# MCP Apps Explained: The Official Interactive-UI Extension for MCP > What MCP Apps (SEP-1865) is: the ui:// resource scheme and sandboxed-iframe/JSON-RPC bridge it defines for MCP tools to return rendered UI instead of plain text, how it relates to the community MCP-UI project and OpenAI's Apps SDK, and which hosts support it. Category: Reference · Updated: 2026-07-14 · Tags: mcp-apps, mcp, protocols, generative-ui, resources, agents, standard Canonical: https://changegamer.ai/resources/mcp-apps-explained Variants: [HTML](https://changegamer.ai/resources/mcp-apps-explained) · [JSON](https://changegamer.ai/api/resources/mcp-apps-explained.json) License: https://changegamer.ai/license.xml · Access: free Plain MCP tools return text and structured data — a chart or a form needs the host to build its own custom rendering logic. **MCP Apps** is the official MCP extension that closes that gap: a server pre-declares an HTML UI resource, links it to a tool, and a compatible host renders it in a sandboxed iframe that talks back over MCP's own JSON-RPC channel — instead of every client inventing its own bespoke widget protocol. ## Key facts - MCP Apps is **SEP-1865** ("MCP Apps - Interactive User Interfaces for MCP"), proposed November 21, 2025 and merged as an accepted, live MCP extension January 26–28, 2026 — confirmed directly against the merged GitHub pull request and the MCP project's own blog. - It defines a `ui://` URI scheme for pre-declared UI resources served as `text/html;profile=mcp-app`, mandatory sandboxed-iframe rendering, and a bidirectional JSON-RPC-over-`postMessage` bridge (`ui/*` methods and notifications) between the widget and host. - It was co-developed by Anthropic, OpenAI, and the community **MCP-UI** project (`@mcp-ui/server` / `@mcp-ui/client`), which had already been shipping the same iframe-plus-postMessage pattern experimentally — MCP Apps standardizes what MCP-UI and OpenAI's separately-branded **Apps SDK** each prototyped first. - The extension is optional and backward-compatible, negotiated per-connection through MCP's existing capability mechanism — a server or client that doesn't implement it just gets a plain tool result, nothing breaks. - Adoption named on the launch announcement itself: Anthropic (Claude), OpenAI (ChatGPT, rolling out), Block (Goose), Microsoft (VS Code Insiders), JetBrains, AWS, and Google DeepMind. ## How a tool call becomes a rendered widget The server registers a `ui://` resource template and links it to a tool — the MCP Apps standard key is `_meta.ui.resourceUri` on the tool descriptor (OpenAI's Apps SDK instead used its own `_meta["openai/outputTemplate"]` key; check both if a tool must target either host — WebSearch-corroborated, not primary-fetched, see sources below). The model calls the tool as normal via `tools/call`; the result points at the linked resource. The host fetches and caches the `ui://` resource once, then renders it sandboxed. Interaction inside the widget (a button, a form) sends JSON-RPC messages back over the bridge, which can trigger further tool calls — the same trust boundary as any other MCP message, not an open postMessage channel. ## Distinct from three adjacent ChangeGamer topics - **Not one of the six core primitives** (/resources/mcp-primitives): MCP Apps is an optional *extension* layered on the Resources primitive, not itself one of the base six. - **Not AG-UI** (/resources/generative-ui-for-agents): AG-UI is an SSE event vocabulary an agent backend streams to a frontend you build; MCP Apps ships the UI *inside the MCP resource itself* and renders inside the host's own chat surface — no separate frontend to build. - **Not covered by the general server-building guide** (/resources/building-mcp-servers): its "three server primitives" section predates this extension and stops at plain tool/resource/prompt results, with no UI-rendering path. ## Security note A rendered widget is untrusted, model-adjacent content running in the user's own session — treat it as another agent-exposed UI surface (see /resources/agentic-security-checklist and /resources/agentic-browsers): validate everything the iframe sends back before acting on it, and rely on the mandatory sandboxing rather than the widget's own good behavior. ## Verified sources Primary (fetched directly this session): - SEP-1865 pull request (merged; title and technical summary confirmed): https://github.com/modelcontextprotocol/modelcontextprotocol/pull/1865 - MCP Apps launch post, "now live" (Jan 26, 2026): https://blog.modelcontextprotocol.io/posts/2026-01-26-mcp-apps/ - MCP Apps proposal post (Nov 21, 2025): https://blog.modelcontextprotocol.io/posts/2025-11-21-mcp-apps/ Secondary — WebSearch-corroborated only (developers.openai.com, mcpui.dev, and a wikipedia.org control fetch all returned HTTP 403 to direct WebFetch this session, so these specific details are not primary-fetched and should be reverified when those domains are reachable): - OpenAI Apps SDK reference (page title + 3 independent developer write-ups agree on the `_meta` key names): https://developers.openai.com/apps-sdk/reference - MCP-UI project docs on the Apps SDK relationship: https://mcpui.dev/guide/apps-sdk - Shopify Engineering, "MCP UI: Breaking the text wall with interactive components": https://shopify.engineering/mcp-ui-breaking-the-text-wall --- ## Related resources - [MCP Primitives: Resources, Prompts, Sampling, and Elicitation](https://changegamer.ai/resources/mcp-primitives.md): Deep reference on the six MCP capability primitives beyond tools — who controls each, the exact JSON-RPC method names, and when to use Resources vs Tools — verified against the 2025-06-18 and 2025-11-25 spec revisions. - [NLWeb Explained: Microsoft's Natural-Language Query Protocol for Websites](https://changegamer.ai/resources/nlweb-explained.md): What NLWeb is: the open, MIT-licensed protocol that lets a site answer natural-language questions over its own Schema.org data via /ask and /mcp endpoints, who built it, and how it differs from llms.txt, AGENTS.md, and a generic MCP server. - [MCP Goes Stateless: The 2026-07-28 Spec Revision Explained](https://changegamer.ai/resources/mcp-2026-spec-revision.md): What changes in MCP's largest revision since launch: SEP-2575/SEP-2567 remove the session handshake and Mcp-Session-Id header for explicit state handles, new Mcp-Method/Mcp-Name routing headers, full JSON Schema 2020-12 tool schemas, and six authorization-hardening SEPs — an RC snapshot as of 2026-07-14; final ships 2026-07-28. - [MCP Server Authentication: OAuth 2.1 for Remote Servers](https://changegamer.ai/resources/mcp-server-authentication.md): How OAuth 2.1 works for remote MCP servers: transport differences, Protected Resource Metadata discovery, PKCE, Resource Indicators, and token-audience security — with a step-by-step client flow and honest notes on what ChangeGamer's own /mcp endpoint does. --- Index of all resources: https://changegamer.ai/llms.txt · Full corpus: https://changegamer.ai/llms-full.txt · Corpus data (NDJSON): https://changegamer.ai/api/corpus.jsonl · Offers: https://changegamer.ai/api/pricing.json