Download Latest Version v1.7.5 source code.zip (16.0 MB)
Email in envelope

Get an email when there's a new version of MCP Apps

Home / v1.7.5
Name Modified Size InfoDownloads / Week
Parent folder
pdf-server.mcpb 2026-07-23 12.8 MB
0
README.md 2026-07-23 2.2 kB
0
v1.7.5 source code.tar.gz 2026-07-23 15.8 MB
0
v1.7.5 source code.zip 2026-07-23 16.0 MB
0
Totals: 4 Items   44.7 MB 0

What's Changed

SDK

  • Preserve experimental capability settings during initialization. McpUiHostCapabilities.experimental and McpUiAppCapabilities.experimental are now typed Record<string, object> instead of {}, and the generated schema no longer strips their contents, by @victor-openai in #721

Specification

  • Add missing HostCapabilities fields by @hydrosquall in #653
  • Sync object-src with default-src by @domfarolino in #715

Examples

  • lazy-auth-server: usable on mobile in #714
  • map-server: fix README and code of conduct links in #657

Docs

  • API Docs link for ext-apps/server in #697
  • Add mcp-use inspector badge to supported clients by @pietrozullo in #650

Security

npm audit goes from 15 findings (2 critical, 7 high, 4 moderate, 2 low) to 3 in #725:

  • shell-quote 1.9.0 (GHSA-w7jw-789q-3m8p, GHSA-395f-4hp3-45gv)
  • @babel/core 7.29.7 (GHSA-4x5r-pxfx-6jf8)
  • sharp ^0.35.3 (GHSA-f88m-g3jw-g9cj; libvips CVE-2026-33327 / 33328 / 35590 / 35591) — devDependency, screenshot tooling only
  • brace-expansion 1.1.16 / 2.1.2, fast-uri 3.1.4, hono 4.12.31, linkify-it 5.0.2, markdown-it 14.3.0, body-parser 2.3.0, plus other transitives

The 3 remaining are all the same advisory (GHSA-frvp-7c67-39w9, path traversal in @hono/node-server's serve-static on Windows), reached through @modelcontextprotocol/sdk's ^1.19.9 pin. It needs an upstream SDK bump, and is not reachable from this SDK, which imports only getRequestListener and serve from that package.

Full Changelog: https://github.com/modelcontextprotocol/ext-apps/compare/v1.7.4...v1.7.5

Source: README.md, updated 2026-07-23