The stateless /:slug/mcp handler creates a fresh McpServer and
StreamableHTTPServerTransport on every request but never closed them,
leaking memory under load. Register a 'close' listener (fires on both
normal completion and client abort mid-SSE) to release them.
- Bump @modelcontextprotocol/ext-apps from ^1.1.0 to ^1.1.1
- Bump all @modelcontextprotocol/server-* packages from ^1.1.0 to ^1.1.1
- Add new @modelcontextprotocol/server-debug package at ^1.1.1
- Wire up debug server in example-apps module at /debug/mcp
Remove bearer auth middleware from all /:slug/mcp routes (pdf, map, etc.)
so they are publicly accessible without an OAuth token. The root /mcp
endpoint retains its existing bearer auth requirement.
https://claude.ai/code/session_019bG1wzY84JA7LbpkybddP9
- Update @modelcontextprotocol/ext-apps to ^1.0.1
- Update all @modelcontextprotocol/server-* packages to ^1.0.1
- Pin @modelcontextprotocol/sdk to 1.24.2 to avoid SDK upgrades from transitive deps
- Pin @types/express-serve-static-core to 5.1.0 for type compatibility
Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%)
Claude-Steers: 1
Claude-Permission-Prompts: 0
Claude-Escapes: 0
Add INFO-level logging to both the stateful SHTTP handler and the
stateless example-apps handler to show the full client capabilities
sent during MCP initialization, including any extensions like
io.modelcontextprotocol/ui.
This helps verify that clients are correctly sending UI extension
capabilities during the initialization handshake.
Remove trailing slash from baseUri before constructing example server
URLs to avoid URLs like "example.com//budget-allocator/mcp".
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Each MCP App example server now has a copy button that copies the
full URL (including domain) to clipboard for easy pasting into Claude.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The MCP server packages require Node 20.11+ due to use of
import.meta.filename. This .nvmrc ensures developers use the
correct Node version.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Address PR feedback:
- Remove session store and session management
- Use stateless mode (sessionIdGenerator: undefined)
- Each request creates a fresh server instance
- Remove user-controlled format string in error message
- Simplify handler logic significantly
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Wire up 13 MCP Apps servers from the @modelcontextprotocol/server-* packages:
- budget-allocator: Interactive budget allocation UI
- cohort-heatmap: Customer retention heatmap
- customer-segmentation: Scatter chart with clustering
- map: Interactive 3D globe viewer (CesiumJS)
- pdf: Interactive PDF viewer
- scenario-modeler: SaaS business projections dashboard
- shadertoy: Real-time GLSL shader renderer
- sheet-music: ABC notation to sheet music visualizer
- system-monitor: Real-time OS metrics display
- threejs: 3D scene renderer
- transcript: Live speech transcription
- video-resource: Binary video streaming via MCP resources
- wiki-explorer: Wikipedia link graph visualization
Each server is mounted at /{slug}/mcp and shares the same OAuth
authentication as the main MCP server.
Also updates the splash page to dynamically list all available
example servers.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Update @modelcontextprotocol/ext-apps to 0.4.0
- Use new nested format `_meta.ui.resourceUri` in tool definition
- Remove resourceUri from tool result (only needed in tool definition)
- Add example structuredContent and _meta in tool result for demo
Include the MCP Apps UI resource in the resources list so clients
can discover it via resources/list.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Implements a simple MCP Apps tool that returns an interactive React UI:
- Add `mcp_apps_hello_world` tool with `_meta.ui/resourceUri` metadata
- Add resource handler for `ui://hello-world/app.html` returning HTML
- Create React app using `@modelcontextprotocol/ext-apps/react` hooks
- Add Vite build tooling to bundle React apps into single HTML files
The tool demonstrates the MCP Apps extension (SEP-1865) which allows
MCP servers to return interactive UI that runs in the client.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Replace the pkg.pr.new preview URL (PR #1189) with the official npm
release now that the changes have been merged and published.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add dev-with-mitm.sh for TUI-based traffic inspection
- Add dev-with-mitmweb.sh for web UI-based traffic inspection
- Fix missing 'id' field in JSON-RPC error responses (required by spec)
- Migrate from zod-to-json-schema to Zod v4's native z.toJSONSchema()
The mitmproxy scripts help developers debug MCP traffic by running
the server through a reverse proxy that intercepts all client requests.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Updated demo tools count from 7 to 8 and added elicitations to the feature list
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add rate limiting to prevent DoS attacks on vulnerable routes
- Update package-lock.json to use public npm registry
- Document intentionally permissive CORS for public test server
- Remove health endpoints to match original codebase (no health checks)
- Fix auth server splash page to list all OAuth endpoints
- Update test scripts to check server availability via splash page
