
Security News
The Nightmare Before Deployment
Season’s greetings from Socket, and here’s to a calm end of year: clean dependencies, boring pipelines, no surprises.
@modelcontextprotocol/ext-apps
Advanced tools
MCP Apps SDK — Enable MCP servers to display interactive user interfaces in conversational clients.
This repo contains the SDK and specification for MCP Apps Extension (SEP-1865).
MCP Apps are a proposed standard inspired by MCP-UI and OpenAI's Apps SDK to allow MCP Servers to display interactive UI elements in conversational MCP clients / chatbots.
This SDK serves two audiences:
Build interactive UIs that run inside MCP-enabled chat clients.
@modelcontextprotocol/ext-apps — API Docs@modelcontextprotocol/ext-apps/react — API DocsEmbed and communicate with MCP Apps in your chat application.
@modelcontextprotocol/ext-apps/app-bridge — API DocsThere's no supported host implementation in this repo (beyond the examples/basic-host example).
We have contributed a tentative implementation of hosting / iframing / sandboxing logic to the MCP-UI repository, and expect OSS clients may use it, while other clients might roll their own hosting logic.
npm install -S @modelcontextprotocol/ext-apps
Or edit your package.json manually:
{
"dependencies": {
"@modelcontextprotocol/ext-apps": "^0.0.1"
}
}
Start with these foundational examples to learn the SDK:
examples/basic-server-vanillajs — Example MCP server with tools that return UI Apps (vanilla JS)examples/basic-server-react — Example MCP server with tools that return UI Apps (React)examples/basic-host — Bare-bones example of hosting MCP AppsThe examples/ directory contains additional demo apps showcasing real-world use cases.
To run all examples together:
npm install
npm run examples:start
Then open http://localhost:8080/.
FAQs
MCP Apps SDK — Enable MCP servers to display interactive user interfaces in conversational clients.
We found that @modelcontextprotocol/ext-apps demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Season’s greetings from Socket, and here’s to a calm end of year: clean dependencies, boring pipelines, no surprises.

Research
/Security News
Impostor NuGet package Tracer.Fody.NLog typosquats Tracer.Fody and its author, using homoglyph tricks, and exfiltrates Stratis wallet JSON/passwords to a Russian IP address.

Security News
Deno 2.6 introduces deno audit with a new --socket flag that plugs directly into Socket to bring supply chain security checks into the Deno CLI.