ext-apps 2.0 and the 15 example server packages are built on the MCP
TypeScript SDK 2.0 split packages, so the stateless example mounts in
src/modules/example-apps now connect each server to
NodeStreamableHTTPServerTransport from @modelcontextprotocol/node; the
factory map is typed as the 2.0 McpServer. The rest of this host (OAuth,
the root /mcp handlers, Redis transport) stays on @modelcontextprotocol/sdk
1.29, which installs alongside the 2.0 packages. zod moves to 4 for the
whole tree: ext-apps 2.0 peers on ^4.2.0, sdk 1.29 accepts ^3.25 || ^4.0,
and the host already imports zod/v4. The hello-world View takes
CallToolResult from @modelcontextprotocol/client.
Bumps @modelcontextprotocol/ext-apps and the example server packages to
1.7.5. Notably picks up server-lazy-auth's larger consent-button touch
targets so the /lazy-auth flow is tappable on mobile
(modelcontextprotocol/ext-apps#714).
ext-apps@1.7.x peers on @modelcontextprotocol/sdk ^1.29.0, which
required bumping the pinned sdk from 1.24.2 and adapting to its
StreamableHTTPServerTransport refactor:
- redisTransport: sessionId is now a readonly getter on the Node
wrapper; inject it (and _initialized) on the underlying web-standard
transport so resumed sessions validate. Also guard message.id which
is now optional on JSONRPCMessage.
- shttp.integration.test: handleRequest now routes through
@hono/node-server, so the mock IncomingMessage needs url/host/
rawHeaders/on/off/resume, and the session-id header now arrives via
writeHead instead of setHeader.
- Bump @modelcontextprotocol/ext-apps from ^1.1.0 to ^1.1.1
- Bump all @modelcontextprotocol/server-* packages from ^1.1.0 to ^1.1.1
- Add new @modelcontextprotocol/server-debug package at ^1.1.1
- Wire up debug server in example-apps module at /debug/mcp
- Update @modelcontextprotocol/ext-apps to ^1.0.1
- Update all @modelcontextprotocol/server-* packages to ^1.0.1
- Pin @modelcontextprotocol/sdk to 1.24.2 to avoid SDK upgrades from transitive deps
- Pin @types/express-serve-static-core to 5.1.0 for type compatibility
Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%)
Claude-Steers: 1
Claude-Permission-Prompts: 0
Claude-Escapes: 0
Wire up 13 MCP Apps servers from the @modelcontextprotocol/server-* packages:
- budget-allocator: Interactive budget allocation UI
- cohort-heatmap: Customer retention heatmap
- customer-segmentation: Scatter chart with clustering
- map: Interactive 3D globe viewer (CesiumJS)
- pdf: Interactive PDF viewer
- scenario-modeler: SaaS business projections dashboard
- shadertoy: Real-time GLSL shader renderer
- sheet-music: ABC notation to sheet music visualizer
- system-monitor: Real-time OS metrics display
- threejs: 3D scene renderer
- transcript: Live speech transcription
- video-resource: Binary video streaming via MCP resources
- wiki-explorer: Wikipedia link graph visualization
Each server is mounted at /{slug}/mcp and shares the same OAuth
authentication as the main MCP server.
Also updates the splash page to dynamically list all available
example servers.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Implements a simple MCP Apps tool that returns an interactive React UI:
- Add `mcp_apps_hello_world` tool with `_meta.ui/resourceUri` metadata
- Add resource handler for `ui://hello-world/app.html` returning HTML
- Create React app using `@modelcontextprotocol/ext-apps/react` hooks
- Add Vite build tooling to bundle React apps into single HTML files
The tool demonstrates the MCP Apps extension (SEP-1865) which allows
MCP servers to return interactive UI that runs in the client.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Replace the pkg.pr.new preview URL (PR #1189) with the official npm
release now that the changes have been merged and published.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add rate limiting to prevent DoS attacks on vulnerable routes
- Update package-lock.json to use public npm registry
- Document intentionally permissive CORS for public test server
- Remove health endpoints to match original codebase (no health checks)
- Fix auth server splash page to list all OAuth endpoints
- Update test scripts to check server availability via splash page
- Merge auth-server and mcp-server into unified architecture under src/modules/
- Add configurable auth modes: internal (single process) and external (separate processes)
- Update example scripts to support OAuth discovery and both auth modes
- Consolidate OAuth documentation into comprehensive implementation guide
- Add configuration options for development vs production deployments
- Support both Redis-backed and in-memory session storage
Simplified the repository to have a single OAuth pattern with separate auth and MCP servers at the top level. Preserved embedded OAuth documentation as an alternative pattern.
The package-lock.json contained references to Anthropic's internal
artifactory registry which GitHub Actions cannot access, causing
npm ci to fail. Regenerated with public registry.npmjs.org.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add express-rate-limit to custom endpoints for security:
- /introspect: 100 requests per 5 minutes
- /fakeupstreamauth/*: 20 requests per minute
- Static files: 25 requests per 10 minutes
- Add automated e2e testing npm scripts using concurrently:
- npm run test:e2e:integrated: Auto-starts server and runs test
- npm run test:e2e:separate: Auto-starts both servers and runs test
- Update README with automated testing approach documentation
- Update docs/streamable-http-design.md with current file structure
- Remove redundancy in README e2e testing documentation
- Verified: All tests, linting, and e2e scripts pass with rate limiting
- Created auth-server/index.ts with full OAuth endpoint support
- Reuses EverythingAuthProvider from main server
- Added custom /oauth/introspect endpoint for token validation
- Includes fake upstream auth routes for user authentication
- Added TypeScript configuration for auth server
- Added comprehensive npm scripts for all modes:
- dev:integrated, dev:separate, dev:auth-server
- dev:with-separate-auth (runs both servers)
- build:auth-server, build:all
- Added concurrently dependency for running multiple servers
- Added detailed README for auth server
- Successfully serves OAuth metadata and health endpoints
Refreshed package dependencies to ensure clean installation.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Updated Jest configuration to use ts-jest ESM preset
- Added NODE_OPTIONS flag for experimental VM modules support
- Fixed import statements in all test files to import Jest globals
- Rewrote provider.test.ts to work with ESM (using actual implementations with mock Redis)
- Fixed test expectations to match actual implementation
- Fixed encryption key generation in tests (using proper 64-char hex tokens)
- Standardized token_type to "Bearer" across codebase
- Removed unused imports to fix lint errors
- Excluded scratch folder from test runs
All tests now pass successfully with proper ES module support.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Relocked
