1.2.2

What's Changed

• fix(schemas): import from zod/v4 to match SDK's zod API by @ochafik in #548
• chore: bump ext-apps to 1.2.2 by @ochafik in #549

Full Changelog: v1.2.1...v1.2.2

1.2.1

What's Changed

• test: exclude screenshot-gen from default E2E run; wire pdf-server tests by @ochafik in #537
• fix(build): copy schema.json to dist and externalize zod by @ochafik in #534
• ci: use npm ci with caching, validate typedoc links, align Node versions by @ochafik in #533
• fix: pre-commit stages only originally-staged files; add .npmrc by @ochafik in #538
• fix(deps): drop @hono/node-server override to patch GHSA-wc8c-qw6v-h7f6 by @ochafik in #535
• fix(ci): require maintainer association for /update-snapshots trigger by @ochafik in #532
• fix: skip debug log for high-frequency tool-input-partial notifications by @antonpk1 in #546
• fix: theme-aware README logo + docs preview CI by @localden in #545
• fix: bundle SDK+zod in react-with-deps (was byte-identical to ./react) by @ochafik in #539
• test(e2e): fix no-op security injection test via frames[] traversal by @ochafik in #540
• chore: bump ext-apps to 1.2.1 by @ochafik in #547

Full Changelog: v1.2.0...v1.2.1

1.2.0

Changes since 1.1.2:

Features

• feat: add readServerResource() and listServerResources() API to App (#470, #528)

Fixes

• fix: replace platform-specific optionalDependencies with bun devDependency (#518)
• fix: autoResize reporting viewport height when content is taller (#525)
• fix: remove duplicate --color-text-ghost from McpUiStyleVariableKey (#523)
• fix: examples servers' npm run start:stdio (#507)
• fix: work around tsx watch hang on Windows in quickstart (#428)

Refactors

• refactor: remove unnecessary type assertions (#471)
• refactor: replace deprecated RESOURCE_URI_META_KEY with modern format (#457)

Examples & Plugin

• pdf-server: ignore client roots by default (#510)
• plugin: refactor create-mcp-app skill to reference patterns.md (#416)

Docs

• docs: add Security documentation section and SEO improvements (#524)
• docs: add MCP client configuration examples to CONTRIBUTING.md (#508, #526)
• docs: use apps.extensions.modelcontextprotocol.io domain for docs URLs (#499)
• docs: add SECURITY.md with GitHub Security Advisories guidance (#472)

Full Changelog: v1.1.2...v1.2.0

1.1.2

What's Changed

• pdf-server: robust path validation + folder/file root support by @ochafik in #497
• feat: add ui/download-file method for host-mediated file downloads by @antonpk1 in #475
• ci: auto-fix prettier formatting in pre-commit hook and CI by @ochafik in #498
• fix: sync local SDK build into node_modules for examples by @ochafik in #504
• chore: bump ext-apps to 1.1.2 by @ochafik in #503

Full Changelog: v1.1.1...v1.1.2

1.1.1

What's Changed

• fix: add audio/video support for basic-host by @Avcharov in #460
• Adding ChatGPT to the readme by @conorkel in #486
• fix(pdf-server): remove page-loading overlay by @ochafik in #493
• pdf-server: remove domain allowlist, require HTTPS only by @ochafik in #487
• ci: add missing examples to deploy workflows by @ochafik in #494
• Add MCPB packaging and Claude Code plugin for pdf-server by @bryan-anthropic in #491
• ci: build and publish MCPB bundle for pdf-server by @ochafik in #495
• Set audioSession.type to playback in sheet music app by @mel-anthropic in #489
• chore: bump ext-apps to 1.1.1 by @ochafik in #496

Full Changelog: v1.1.0...v1.1.1

1.1.0

What's Changed

• Fix: registerAppResource does not return registered resource, but void by @KKonstantinov in #370
• Use escaped newlines in ShaderToy README JSON examples by @jonathanhefner in #375
• Fix extractRegion() matching region names that are substrings of others by @jonathanhefner in #376
• Improve patterns guide with concrete examples and safe area insets by @jonathanhefner in #381
• feat(pdf-server): send screenshot to updateModelContext by @ochafik in #373
• Separate static and dynamic data in system-monitor-server tools by @jonathanhefner in #388
• docs: add root npm install step for basic-host setup by @GiladShoham in #371
• Add polling pattern to patterns guide by @jonathanhefner in #389
• Add binary blob resource pattern to patterns guide by @jonathanhefner in #391
• Add server-side persistence guidance to view state pattern by @jonathanhefner in #397
• examples: add MCP Apps arcade server by @idosal in #346
• examples: add arcade example to servers by @idosal in #399
• docs: fix basic-host setup instructions in quickstart by @rafa-thayto in #398
• Improve global.css as scaffolding template by @jonathanhefner in #403
• Improve documentation for CSP and permissions types by @jonathanhefner in #409
• Improve example CSS files to better demonstrate host style integration by @jonathanhefner in #404
• Extract getUiCapability example to type-checked examples file by @jonathanhefner in #406
• examples: remove arcade by @idosal in #414
• Cache full PDF bodies from servers without Range support by @ochafik in #411
• Add CSP and CORS section to patterns docs by @jonathanhefner in #415
• Add isToolVisibilityModelOnly and isToolVisibilityAppOnly helper functions by @matteo8p in #294
• Use escaped double quotes in npm scripts for Windows compatibility by @jonathanhefner in #421
• Replace "external" with "network" in CSP documentation by @jonathanhefner in #422
• Clarify spec and SDK: accept UIResourceMeta in both resources/list and resources/read by @ochafik in #410
• Rename skill to 'create-mcp-app' to align with spec by @vgshenoy in #443
• Rename migrate-oai-app skill name to align with spec by @jonathanhefner in #444
• Handle non-JSON-RPC messages gracefully in PostMessageTransport by @ochafik in #448
• Update theme toggle button position in CSS from top to bottom by @healthkowshik in #441
• fix: align basic-host dark mode styles by @Avcharov in #438
• Change Host <> Sandbox communication protocol to "SHOULD" by @mstoiber-oai in #435
• Upgrade GitHub Actions to latest versions by @salmanmkc in #393
• Upgrade GitHub Actions for Node 24 compatibility by @salmanmkc in #392
• Apply typedoc-github-theme typography fixes locally via customCss by @jonathanhefner in #442
• Add validation for callServerTool params argument by @ochafik in #449
• fix: update e2e test snapshots for shadertoy and wiki-explorer images by @Avcharov in #461
• README update by @localden in #463
• Upgrade typedoc-github-theme to v0.4.0 and remove local CSS workaround by @jonathanhefner in #462
• Add double-connect guard to prevent protocol message handling errors by @ochafik in #450
• Add PDF search feature to pdf-server by @ochafik in #445
• Add fullscreen button to threejs-server by @ochafik in #446
• feat(pdf-server): use MCP roots to auto-allow local directories by @ochafik in #479
• Lead README with agent skills for faster onboarding by @localden in #478
• Update README.md by @localden in #483
• pdf: ignore safe area insets in fullscreen mode by @ochafik in #484
• feat(pdf-server): lazy range-based loading + eager background preloading by @ochafik in #480
• chore: bump ext-apps to 1.1.0 by @ochafik in #485

Full Changelog: v1.0.1...v1.1.0

1.0.1

What's Changed

• docs: update MCP-UI SDK description in README by @idosal in #365
• fix(qr-server): use stable mcp SDK from PyPI by @malbari in #360
• fix(say-server): pin to released mcp version by @ochafik in #366
• chore: bump to 1.0.1 - fix npm reference for ext-apps dependency in examples + update zod to 4.x by @ochafik in #368
• chore: bump ext-apps to 1.0.1 by @ochafik in #369

Full Changelog: v1.0.0...v1.0.1

1.0.0

stable spec release 2026-01-26 and SDK v1.0.0 by @ochafik in #362

v0.4.2

Release 0.4.2

Features

• say-server: New streaming Pocket TTS example with karaoke-style word highlighting (#304)
• debug-server: Interactive debug server for development and troubleshooting (#321)
• Theme support in basic-host: Theme toggle and MCP style CSS variables for consistent styling (#336)
• getUiCapability helper: New helper function for capability negotiation between views and hosts (#313)
• Visibility optimization: Three.js and Shadertoy examples now pause rendering when hidden (#297, #299)
• Mouse/touch interaction: Proper input support for Shadertoy shaders (#293)
• SSE transport fallback: basic-host now supports Server-Sent Events transport (#289)
• map-server screenshot: Screenshot capture via updateModelContext (#340)

Documentation

• Quickstart guide: Rewritten with type-checked code examples (#342)
• MCP Apps Overview: New comprehensive overview document (#343)
• Patterns guide: Common patterns for MCP Apps development (#314)
• Testing guide: How to test MCP Apps (#350)
• Agent Skills guide: Installation and usage guide (#344, #352)
• MCP client configuration: Added config examples to all READMEs (#286)
• Type-checked JSDoc examples: Examples moved to .examples.ts files for type safety (#302)
• OpenAI migration guide: Improved accuracy and readability (#345, #349)

Fixes

• Align spec permissions type with SDK implementation (#305)
• Python server dependency resolution and Docker host validation (#333)
• Serve HTTP now runs main.ts instead of server.ts (#315)
• Embed widget HTML in QR server example (#317)
• Standardize UI terminology to use "view" consistently (#325, #339)
• Update Map Server display name to CesiumJS Map Server (#324)
• Test stability and developer experience improvements (#337)
• Fix onhostcontextchanged handler invocation in examples (#351)

Other

• Add .claude-plugin/marketplace.json for plugin distribution (#306)
• Add "Migrate from OpenAI App" skill to Claude Code plugin (#290)
• Use typedoc-github-theme for API documentation (#322)
• Add Codex and Goose to supporting clients documentation (#357)
• EXAMPLE=folder-name support for running specific examples (#292)

New Contributors

• @malbari made their first contribution in #315
• @tobinsouth made their first contribution in #317

Full Changelog: v0.4.1...v0.4.2

0.4.1

What's Changed

• revert to document.write again; cesiumjs doesn't like srcdoc, period. by @ochafik in #258
• basic-host: filter app-only tools, prioritize UI tools by @ochafik in #262
• feat: add example gallery with auto-generated screenshots by @ochafik in #253
• docs: how to migrate from openai apps by @ochafik in #260
• build(deps): bump hono from 4.11.3 to 4.11.4 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #268
• Add "Server-Side" section to OpenAI migration guide by @jonathanhefner in #263
• Improve JSDoc comments with cross-references and clarifications by @jonathanhefner in #254
• chore: update licensing to Apache 2.0 for new contributions by @domdomegg in #251
• disambiguate resource in csp sample by @idosal in #257
• Add Claude Code plugin with "Create MCP App" skill by @jonathanhefner in #256
• Improve consistency and organization of examples for AI learning by @jonathanhefner in #252
• examples: add PDF viewer w/ chunked data loading, full-screen, model context updates, private tool by @ochafik in #267
• examples[pdf]: limit context length by @ochafik in #270
• fix(examples): improve updateModelContext with structured YAML frontmatter by @ochafik in #271
• feat(basic-host): URL params, fullscreen mode, unified layout by @ochafik in #266
• feat: compile example servers to JavaScript for npm consumption by @jerome3o-anthropic in #259
• Use Tool as the input type in getToolUiResourceUri by @matteo8p in #274
• fix: change unknown source message log from error to debug level by @Copilot in #239
• fix[examples/transcript]: fix transitional deltas by @ochafik in #275
• pdf-server: fix scrolling gap in inline mode by @ochafik in #280
• fix(examples): resolve DIST_DIR path for npm package execution by @ochafik in #277
• feat(shadertoy): add fullscreen support + ditch insets for max visual effect by @ochafik in #278
• feat(shadertoy): show fullscreen button only on widget hover by @ochafik in #281
• feat(qr-server): migrate to uv with PEP 723 inline dependencies by @antonpk1 in #272
• chore: bump version to 0.4.1 by @ochafik in #282

New Contributors

• @dependabot[bot] made their first contribution in #268
• @domdomegg made their first contribution in #251
• @Copilot made their first contribution in #239

Full Changelog: v0.4.0...v0.4.1