What are MCP Apps?

Standard MCP tool results are text, images or structured data. MCP Apps extends this so a tool can return an interactive interface the user manipulates directly. It began as proposal SEP-1865, building on the community MCP-UI project and OpenAI's Apps SDK, and became the first official MCP extension in January 2026, maintained in the ext-apps repository with its own specification (revision 2026-01-26) — an extension to the core spec, not part of the base protocol.

The mechanics:

• Servers declare UI templates as resources using the ui:// URI scheme and associate them with tools through tool metadata.
• Because templates are declared ahead of time, hosts can prefetch, cache and security-review them before anything renders.
• The host renders the HTML in a sandboxed iframe; the embedded UI and host communicate bidirectionally over MCP's JSON-RPC base protocol.

Clients including ChatGPT, Claude, Goose and Visual Studio Code have shipped support. For platform teams, MCP Apps widens what a server delivers into the client from data to executable UI. The sandboxed iframe and pre-declared templates are the spec's containment mechanisms, but an app's interactions still flow through MCP — a UI can trigger tool calls on the user's behalf, which makes the served templates and the tools they can invoke part of the review surface when assessing a server.

PolicyLayer's gateway evaluates tools/call traffic regardless of whether a call originates from a model's decision or from a user interacting with an MCP App — the policy check sits in the protocol path, not in the client UI. Server scanning and the catalogue at policylayer.com/tools give teams visibility into what a server exposes before its tools, with or without embedded UI, reach their fleet.