
Security News
Feross on TBPN: How North Korea Hijacked Axios
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.
mcp-widgets
Advanced tools
UI widgets for rendering MCP (Model Context Protocol) tool responses in AI assistants like ChatGPT.
When an MCP tool returns data, AI assistants can display it using custom UI widgets instead of plain text. This package provides ready-to-use widgets that can be embedded via a simple <script> tag.
npm install mcp-widgets
# or
pnpm add mcp-widgets
| Widget | Framework | Size | Description |
|---|---|---|---|
data-card | Web Widget | ~3KB | Simple key-value data display |
rich-data-card | React | ~148KB | Enhanced card with sections, icons, footer |
Load widgets via CDN and use them as custom HTML elements:
<!-- Load the widget -->
<script src="https://unpkg.com/mcp-widgets/cdn/data-card.js"></script>
<!-- Use it -->
<mcp-data-card
title="Weather"
data='{"temperature": "72°F", "conditions": "Sunny"}'
status="success"
></mcp-data-card>
import { RichDataCard } from 'mcp-widgets'
function MyWidget() {
return (
<RichDataCard
title="Order Summary"
icon="🛒"
data={{ orderId: '#12345', total: '$89.99' }}
sections={[{ title: 'Shipping', data: { method: 'Express' } }]}
status="success"
/>
)
}
<script> tag pointing to a CDN-hosted widgetWhen your MCP server handles a tool call, return HTML that embeds a widget:
// In your MCP server tool handler
function handleWeatherTool(location) {
const data = fetchWeather(location)
return {
content: [
{
type: 'text',
text: `
<script src="https://unpkg.com/mcp-widgets/cdn/data-card.js"></script>
<mcp-data-card
title="Weather in ${location}"
data='${JSON.stringify(data)}'
status="success"
></mcp-data-card>
`,
},
],
}
}
The loader handles communication with the ChatGPT host via window.openai. Widgets themselves should NOT call these APIs directly - the loader manages height notifications and prop extraction.
Available host APIs (used by the loader):
// Notify ChatGPT of widget height (takes a number)
window.openai.notifyIntrinsicHeight(document.body.scrollHeight)
// Access tool response metadata for props
window.openai.toolResponseMetadata._meta
See the OpenAI Apps SDK docs for the full window.openai API reference.
<mcp-data-card>A lightweight Web Widget (no React dependency).
| Attribute | Type | Description |
|---|---|---|
title | string | Card title |
data | JSON string | Key-value pairs to display |
status | success | error | warning | info | Status indicator styling |
<mcp-rich-data-card>A React-based widget with more features.
| Attribute | Type | Description |
|---|---|---|
title | string | Card title |
description | string | Subtitle text |
icon | string | Emoji or icon character |
data | JSON string | Main data section |
sections | JSON string | Array of {title, data} sections |
footer | string | Footer text |
status | success | error | warning | info | Status styling |
# Install dependencies
pnpm install
# Start Storybook
pnpm dev
# Run tests
pnpm test
# Build everything
pnpm build
# Build CDN bundles only
pnpm build:cdn
src/widgets/{widget-name}/WidgetName.ts (Web Widget) or WidgetName.tsx (React)manifest.json - Widget metadatacdn.ts or cdn.tsx - CDN entry pointindex.ts - Library exportsrc/widgets/index.tspnpm build to generate bundlesThis repository is designed to be forked! You have two options:
Fork this repo to create your own private widget library:
This is ideal for:
We welcome community contributions! If you build a widget that could benefit others:
Good candidates for community widgets:
If you fork and want to self-host your CDN bundles:
# Build the CDN bundles
pnpm build:cdn
# The cdn/ directory contains all bundles
# Upload to your preferred hosting:
# - GitHub Pages
# - Cloudflare R2/Pages
# - AWS S3 + CloudFront
# - Vercel/Netlify
Then reference your hosted bundles in MCP tool responses:
<script src="https://your-cdn.example.com/widgets/my-widget.js"></script>
MIT
FAQs
UI widgets for MCP integrations (OpenAI, etc.)
The npm package mcp-widgets receives a total of 0 weekly downloads. As such, mcp-widgets popularity was classified as not popular.
We found that mcp-widgets demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.

Security News
OpenSSF has issued a high-severity advisory warning open source developers of an active Slack-based campaign using impersonation to deliver malware.

Research
/Security News
Malicious packages published to npm, PyPI, Go Modules, crates.io, and Packagist impersonate developer tooling to fetch staged malware, steal credentials and wallets, and enable remote access.