npm / @modelcontextprotocol/ext-apps
@modelcontextprotocol/ext-apps
What changed in @modelcontextprotocol/ext-apps 1 to 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.
13 breaking5 security6 deprecations16 new APIs and options6 behavior and defaults28 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@modelcontextprotocol/ext-apps 222 changes
Breaking changes 9
The guard now also rejects registrations for notifications/progress and notifications/cancelled with an already registered error.
The 21 published example packages now declare a Node.js engine requirement of >=20, matching the root package and README.
Custom handlers now receive the request signal at extra.mcpReq.signal instead of extra.signal.
Host-side wire deltas change handler-thrown -32002 to -32602 for Views, use -32602 for invalid params on ui/* methods instead of -32603, and remove the MCP error N: message prefix.
Replace the @modelcontextprotocol/sdk@^1 peer dependency with @modelcontextprotocol/client@^2.0.0, required because App and AppBridge extend its Protocol.
Remote JSON-RPC errors are represented as ProtocolError with a numeric code.
ProtocolWithEvents is removed.
Local failures are represented as SdkError with a string code.
Requires zod 4.2 or later; zod 3 and the 1.x fallback for zod 3.25 are no longer supported.
Security 3
@modelcontextprotocol/server-pdf now pins @cantoo/pdf-lib to exactly 2.6.5, avoiding the untested 2.11.x resolution and dependencies flagged by supply-chain scanners.
The root overrides that pinned seroval are removed; the updated dependency tree passes vulnerability and supply-chain scans.
@modelcontextprotocol/server-basic-solid now depends on solid-js 1.9.15 instead of exact 1.9.10, avoiding the vulnerable seroval 1.3 dependency.
Deprecations 6
AppNotification remains available as a deprecated type alias.
AppRequest remains available as a deprecated type alias.
AppResult remains available as a deprecated type alias.
Raw zod shapes remain accepted as a deprecated overload; wrap them in z.object({...}) to move off it.
The 2.x form keys registration by method name; the 1.x schema-and-handler form remains as a deprecated overload with a one-time warning and is removed in 3.0.
The 2.x form keys registration by method name and takes params before the handler; the 1.x schema-and-handler form remains as a deprecated overload with a one-time warning and is removed in 3.0.
New APIs and options 1
The server package is an optional peer dependency for projects using the ./server helpers.
Behavior and default changes 1
The schema follows 2.0 core schemas: structuredContent accepts any JSON value, result _meta documents io.modelcontextprotocol/serverInfo, toolInfo.tool.outputSchema is a loose object, and a recursive JSON-value definition is added.
Fixes and other changes 2
Example servers and the quickstart now derive the dist path from import.meta.url, preventing startup crashes on Node 18 and Node 20.0 to 20.10.
Relative imports now use explicit .js extensions so published declarations resolve under NodeNext and Node16.
@modelcontextprotocol/ext-apps 152 changes
Breaking changes 4
Types csp as ?: never so misplaced declarations fail at compile time.
Types permissions as ?: never so misplaced declarations fail at compile time.
Schemas now import from zod/v4 to match the SDK's zod API.
The pdf-server removes its domain allowlist and requires HTTPS only.
Security 2
Adds allowUnsafeEval, defaulting to false, so Views run under strict CSP without unsafe-eval; opting out enables the faster JIT path.
Adds robust path validation and support for folder or file roots.
New APIs and options 15
Adds sampling support via stock SDK types.
Views can expose tools for the Host to call.
Supports notifying the Host about changes to the tool list exposed by a View.
callServerTool can now opt into resetting its timeout based on progress.
A get_viewer_state interact action is available to retrieve viewer state.
Adds addEventListener with DOM-model on* semantics, allowing event listeners to be registered.
Adds pinch-to-zoom.
Adds removeEventListener with DOM-model on* semantics, allowing event listeners to be removed.
Adds the save_as interact action.
Adds a notification for the UI to initiate termination.
Adds listServerResources() to the App API for listing server resources.
Adds readServerResource() to the App API for reading server resources.
Adds a host-mediated file download method for apps.
A Claude Code plugin is now available for pdf-server.
The pdf-server now has MCPB packaging, providing a bundle developers can use.
Behavior and default changes 5
Host-bound methods warn when called before connect() completes; they throw instead when AppOptions.strict is enabled.
Warns when it receives requests before ui/notifications/initialized.
One-shot event handlers warn when first registered after connect() completes.
Imported annotations are rasterized.
Adds fit-to-page behavior in fullscreen.
Fixes and other changes 26
Missing HostCapabilities fields were added to the specification.
The experimental capability setting is typed as Record<string, object> and its contents are preserved during initialization instead of being stripped by the generated schema.
The experimental capability setting is typed as Record<string, object> and its contents are preserved during initialization instead of being stripped by the generated schema.
object-src is synchronized with default-src in the specification.
Forwards autoResize and strict to the underlying App.
Effect cleanup now closes the App, preventing React StrictMode's development double-invoke from leaving a zombie PostMessageTransport listener.
Highlight, underline, and strike annotations from existing PDFs are imported.
Form-field saving is made more robust, with save consistency follow-ups.
The PDF viewer toolbar layout is fixed.
The zoom-out button can zoom below fit-to-page.
Pinch interactions to and from fullscreen are fixed.
PDF highlights render with translucency.
Fixes batch results to be 1:1.
Renders the page before O(numPages) annotation scans.
Fixes an npx DOMMatrix crash.
Fixes fullscreen jitter.
Fixes a broken MCPB bundle.
Fixes radio and dropdown handling in fill_form/save.
Fixes viewer liveness.
Fixes auto-resize destroying horizontal scroll positions.
Reverts the fullscreen size-changed skip.
Fixes detached-buffer handling when a PDF range is re-requested.
The react-with-deps package now bundles the SDK and zod, unlike before.
Fixes autoResize reporting viewport height when content is taller.
basic-host now supports audio and video, allowing developers to use it with apps that need those media capabilities.
The pdf-server no longer displays the page-loading overlay.