modelcontextprotocol/ext-apps
Watch
1
0
Fork
You've already forked ext-apps
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(types): forbid csp/permissions on McpUiToolMeta via never (#624)

Browse source 
* fix(types): forbid csp/permissions on McpUiToolMeta via never

Hosts read _meta.ui.csp and _meta.ui.permissions from the resource
(resources/read content item, with resources/list entry as fallback),
never from the tool. Typing them as `never` on McpUiToolMeta gives
TypeScript users a compile-time error pointing at McpUiResourceMeta
instead of silently accepting and ignoring them.

Companion to anthropics/apps#38705 (host-side console.warn).
Refs anthropics/claude-ai-mcp#40.

* drop misleading #40 link from McpUiToolMeta.csp JSDoc
This commit is contained in:
Olivier Chafik 2026-04-21 13:49:07 +01:00 • committed by GitHub
commit 4995746759
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 28 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/generated/schema.json generated
View file

@ -5300,6 +5300,12 @@
], ],
"description": "Tool visibility scope - who can access the tool." "description": "Tool visibility scope - who can access the tool."
} }
},
"csp": {
"not": {}
},
"permissions": {
"not": {}
} }
}, },
"additionalProperties": false "additionalProperties": false

11
src/generated/schema.ts generated
View file

@ -730,6 +730,17 @@ export const McpUiToolMetaSchema = z.object({
.describe( .describe(
'Who can access this tool. Default: ["model", "app"]\n- "model": Tool visible to and callable by the agent\n- "app": Tool callable by the app from this server only', 'Who can access this tool. Default: ["model", "app"]\n- "model": Tool visible to and callable by the agent\n- "app": Tool callable by the app from this server only',
), ),
/**
* `csp` belongs on the UI **resource** (see {@link McpUiResourceMeta}),
* not the tool. Hosts read it from the `resources/read` content item
* (with `resources/list` entry as fallback) and ignore it here.
*/
csp: z.never().optional(),
/**
* `permissions` belongs on the UI **resource** (see {@link McpUiResourceMeta}),
* not the tool. Hosts ignore it here.
*/
permissions: z.never().optional(),
}); });
/** /**

11
src/spec.types.ts
View file

@ -783,6 +783,17 @@ export interface McpUiToolMeta {
* - "app": Tool callable by the app from this server only * - "app": Tool callable by the app from this server only
*/ */
visibility?: McpUiToolVisibility[]; visibility?: McpUiToolVisibility[];
/**
* `csp` belongs on the UI **resource** (see {@link McpUiResourceMeta}),
* not the tool. Hosts read it from the `resources/read` content item
* (with `resources/list` entry as fallback) and ignore it here.
*/
csp?: never;
/**
* `permissions` belongs on the UI **resource** (see {@link McpUiResourceMeta}),
* not the tool. Hosts ignore it here.
*/
permissions?: never;
} }
/** /**