MCP Apps on the 2026-07-28 stateless core
client request
POST /mcp
MCP-Protocol-Version
Mcp-Method + Mcp-Name
params._meta
protocolVersion
clientCapabilities.extensions
io.modelcontextprotocol/ui
server/discover
then tools/list, tools/call,
resources/read
never sent
initialize
Mcp-Session-Id
standalone GET stream
MCP App server
server/discover
advertise tools, resources, UI
tools/list
_meta.ui.resourceUri
ui://notes/timeline.html
tools/call
text + structuredContent
resources/list + read
HTML + CSP + permissions
ttlMs + cacheScope
every result
resultType: complete
serverInfo in result _meta
host sandbox and App
sandboxed iframe
host controls browser powers
deny-first CSP
minimum origins and permissions
postMessage JSON-RPC
exact targetOrigin
validate event.origin
ui/initialize
Apps bridge only
not core MCP initialization
tools/call bridge
host consent, then a new
self-contained MCP request
This protocol model plugs into Lesson 09's full Streamable HTTP adapter.