Add INFO-level logging to both the stateful SHTTP handler and the
stateless example-apps handler to show the full client capabilities
sent during MCP initialization, including any extensions like
io.modelcontextprotocol/ui.
This helps verify that clients are correctly sending UI extension
capabilities during the initialization handshake.
Remove trailing slash from baseUri before constructing example server
URLs to avoid URLs like "example.com//budget-allocator/mcp".
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Each MCP App example server now has a copy button that copies the
full URL (including domain) to clipboard for easy pasting into Claude.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The MCP server packages require Node 20.11+ due to use of
import.meta.filename. This .nvmrc ensures developers use the
correct Node version.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Address PR feedback:
- Remove session store and session management
- Use stateless mode (sessionIdGenerator: undefined)
- Each request creates a fresh server instance
- Remove user-controlled format string in error message
- Simplify handler logic significantly
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Wire up 13 MCP Apps servers from the @modelcontextprotocol/server-* packages:
- budget-allocator: Interactive budget allocation UI
- cohort-heatmap: Customer retention heatmap
- customer-segmentation: Scatter chart with clustering
- map: Interactive 3D globe viewer (CesiumJS)
- pdf: Interactive PDF viewer
- scenario-modeler: SaaS business projections dashboard
- shadertoy: Real-time GLSL shader renderer
- sheet-music: ABC notation to sheet music visualizer
- system-monitor: Real-time OS metrics display
- threejs: 3D scene renderer
- transcript: Live speech transcription
- video-resource: Binary video streaming via MCP resources
- wiki-explorer: Wikipedia link graph visualization
Each server is mounted at /{slug}/mcp and shares the same OAuth
authentication as the main MCP server.
Also updates the splash page to dynamically list all available
example servers.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Update @modelcontextprotocol/ext-apps to 0.4.0
- Use new nested format `_meta.ui.resourceUri` in tool definition
- Remove resourceUri from tool result (only needed in tool definition)
- Add example structuredContent and _meta in tool result for demo
Include the MCP Apps UI resource in the resources list so clients
can discover it via resources/list.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Implements a simple MCP Apps tool that returns an interactive React UI:
- Add `mcp_apps_hello_world` tool with `_meta.ui/resourceUri` metadata
- Add resource handler for `ui://hello-world/app.html` returning HTML
- Create React app using `@modelcontextprotocol/ext-apps/react` hooks
- Add Vite build tooling to bundle React apps into single HTML files
The tool demonstrates the MCP Apps extension (SEP-1865) which allows
MCP servers to return interactive UI that runs in the client.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Replace the pkg.pr.new preview URL (PR #1189) with the official npm
release now that the changes have been merged and published.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add dev-with-mitm.sh for TUI-based traffic inspection
- Add dev-with-mitmweb.sh for web UI-based traffic inspection
- Fix missing 'id' field in JSON-RPC error responses (required by spec)
- Migrate from zod-to-json-schema to Zod v4's native z.toJSONSchema()
The mitmproxy scripts help developers debug MCP traffic by running
the server through a reverse proxy that intercepts all client requests.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Updated demo tools count from 7 to 8 and added elicitations to the feature list
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add rate limiting to prevent DoS attacks on vulnerable routes
- Update package-lock.json to use public npm registry
- Document intentionally permissive CORS for public test server
- Remove health endpoints to match original codebase (no health checks)
- Fix auth server splash page to list all OAuth endpoints
- Update test scripts to check server availability via splash page
- Merge auth-server and mcp-server into unified architecture under src/modules/
- Add configurable auth modes: internal (single process) and external (separate processes)
- Update example scripts to support OAuth discovery and both auth modes
- Consolidate OAuth documentation into comprehensive implementation guide
- Add configuration options for development vs production deployments
- Support both Redis-backed and in-memory session storage
Adds a new elicitInputs tool that demonstrates how to use MCP's elicitation
feature to request user input. The tool showcases various input field types
including strings, booleans, emails, dates, numbers, and enums. This allows
clients to interactively collect structured user input during tool execution.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Add documentation explaining that SSE transport requires /sse endpoint
and Streamable HTTP requires /mcp endpoint. This is a common mistake
when using MCP Inspector.
- Create docs/customization-guide.md with guidance on replacing demo functionality
- Add customization section to main README
- Fix all references to renamed oauth-architecture-patterns.md
- Update repository structure comments to clarify what to replace vs keep
Consolidate three redundant 'Production Replacement' sections into
a single canonical location in docs/oauth-architecture-patterns.md.
Both server READMEs now point to this guide.
- Add /health endpoint to docs/endpoints.md for MCP server
- Document degraded mode behavior in Common Issues section
- Update OAuth metadata endpoint to mention 503 responses
- Rename oauth-patterns.md to oauth-architecture-patterns.md for clarity
- Fix session-ownership.md test commands to run from mcp-server directory
- Update redisTransport.ts path reference to include mcp-server prefix
