MCP Apps: UI in AI

When Model Context Protocol (MCP) can render HTML inside AI chat app

Aurelijus Banelis · NoTrollAllowed · 2026-07-31

Aurelijus Banelis

Lead Software Engineer

aurelijus.banelis.lt
aurelijus@banelis.lt

PGP 0x320205E7539B6203

130D C446 1F1A 2E50 D6E3

3DA8 3202 05E7 539B 6203

Terminology

MCP Apps: UI in AI tools

AI: Artificial Intelligence
MCP: Model Context Protocol

MCP Apps is part of MCP specification
UI: User Interface

Agenda

What we'll cover

How it feels?01

How it works?02

How mature it is?03

Part 01

How it feels?

DEMO time: How it looks from a non-technical user

01How it feels?

02How it works?

03How mature it is?

The human_prioritization tool rendering a drag-and-drop list inside the Claude chat

The same MCP App rendered in the ChatGPT mobile client

Let's talk DEMO

https://mcp-prioritization.netlify.app/mcp

github.com/aurelijusb/mcp-prioritization

Let's talk DEMO

tsx ./src/stdio.ts

github.com/aurelijusb/mcp-prioritization

Adoption

Client	Platform	MCP Apps support
Claude	desktop	HTTP / stdio
GitHub Copilot	VS Code	HTTP / stdio
Claude	mobile / web	HTTP
ChatGPT	mobile / web	HTTP
Claude	CLI / VS Code	no support
Codex	CLI / VS Code	no support

Microsoft Office Copilot also support, but it can cost ~2500k€/year.
Claude Haiku does not render MCP Apps, need at least Sonnet model.

Official reference: Supported clients

Part 02

How it works?

Behind the SDK

01How it feels?

02How it works?

03How mature it is?

HTTP Schema for UI files

Request · my demo server

curl -sS https://mcp-prioritization.netlify.app/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2026-07-28' \
  -H 'Mcp-Method: tools/list' \
  -d '{"jsonrpc":"2.0","id":1,
    "method":"tools/list",
    "params":{"_meta":{
      "io.modelcontextprotocol/protocolVersion":
        "2026-07-28",
      "io.modelcontextprotocol/clientCapabilities":
        {}}}}' | jq

Response

{ "tools": [ {
  "name": "human_prioritization",
  "inputSchema": { ... },
  "_meta": {
    "ui": {
      "resourceUri": "ui://prioritization/list.html",
      "visibility": [ "model", "app" ]
    }
  }
} ] }

JSON-RPC over Stateless HTTP.
The UI is already declared in tools/list, before anything is called.

JavaScript Communication

Every message, in either direction, crosses one channel: window.parent.postMessage.

notify — no id, fire and forget: tool-input, tool-result

host-action — View → Host → Server: tools/call, resources/read

host-action — terminates at the Host: ui/open-link, ui/message, ui/request-display-mode, ui/update-model-context, ui/resource-teardown

Specgithub.com/modelcontextprotocol/.../apps.mdx

Part 03

How mature it is?

Usages in the real world

01How it feels?

02How it works?

03How mature it is?

No single MCP Apps store

Host	Name
Claude	Claude Connector or Claude App that ships UI
ChatGPT	ChatGPT App build on MCP with some OpenAI-only features
VS Code	Microsoft's curated MCP gallery
Goose	Goose extensions
Cursor	Cursor marketplace
PulseMCP	The cross-host MCP server directory
...	...

Security and privacy edge cases

Claude tool permissions panel letting a user allow, ask, or deny a tool per-call

Tool trust poisoning — Invariant Labs, Apr 2025 — a sleeper server advertises an innocuous tool, then swaps it after you approved it. CyberArk extended this to the whole schema, not just descriptions *

GitHub Dependabot alert list with Critical, High, and Moderate severity vulnerabilities

Supply chain — postmark-mcp shipped 15 clean versions, then a one-line BCC backdoor in v1.0.16 — 1,643 downloads before removal. CVE-2025-6514 in mcp-remote scores 9.6 *

German cookie-consent dialog with separate Marketing, Analysis, and Essential toggles

GDPR — ePrivacy Art. 5(3) and TDDDG §25 are technology-neutral and name local storage directly. MCP simply has no consent logging — a compliance burden

Sourcing per research.md:

Tool trust poisoning: Invariant Labs' WhatsApp MCP demo (linked) is the primary source; the CyberArk "full-schema poisoning" extension is cited in research.md without a URL — still need a link for that half of the claim.
Supply chain: CVE-2025-6514 links to its NVD entry. The postmark-mcp backdoor (15 clean versions, BCC in v1.0.16, 1,643 downloads) has no source URL in research.md — need one before this can carry a link.
GDPR: research.md itself flags this as needing re-verification — "The EDPB Guidelines 2/2023 verbatim quotes were confirmed via a faithful mirror because edpb.europa.eu returned 503s at fetch time; re-fetch the official URL to confirm" — so no link is wired up here until that's re-verified against the real edpb.europa.eu URL.

Say on stage: these are the sharpest edge cases, not the norm — most servers aren't malicious, but the tooling to tell the difference (mcp-scan, host-side consent gates) is still young.

Token efficiency

AWS MCP tool description marking the aws___call_aws tool as DEPRECATED in favor of run_script

Chatty MCPs — Early MCPs exposed a full API as one endpoint — AWS's now gets only a deprecation warning baked into the tool description.

Harness tool search loading a single MCP tool on demand

Tool search on harness level — Claude, Codex and orchestrator MCPs responded by loading tools on demand instead of dumping every schema up front.

AWS Agent Toolkit setup dialog with copy-paste instructions for an AI agent

Trend towards skills and CLI — Many small iterations over a folder hierarchy and hooks read as more context-efficient. E.g. AWS's setup prompt plus a small CLI guideline.

Examples from AWS:

https://docs.aws.amazon.com/agent-toolkit/latest/userguide/aws-cli.html

Reproducing big AWS MCP description:

Start with wide access and MFA:

aws sso login

Switch to minimal access role:

read -r AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN < <(
  aws sts assume-role \
    --role-arn arn:aws:iam::327920853133:role/aws-mcp-minimal \
    --role-session-name preparing-for-demo \
    --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' \
    --output text)
export AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN

Verify

env -u AWS_PROFILE aws sts get-caller-identity   # expect .../assumed-role/aws-mcp-minimal/preparing-for-demo

printf 'user = "%s:%s"\n' "$AWS_ACCESS_KEY_ID" "$AWS_SECRET_ACCESS_KEY" | \
curl -sS -N https://aws-mcp.us-east-1.api.aws/mcp -K - \
  --aws-sigv4 "aws:amz:us-east-1:aws-mcp" \
  -H "x-amz-security-token: $AWS_SESSION_TOKEN" \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | jq .

Potential

MCP Apps: The next IDE

Biggest MCP Apps potential is still for technical people.
Human review on low level code will become a bottleneck.
Visualization and interaction is like a high level programming language.

Q&A

MCP Apps: UI in AI

Aurelijus Banelis · aurelijus.banelis.lt