
Product
Socket MCP Adds Org Alerts, Threat Feed Review, and Package Inspection
Socket MCP now lets AI assistants review org alerts, investigate threats using the Socket threat feed, and inspect package files in addition to dependency scoring.
@agent-format/mcp
Advanced tools
MCP Apps server that renders .agent files as interactive dashboards inline in Claude / ChatGPT / Cursor / VS Code Copilot.
MCP Apps server that renders .agent files as interactive dashboards inline in the chat of any MCP Apps–supporting client.
Status: Draft v0.1 — targets MCP Apps spec
2026-01-26.
When connected to Claude Desktop, ChatGPT (via Apps SDK), Cursor, VS Code Copilot, or Goose, this server exposes two tools:
render_agent_file(path) — reads an .agent file from disk and renders it inline as a kanban / timeline / metrics / log / mindmap / etc. dashboard.render_agent_inline(data) — renders a full .agent JSON object that the agent just generated in this turn.The rendered UI is the standard .agent viewer (knorq-ai.github.io/agent-format) embedded in the chat. All 12 section types work.
npm install -g @agent-format/mcp
Or run without installing:
npx @agent-format/mcp
Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or the equivalent on Windows:
{
"mcpServers": {
"agent-format": {
"command": "npx",
"args": ["-y", "@agent-format/mcp"]
}
}
}
Restart Claude Desktop. The first time a tool runs, Claude will ask for permission.
Edit ~/.cursor/mcp.json:
{
"mcpServers": {
"agent-format": {
"command": "npx",
"args": ["-y", "@agent-format/mcp"]
}
}
}
Add to settings.json:
{
"mcp.servers": {
"agent-format": {
"command": "npx",
"args": ["-y", "@agent-format/mcp"]
}
}
}
ChatGPT Apps are registered via the developer portal, not a local config file. The stdio pattern above targets desktop clients. For ChatGPT, package this server as an HTTP endpoint — a future release will include that entrypoint.
After configuring a client and restarting:
"Render
/Users/me/project.agentas a dashboard."
Claude calls render_agent_file, the viewer opens inline, and you see the kanban / timeline / metrics.
Or inline:
"Turn these TODOs into a kanban and render it."
Claude generates the .agent JSON, calls render_agent_inline with it, and the dashboard appears in the chat without touching disk.
@modelcontextprotocol/sdk and @modelcontextprotocol/ext-apps.ui://agent-format/render.html.@agent-format/renderer React bundle and CSS are inlined at build time (see build-ui.mjs). No nested iframes, no external fetches, no CSP frameDomains required — the default sandbox is sufficient.ui/notifications/tool-result postMessage, the embedded script reads structuredContent.data and mounts <AgentRenderer/> against it directly.This means the visual output is identical to what you'd see on the standalone viewer — same React renderer, same CSS — just embedded in the chat.
cd packages/mcp
npm install
npm run build
node dist/server.js
To test end-to-end locally, point your client's command at your absolute dist/server.js path instead of npx.
MIT.
FAQs
MCP Apps server that renders .agent files as interactive dashboards inline in Claude / ChatGPT / Cursor / VS Code Copilot.
We found that @agent-format/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Socket MCP now lets AI assistants review org alerts, investigate threats using the Socket threat feed, and inspect package files in addition to dependency scoring.

Product
Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.

Research
More than 140 Mastra npm packages were compromised in a supply chain attack that used a typosquatted dependency to deliver a cross-platform infostealer during installation.