MCP Apps on the Stateless Protocol
An interactive result is still an MCP tool and resource exchange. The 2026-07-28 core makes that exchange self-contained, while the Apps extension adds the sandboxed browser surface. Advertise MCP Apps through server/discover and per-request extension capabilities. Declare a ui:// resource on a tool before the tool is called. Return complete tool and resource results on the 2026-07-28 stateless wire. Separate the Apps ui/initialize bridge message from the removed MCP core handshake. Apply origin validation, sandboxing, CSP, and least-privilege permissions. A text result can describe a timeline. It cannot give the user a timeline they can filter, inspect, or act on. MCP Apps solves the presentation problem with an optional extension. A tool definition points to a ui:// resource. The host can fetch and review that resource before the tool runs, render it in a sandboxed iframe, and mediate all app actions through a JSON-RPC bridge. The core protocol changed in 2026-07-28. Do not wrap an App in the old connection lifecycle: There is no core initialize request or notifications/initialized notification. There is no Mcp-Session-Id header. Every request carries protocol version and client capabilities in params.meta. A server implements server/discover so clients can inspect versions, core capabilities, and extensions. Every successful result has a resultType discriminator. Streamable HTTP uses one POST per request. Modern GET and DELETE entrypoints return 405. The…
MCP Apps on the Stateless Protocol: An interactive result is still an MCP tool and resource exchange. The 2026-07-28 core makes that exchange self-contained,…
This free lesson is part of the AI Engineering from Scratch curriculum. Read the full explanation, run the lesson code, and verify the result in the interactive reader or from the repository source.
Browse the complete course catalog or open this lesson on GitHub.