@modelcontextprotocol/ext-apps - npm Package Compare versions

Comparing version 0.0.6 to 0.0.7

dist/src/app.d.ts

@@ -41,3 +41,3 @@ import { type RequestOptions, Protocol, ProtocolOptions } from "@modelcontextprotocol/sdk/shared/protocol.js";
  */
-export declare const RESOURCE_MIME_TYPE = "text/html;profile=mcp";
+export declare const RESOURCE_MIME_TYPE = "text/html;profile=mcp-app";
 /**
@@ -44,0 +44,0 @@ * Options for configuring App behavior.

dist/src/types.d.ts

@@ -261,2 +261,9 @@ import { CallToolResult, ContentBlock, Implementation, RequestId, Tool } from "@modelcontextprotocol/sdk/types.js";
         sandbox?: string;
+        /** CSP configuration from resource metadata */
+        csp?: {
+            /** Origins for network requests (fetch/XHR/WebSocket) */
+            connectDomains?: string[];
+            /** Origins for static resources (scripts, images, styles, fonts) */
+            resourceDomains?: string[];
+        };
     };
@@ -273,2 +280,6 @@ }
         sandbox: z.ZodOptional<z.ZodString>;
+        csp: z.ZodOptional<z.ZodObject<{
+            connectDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            resourceDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
     }, z.core.$strip>;
@@ -275,0 +286,0 @@ }, z.core.$strip>;

package.json

@@ -8,3 +8,3 @@ {
   "homepage": "https://github.com/modelcontextprotocol/ext-apps",
-  "version": "0.0.6",
+  "version": "0.0.7",
   "license": "MIT",
@@ -11,0 +11,0 @@ "description": "MCP Apps SDK — Enable MCP servers to display interactive user interfaces in conversational clients.",

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

821699

0.11%

Lines of code

5188

0.25%

Worsened metrics

Number of medium supply chain risk alerts

5

25%

No dependency changes