpenLinkResult, type McpUiMessageRequest, type McpUiMessageResult, type McpUiSandboxProxyReadyNotification, type McpUiSandboxResourceReadyNotification, type McpUiSizeChangedNotification, type McpUiToolInputNotification, type McpUiToolInputPartialNotification, type McpUiToolResultNotification, type McpUiToolCancelledNotification, type McpUiHostContext, type McpUiHostContextChangedNotification, type McpUiResourceTeardownRequest, type McpUiResourceTeardownResult, type McpUiHostCapabilities, type McpUiAppCapabilities, type McpUiInitializeRequest, type McpUiInitializeResult, type McpUiInitializedNotification, type McpUiResourceCsp, type McpUiResourceMeta, type McpUiRequestDisplayModeRequest, type McpUiRequestDisplayModeResult, type McpUiToolVisibility, type McpUiToolMeta, } from "./spec.types.js";
-import type { McpUiInitializeRequest, McpUiOpenLinkRequest, McpUiMessageRequest, McpUiResourceTeardownRequest, McpUiRequestDisplayModeRequest, McpUiHostContextChangedNotification, McpUiToolInputNotification, McpUiToolInputPartialNotification, McpUiToolResultNotification, McpUiToolCancelledNotification, McpUiSandboxResourceReadyNotification, McpUiInitializedNotification, McpUiSizeChangedNotification, McpUiSandboxProxyReadyNotification, McpUiInitializeResult, McpUiOpenLinkResult, McpUiMessageResult, McpUiResourceTeardownResult, McpUiRequestDisplayModeResult } from "./spec.types.js";
-export { McpUiThemeSchema, McpUiDisplayModeSchema, McpUiHostCssSchema, McpUiHostStylesSchema, McpUiOpenLinkRequestSchema, McpUiOpenLinkResultSchema, McpUiMessageRequestSchema, McpUiMessageResultSchema, McpUiSandboxProxyReadyNotificationSchema, McpUiSandboxResourceReadyNotificationSchema, McpUiSizeChangedNotificationSchema, McpUiToolInputNotificationSchema, McpUiToolInputPartialNotificationSchema, McpUiToolResultNotificationSchema, McpUiToolCancelledNotificationSchema, McpUiHostContextSchema, McpUiHostContextChangedNotificationSchema, McpUiResourceTeardownRequestSchema, McpUiResourceTeardownResultSchema, McpUiHostCapabilitiesSchema, McpUiAppCapabilitiesSchema, McpUiInitializeRequestSchema, McpUiInitializeResultSchema, McpUiInitializedNotificationSchema, McpUiResourceCspSchema, McpUiResourceMetaSchema, McpUiRequestDisplayModeRequestSchema, McpUiRequestDisplayModeResultSchema, McpUiToolVisibilitySchema, McpUiToolMetaSchema, } from "./generated/schema.js";
+export { LATEST_PROTOCOL_VERSION, OPEN_LINK_METHOD, MESSAGE_METHOD, SANDBOX_PROXY_READY_METHOD, SANDBOX_RESOURCE_READY_METHOD, SIZE_CHANGED_METHOD, TOOL_INPUT_METHOD, TOOL_INPUT_PARTIAL_METHOD, TOOL_RESULT_METHOD, TOOL_CANCELLED_METHOD, HOST_CONTEXT_CHANGED_METHOD, RESOURCE_TEARDOWN_METHOD, INITIALIZE_METHOD, INITIALIZED_METHOD, REQUEST_DISPLAY_MODE_METHOD, type McpUiTheme, type McpUiDisplayMode, type McpUiStyleVariableKey, type McpUiStyles, type McpUiHostCss, type McpUiHostStyles, type McpUiOpenLinkRequest, type McpUiOpenLinkResult, type McpUiMessageRequest, type McpUiMessageResult, type McpUiUpdateModelContextRequest, type McpUiSupportedContentBlockModalities, type McpUiSandboxProxyReadyNotification, type McpUiSandboxResourceReadyNotification, type McpUiSizeChangedNotification, type McpUiToolInputNotification, type McpUiToolInputPartialNotification, type McpUiToolResultNotification, type McpUiToolCancelledNotification, type McpUiHostContext, type McpUiHostContextChangedNotification, type McpUiResourceTeardownRequest, type McpUiResourceTeardownResult, type McpUiHostCapabilities, type McpUiAppCapabilities, type McpUiInitializeRequest, type McpUiInitializeResult, type McpUiInitializedNotification, type McpUiResourceCsp, type McpUiResourcePermissions, type McpUiResourceMeta, type McpUiRequestDisplayModeRequest, type McpUiRequestDisplayModeResult, type McpUiToolVisibility, type McpUiToolMeta, } from "./spec.types.js";
+import type { McpUiInitializeRequest, McpUiOpenLinkRequest, McpUiMessageRequest, McpUiUpdateModelContextRequest, McpUiResourceTeardownRequest, McpUiRequestDisplayModeRequest, McpUiHostContextChangedNotification, McpUiToolInputNotification, McpUiToolInputPartialNotification, McpUiToolResultNotification, McpUiToolCancelledNotification, McpUiSandboxResourceReadyNotification, McpUiInitializedNotification, McpUiSizeChangedNotification, McpUiSandboxProxyReadyNotification, McpUiInitializeResult, McpUiOpenLinkResult, McpUiMessageResult, McpUiResourceTeardownResult, McpUiRequestDisplayModeResult } from "./spec.types.js";
+export { McpUiThemeSchema, McpUiDisplayModeSchema, McpUiHostCssSchema, McpUiHostStylesSchema, McpUiOpenLinkRequestSchema, McpUiOpenLinkResultSchema, McpUiMessageRequestSchema, McpUiMessageResultSchema, McpUiUpdateModelContextRequestSchema, McpUiSupportedContentBlockModalitiesSchema, McpUiSandboxProxyReadyNotificationSchema, McpUiSandboxResourceReadyNotificationSchema, McpUiSizeChangedNotificationSchema, McpUiToolInputNotificationSchema, McpUiToolInputPartialNotificationSchema, McpUiToolResultNotificationSchema, McpUiToolCancelledNotificationSchema, McpUiHostContextSchema, McpUiHostContextChangedNotificationSchema, McpUiResourceTeardownRequestSchema, McpUiResourceTeardownResultSchema, McpUiHostCapabilitiesSchema, McpUiAppCapabilitiesSchema, McpUiInitializeRequestSchema, McpUiInitializeResultSchema, McpUiInitializedNotificationSchema, McpUiResourceCspSchema, McpUiResourcePermissionsSchema, McpUiResourceMetaSchema, McpUiRequestDisplayModeRequestSchema, McpUiRequestDisplayModeResultSchema, McpUiToolVisibilitySchema, McpUiToolMetaSchema, } from "./generated/schema.js";
 import { CallToolRequest, CallToolResult, EmptyResult, ListPromptsRequest, ListPromptsResult, ListResourcesRequest, ListResourcesResult, ListResourceTemplatesRequest, ListResourceTemplatesResult, ListToolsRequest, ListToolsResult, LoggingMessageNotification, PingRequest, PromptListChangedNotification, ReadResourceRequest, ReadResourceResult, ResourceListChangedNotification, ToolListChangedNotification } from "@modelcontextprotocol/sdk/types.js";
 /**
  * All request types in the MCP Apps protocol.
@@ -20,7 +20,7 @@ import { CallToolRequest, CallToolResult, EmptyResult, ListPromptsRequest, ListP
  * - MCP server requests forwarded from the app (tools/call, resources/*, prompts/list)
  * - Protocol requests (ping)
  */
-export type AppRequest = McpUiInitializeRequest | McpUiOpenLinkRequest | McpUiMessageRequest | McpUiResourceTeardownRequest | McpUiRequestDisplayModeRequest | CallToolRequest | ListToolsRequest | ListResourcesRequest | ListResourceTemplatesRequest | ReadResourceRequest | ListPromptsRequest | PingRequest;
+export type AppRequest = McpUiInitializeRequest | McpUiOpenLinkRequest | McpUiMessageRequest | McpUiUpdateModelContextRequest | McpUiResourceTeardownRequest | McpUiRequestDisplayModeRequest | CallToolRequest | ListToolsRequest | ListResourcesRequest | ListResourceTemplatesRequest | ReadResourceRequest | ListPromptsRequest | PingRequest;
 /**
  * All notification types in the MCP Apps protocol.
  *

package/package.json

@@ -5,7 +5,7 @@
     "url": "https://github.com/modelcontextprotocol/ext-apps"
   },
   "homepage": "https://github.com/modelcontextprotocol/ext-apps",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "license": "MIT",
   "description": "MCP Apps SDK — Enable MCP servers to display interactive user interfaces in conversational clients.",
   "type": "module",
@@ -15,10 +15,18 @@
       "types": "./dist/src/app.d.ts",
       "default": "./dist/src/app.js"
     },
+    "./app-with-deps": {
+      "types": "./dist/src/app.d.ts",
+      "default": "./dist/src/app-with-deps.js"
+    },
     "./react": {
       "types": "./dist/src/react/index.d.ts",
       "default": "./dist/src/react/index.js"
     },
+    "./react-with-deps": {
+      "types": "./dist/src/react/index.d.ts",
+      "default": "./dist/src/react/react-with-deps.js"
+    },
     "./app-bridge": {
       "types": "./dist/src/app-bridge.d.ts",
       "default": "./dist/src/app-bridge.js"
@@ -37,17 +45,18 @@
   ],
   "scripts": {
     "postinstall": "node scripts/setup-bun.mjs || echo 'setup-bun.mjs failed or not available'",
-    "start": "npm run examples:start",
+    "start": "npm run examples:dev",
     "generate:schemas": "tsx scripts/generate-schemas.ts && prettier --write \"src/generated/**/*\"",
     "build": "npm run generate:schemas && node scripts/run-bun.mjs build.bun.ts",
     "prepack": "npm run build",
-    "build:all": "npm run build && npm run examples:build",
+    "build:all": "npm run examples:build",
     "test": "bun test src",
     "test:e2e": "playwright test",
     "test:e2e:update": "playwright test --update-snapshots",
     "test:e2e:ui": "playwright test --ui",
     "test:e2e:docker": "docker run --rm -v $(pwd):/work -w /work -it mcr.microsoft.com/playwright:v1.57.0-noble sh -c 'npm i -g bun && npm ci && npx playwright test'",
     "test:e2e:docker:update": "docker run --rm -v $(pwd):/work -w /work -it mcr.microsoft.com/playwright:v1.57.0-noble sh -c 'npm i -g bun && npm ci && npx playwright test --update-snapshots'",
+    "preexamples:build": "npm run build",
     "examples:build": "bun examples/run-all.ts build",
     "examples:start": "NODE_ENV=development npm run build && bun examples/run-all.ts start",
     "examples:dev": "NODE_ENV=development bun examples/run-all.ts dev",
@@ -56,7 +65,8 @@
     "docs": "typedoc",
     "docs:watch": "typedoc --watch",
     "prettier": "prettier -u \"**/*.{js,jsx,ts,tsx,mjs,json,md,yml,yaml}\" --check",
-    "prettier:fix": "prettier -u \"**/*.{js,jsx,ts,tsx,mjs,json,md,yml,yaml}\" --write"
+    "prettier:fix": "prettier -u \"**/*.{js,jsx,ts,tsx,mjs,json,md,yml,yaml}\" --write",
+    "check:versions": "node scripts/check-versions.mjs"
   },
   "author": "Olivier Chafik",
   "devDependencies": {