
TL;DR
MCP Apps shipped with the 2026-07-28 final spec - sandboxed interactive UIs for MCP servers. How they compare to standard tool calling and standalone web UIs, and when to use each approach.
Direct answer
MCP Apps shipped with the 2026-07-28 final spec - sandboxed interactive UIs for MCP servers. How they compare to standard tool calling and standalone web UIs, and when to use each approach.
Best for
Developers comparing real tool tradeoffs before choosing a stack.
Covers
Verdict, tradeoffs, pricing signals, workflow fit, and related alternatives.
| Resource | Link | Verified |
|---|---|---|
| MCP Apps Overview | modelcontextprotocol.io/extensions/apps | July 29, 2026 |
| MCP Apps Build Guide | modelcontextprotocol.io/extensions/apps/build | July 29, 2026 |
| MCP Apps Specification | github.com/modelcontextprotocol/ext-apps | July 29, 2026 |
| MCP Apps Examples | github.com/modelcontextprotocol/ext-apps/examples | July 29, 2026 |
| MCP 2026-07-28 Final Specification | modelcontextprotocol.io/specification | July 29, 2026 |
| MCP Apps API Documentation | apps.extensions.modelcontextprotocol.io | July 29, 2026 |
| MCP Client Extension Matrix | modelcontextprotocol.io/extensions/client-matrix | July 29, 2026 |
Last updated: July 29, 2026
The MCP 2026-07-28 final specification shipped yesterday, and with it came MCP Apps - an official extension that lets MCP servers render interactive HTML interfaces directly inside host applications like Claude Desktop, VS Code, and Microsoft 365 Copilot.
This is a new capability in the MCP ecosystem, and it introduces a third option for how MCP servers interact with users. Previously you had two choices: standard tool calling (text in, structured data out) or building a standalone web app. MCP Apps adds a middle path: sandboxed, interactive UIs that live inside the conversation.
This post compares all three approaches so you can decide which one to use for your next MCP server.
MCP Apps shipped as an official extension with the 2026-07-28 final specification:
The original MCP interaction model. The server declares tools with JSON Schema input/output definitions. The LLM decides when to call them. Results come back as text, structured data, or inline images.
User -> LLM decides -> Server tool call -> Structured response -> LLM formats -> User reads
Tools declare a UI resource reference in _meta.ui.resourceUri. The host preloads the UI, renders it in a sandboxed iframe, and establishes bidirectional JSON-RPC communication. The app can call tools, receive data updates, and send context back to the model.
User -> LLM decides -> Server returns tool result + UI reference -> Host renders UI in iframe -> User interacts -> App calls tools via host -> Results update in-place
No MCP integration at all. Build a separate web application with its own API, authentication, and state management. Send the user a link.
User -> Clicks link -> Opens new tab -> Standalone app loads -> User interacts -> Separate API calls -> Results in separate window
| Dimension | Standard Tool Calling | MCP Apps | Standalone Web App |
|---|---|---|---|
| Setup complexity | Low - declare JSON Schema, implement handler | Medium - build HTML UI + tool declaration | High - full app with routing, auth, API, state |
| User experience | Text/structured data only | Interactive UI in conversation | Full web app in separate tab |
| Context preservation | Full - results stay in chat | Full - UI lives inline in chat | Lost - user leaves conversation |
| Bidirectional data | Not supported | Yes - app calls tools, host pushes data | Via separate API layer |
| Security | Server returns data, LLM interprets | Sandboxed iframe - host controls capabilities | Standard web security model |
| State management | Stateless per tool call | App state persists in iframe | Full app-level state |
| Auth required | MCP transport auth | MCP transport auth + host capability consent | Separate auth system |
| Maintenance | Minimal - schema and handler | Medium - UI code + tool handler | Full application lifecycle |
| Host client support | All MCP clients | Claude Desktop, VS Code, M365 Copilot, Goose, Postman, Archestra.AI | All web browsers |
| Best for | Simple data queries, file ops, API wrappers | Interactive dashboards, multi-step forms, rich media previews | Full-featured products that exist outside agent context |
Newsletter
Get the weekly deep dive
Tutorials on Claude Code, AI agents, and dev tools, delivered free every week.
From the archive
Jul 29, 2026 • 10 min read
Jul 29, 2026 • 8 min read
Jul 28, 2026 • 7 min read
Jul 28, 2026 • 9 min read
Standard tool calling should be your default for any MCP server. It is the simplest to build, works across every MCP client, and handles most use cases well. Use it when:
Examples: search tools, file readers, code analysis tools, API wrappers, database query tools.
MCP Apps shine when your tool produces output that benefits from interactivity, and that interactivity benefits from living inside the conversation. Use MCP Apps when:
Examples from the official repository: map-server (CesiumJS globe), cohort-heatmap-server, pdf-server, system-monitor-server, budget-allocator-server.
Standalone web apps remain the right choice when the capability is a product, not a tool. Use standalone when:
Examples: analytics platforms, project management tools, CI/CD dashboards, design tools.
The MCP Apps extension uses a familiar pattern. Your server declares a tool with a _meta.ui.resourceUri field pointing to an HTML resource:
// Server-side tool declaration with MCP Apps support
server.setRequestHandler('tools/call', async (request) => {
if (request.params.name === 'query-analytics') {
const data = await fetchAnalytics(request.params.arguments);
return {
content: [{
type: 'text',
text: `Found ${data.length} records. Opening interactive view.`
}],
_meta: {
ui: {
resourceUri: 'ui://analytics-dashboard',
permissions: ['tools/call']
}
}
};
}
});
The host preloads the ui://analytics-dashboard resource, which returns an HTML page that renders inside a sandboxed iframe. The app communicates with the host through JSON-RPC over postMessage:
// Inside the MCP App iframe
const app = new App({
transport: new PostMessageTransport(window.parent),
});
// Request fresh data through the host's MCP connection
const result = await app.request('tools/call', {
name: 'get-analytics-data',
arguments: { view: 'monthly' }
});
// Update the UI with new data
renderChart(result.data);
The App SDK handles message routing, tool call proxying through the host, and capability consent. The host validates permissions before forwarding tool calls.
MCP Apps is an extension, not a core spec feature. Host support varies. At launch (July 28, 2026):
| Host | MCP Apps Support | Notes |
|---|---|---|
| Claude Desktop | Yes | Full sandboxed iframe rendering |
| VS Code (GitHub Copilot) | Yes | Renders in Copilot Chat |
| Microsoft 365 Copilot | Yes | Enterprise integration |
| Goose | Yes | Open source agent |
| Postman | Yes | API development tool |
| Archestra.AI | Yes | AI orchestration platform |
| Claude Code (CLI) | Not at launch | Terminal-only, no iframe support |
| Cursor | Not at launch | TBD on roadmap |
| Zed | Not at launch | TBD on roadmap |
If you need to support hosts without MCP Apps, your server should fall back to returning structured data through standard tool calling. The pattern: check the client's capabilities during initialization and serve the appropriate response format.
MCP Apps are not free. The tradeoffs:
For simple use cases, standard tool calling is still the better choice. MCP Apps add power at the cost of complexity. Evaluate whether the interactivity benefit justifies the additional surface area before adopting it.
MCP Apps is an official extension to the Model Context Protocol that shipped with the 2026-07-28 specification. It lets MCP servers return interactive HTML interfaces that render inside host applications like Claude Desktop and VS Code. The apps run in sandboxed iframes and communicate bidirectionally with the host through JSON-RPC over postMessage.
Standard tool calling returns text or structured data that the LLM formats. MCP Apps return an interactive HTML UI that renders inline in the conversation. The app can call tools through the host, receive real-time data updates, and maintain persistent state across interactions.
No. MCP Apps is an additive extension. Your existing tools continue to work. You add MCP Apps support by including _meta.ui.resourceUri in tool responses and providing corresponding UI resources. Clients that do not support the extension simply ignore the UI metadata and display the text response.
Claude Desktop, VS Code GitHub Copilot, Microsoft 365 Copilot, Goose, Postman, and Archestra.AI. Claude Code CLI, Cursor, and Zed do not support MCP Apps at launch.
MCP Apps run in a sandboxed iframe with no access to the host's DOM, cookies, or local storage. All communication goes through a postMessage channel that the host controls. The host decides which capabilities (tool calls, etc.) to grant the app based on user consent.
Yes. The official repository provides starter templates for React, Vue, Svelte, Preact, Solid, and vanilla JavaScript. The App class from @modelcontextprotocol/ext-apps is a convenience wrapper, not a requirement - you can implement the postMessage protocol directly.
For more on the MCP ecosystem and the 2026-07-28 specification:
Read next
The MCP 2026-07-28 final spec is here - sessions are gone, the protocol is stateless. Here is what changed, what broke, and how to finish migrating your MCP servers.
9 min readMCP lets AI agents connect to databases, APIs, and tools. Here is what it is and how to use it in your TypeScript projects.
5 min readEverything you need to know about Model Context Protocol - how it works, how to install servers, how to build your own, and the best ones.
12 min readTechnical content at the intersection of AI and development. Building with AI agents, Claude Code, and modern dev tools - then showing you exactly how it works.
Gives AI agents access to 250+ external tools (GitHub, Slack, Gmail, databases) with managed OAuth. Handles the auth and...
View ToolTypeScript-first AI agent framework. Agents, tools, memory, workflows, RAG, evals, tracing, MCP, and production deployme...
View ToolA hosted infinite canvas your headless AI agents drive over MCP. Any MCP-speaking agent - Claude Code, Codex, Cursor, or...
View ToolThe TypeScript toolkit for building AI apps. Unified API across OpenAI, Anthropic, Google. Streaming, tool calling, stru...
View ToolReplay every MCP tool call to find why your agent went sideways.
View AppEvery coding agent in one window. Stop alt-tabbing between Claude, Codex, and Cursor.
View AppSee exactly what your agent did, locally. No cloud, no signup.
View AppConfigure model, tools, MCP, skills, memory, and scoping.
Claude CodeStep-by-step guide to building an MCP server in TypeScript - from project setup to tool definitions, resource handling, testing, and deployment.
AI AgentsDeep comparison of the top AI agent frameworks - LangGraph, CrewAI, Mastra, CopilotKit, AutoGen, and Claude Code.
AI Agents
No-Code AI Automation with VectorShift: Integrations, Pipelines, and Chatbots In this video, I introduce VectorShift, a no-code AI automation platform that enables you to create AI solutions...

Build Anything with Vercel, the Agentic Infrastructure Stack Check out Vercel: https://vercel.plug.dev/cwBLgfW The video shows a behind-the-scenes walkthrough of how the creator rapidly builds and d...

Check out Deep Agent here: https://deepagent.abacus.ai/ In this video, learn how to build a full stack application using Deep Agent, a platform by Abacus AI. We'll create a Twitter clone with...

The MCP 2026-07-28 final spec is here - sessions are gone, the protocol is stateless. Here is what changed, what broke,...

MCP lets AI agents connect to databases, APIs, and tools. Here is what it is and how to use it in your TypeScript projec...

Everything you need to know about Model Context Protocol - how it works, how to install servers, how to build your own,...

A step-by-step guide to building Model Context Protocol servers in TypeScript. Project setup, tool registration, resourc...

Claude Code, Claude Desktop, Cursor, VS Code, Zed, and opencode all speak MCP differently. Here is how their transport,...

A practical comparison of the four authentication platforms developers reach for when connecting AI agents to third-part...

New tutorials, open-source projects, and deep dives on coding agents - delivered weekly.