mcp-native 0.6.0 → 0.7.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -7
- package/package.json +5 -5
package/README.md
CHANGED
|
@@ -29,10 +29,10 @@ Add `react-native` when mounting native surfaces. The package is ESM-only and in
|
|
|
29
29
|
|
|
30
30
|
## A2UI v1 Candidate path
|
|
31
31
|
|
|
32
|
-
|
|
32
|
+
The package re-exports the APIs needed to negotiate the project-owned binding, resolve official
|
|
33
33
|
v1 JSONL lifecycle envelopes, maintain bounded ordered surface state, apply explicit host
|
|
34
34
|
component/event/function policies, and mount the supported native subset through
|
|
35
|
-
`A2uiV1NativeSurface`. The mounted surface keeps
|
|
35
|
+
`A2uiV1NativeSurface`. The mounted surface keeps typed input edits renderer-local and returns validated
|
|
36
36
|
official action envelopes to a host callback; it never selects a return transport. See the
|
|
37
37
|
[complete v1 host-flow example](https://github.com/pablospaniard/mcp-native#a2ui-v1-candidate-host-flow)
|
|
38
38
|
and the [`@mcp-native/react-native` adapter documentation](https://github.com/pablospaniard/mcp-native/tree/main/packages/react-native#a2ui-v1-render-plan-adapter).
|
|
@@ -127,17 +127,16 @@ Use the separately installable [`@mcp-native/mcp`](https://github.com/pablospani
|
|
|
127
127
|
- host-localized A2UI v1 plural selection and pure boolean functions;
|
|
128
128
|
- bounded A2UI v1 validation functions and renderer-side field and button checks;
|
|
129
129
|
- press-time, host-policy-gated A2UI v1 HTTP(S) `openUrl` actions;
|
|
130
|
-
- trusted render plans for
|
|
131
|
-
|
|
132
|
-
-
|
|
133
|
-
- typed adapters from trusted native primitives into locally bundled design-system components;
|
|
130
|
+
- trusted render plans for every non-media basic-catalog component, with closed host-owned variants;
|
|
131
|
+
- mounting through host-provided components with action and typed-binding event translation;
|
|
132
|
+
- typed adapters from trusted non-media semantics into locally bundled design-system components;
|
|
134
133
|
- memoized render-plan and safely observed asynchronous action-dispatch hooks;
|
|
135
134
|
- policy-gated inline and remote HTML document descriptions;
|
|
136
135
|
- MCP `2026-07-28` tool/resource field preservation through the official SDK adapter;
|
|
137
136
|
- pinned current-protocol integration coverage through the SDK HTTP handler/fetch path;
|
|
138
137
|
- ESM exports, TypeScript declarations, automated tests, and signed npm provenance.
|
|
139
138
|
|
|
140
|
-
|
|
139
|
+
Release `0.7.0` adds every non-media A2UI basic-catalog component, typed renderer-local absolute and dynamic-list-relative bindings, bounded formatting, validation functions and checks, pure boolean functions, template-instance action resolution, `@index` with offsets, host-callback action envelopes, required image grants, policy-gated HTTP(S) `openUrl`, exact installed-subset discovery, and closed catalog-capability metadata with inline catalogs disabled. `Video` and `AudioPlayer` remain planned for `0.8.0`. Release `0.6.0` added bounded consent over explicit host-authored risk, capability, sensitive-data, and external-sharing descriptors, plus expiring and revocable host-owned grants. Direct `callTool()` operations can use a separate trusted-tool policy; MCP Apps callbacks and A2UI v1 delivery use their own explicit host gates. The separately installed `@mcp-native/mcp` adapter provides issuer-bound interactive OAuth for protected HTTP, durable scope-upgrade history, bounded lifecycle coordination, actionable states, redacted operational events, and dependency-neutral platform reference adapters. It passes every scored pinned `2026-07-28` authorization client scenario. Complete MCP and A2UI conformance remain explicitly out of scope; full streaming host integration, transport placement for A2UI capability objects, and the separate non-blocking Expo Go integration PoCs remain future work. Follow the [roadmap](https://github.com/pablospaniard/mcp-native/blob/main/docs/roadmap.md) for exact claim boundaries.
|
|
141
140
|
|
|
142
141
|
## Security model
|
|
143
142
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "mcp-native",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.7.0",
|
|
4
4
|
"description": "Convenience package for the MCP Native runtime.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"a2ui",
|
|
@@ -37,10 +37,10 @@
|
|
|
37
37
|
"access": "public"
|
|
38
38
|
},
|
|
39
39
|
"dependencies": {
|
|
40
|
-
"@mcp-native/a2ui": "^0.
|
|
41
|
-
"@mcp-native/core": "^0.
|
|
42
|
-
"@mcp-native/react-native": "^0.
|
|
43
|
-
"@mcp-native/webview": "^0.
|
|
40
|
+
"@mcp-native/a2ui": "^0.7.0",
|
|
41
|
+
"@mcp-native/core": "^0.7.0",
|
|
42
|
+
"@mcp-native/react-native": "^0.7.0",
|
|
43
|
+
"@mcp-native/webview": "^0.7.0"
|
|
44
44
|
},
|
|
45
45
|
"peerDependencies": {
|
|
46
46
|
"react": ">=18.3.1 <20",
|