On January 26, 2026, the Model Context Protocol maintainers launched MCP Apps, the first official MCP extension. It lets an MCP tool return an interactive user interface, such as a chart, form or dashboard, that the host renders directly in the conversation. Claude, ChatGPT, Visual Studio Code Insiders and goose supported it at launch. The release matters because it replaces two incompatible approaches to agent UIs with one standard, so a server author can build an interface once and have it work across hosts.

Key Facts#

  • Launch date: January 26, 2026, announced by the MCP core maintainers. Version 1.0.0 of the @modelcontextprotocol/ext-apps npm package was published the same day.
  • Status: The first official MCP extension, layered on top of the core protocol rather than added to it.
  • How it works: UI templates are declared as resources with the ui:// scheme, rendered in sandboxed iframes, and talk to the host through JSON-RPC messages sent over postMessage.
  • Launch clients: Claude on the web and desktop, ChatGPT (rolling out that week), VS Code Insiders and goose.
  • Lineage: The extension standardizes patterns pioneered by the community MCP-UI project and OpenAI's Apps SDK. Both projects remain active, and migrating to the official extension is optional.
  • Origin: The design was proposed in November 2025 as SEP-1865 by contributors from Anthropic, OpenAI and MCP-UI.

What Happened#

Until MCP Apps, a tool could return text, structured data or links, and the model had to describe results in prose. That works for simple answers but not for tasks where people need to compare, filter or approve something. The launch post describes MCP Apps as a way for tools to return interactive components rendered in the conversation, so users can work with dashboards, forms and multi-step workflows without typing more prompts.

The mechanism is deliberately conservative. A server declares its UI templates up front as resources under the ui:// scheme, bundling the HTML and JavaScript each one needs. When a tool linked to a template runs, the host loads that bundle in a sandboxed iframe with restricted permissions. The UI and the host then exchange JSON-RPC messages over the browser's postMessage channel. That lets the interface update when new data arrives and ask the host to call tools on the user's behalf.

The maintainers listed four layers of protection: iframe sandboxing, pre-declared templates that hosts can review before rendering, auditable JSON-RPC messages, and optional user consent before a UI can trigger a tool call. Early supporters were quoted in the announcement. Andrew Harvard of Block said the extension "puts humans at the center," and JetBrains' Denis Shiryaev said that "text and structured data only gets you so far when developers want rich, interactive tooling."

Background#

Interactive UIs in agent conversations did not start with MCP Apps. The community MCP-UI project had shown how an MCP server could ship interface components, and OpenAI built its Apps SDK for ChatGPT on MCP with its own conventions for rendering app interfaces. Each approach worked, but a host that wanted to support both had to build separate rendering logic, and a server author had to pick a target.

In November 2025, contributors from Anthropic, OpenAI and MCP-UI proposed a unified design as SEP-1865, with an early-access SDK. The proposal named fragmentation as the core problem and set out the ui:// resources, tool-to-template links, sandboxed iframes and postMessage messaging that shipped in January. Our story on OpenAI adopting MCP covers how the Apps SDK came to be built on the protocol in the first place.

The launch also established the extension model itself. In a March 2026 post, the maintainers described extensions as strictly additive and optional, so a client that does not understand an extension simply ignores it and keeps baseline behavior.

Why It Matters for Developers#

For .NET developers building MCP servers, the C# SDK now ships a ModelContextProtocol.Extensions.Apps package for building interactive UI applications that render inside MCP hosts, alongside the core packages covered in our MCP in C# guide. The front end itself is a self-contained HTML and JavaScript bundle, so it can be produced with whatever web tooling the team already uses and embedded in the server as a static resource.

The design shifts some responsibilities onto server authors:

  • Design for a human decision, not just a display. The strongest use cases are review and approval steps, such as confirming a refund, choosing among search results or editing a draft before it is sent. That keeps a person in the loop at the moment of risk, a pattern discussed in our AI agent patterns guide.
  • Treat messages from the UI as untrusted input. A UI can ask the host to invoke tools, so server-side tools must still validate arguments and authorize every call. Sandboxing protects the host, not your back end.
  • Apply normal web security discipline. The bundle is web content, so the usual defenses against injection and data leakage apply. Our OWASP Top 10 for .NET guide is a useful checklist.
  • Keep text fallbacks. Because extensions are optional, some clients will never render your UI. Tools should still return useful text or structured content.

The shared standard also lowers the cost of supporting several hosts. A team that previously built a ChatGPT app and a separate Claude integration can now target one specification, which reduces duplicated front-end work.

What's Next#

MCP Apps quickly became the model for how the protocol will grow. When the maintainers published the release candidate for the 2026-07-28 specification in May 2026, they made extensions first-class, with reverse-DNS identifiers, independent versioning and delegated maintainers, and named MCP Apps and Tasks as the two official extensions. The ext-apps npm package has since reached version 2.0.0.

Open questions include how consistently hosts implement consent prompts, how enterprises will review and allowlist UI templates, and how accessible these embedded interfaces will be across clients. As more hosts adopt the extension, those operational details will matter more than the core mechanism.

Sources#