What an MCP App is
MCP Apps (extensionio.modelcontextprotocol/ui) lets an MCP server ship a UI. The server exposes
a ui:// resource — one self-contained HTML document served with MIME type
text/html;profile=mcp-app — and links tools to it via _meta.ui.resourceUri.
The host renders the document in a sandboxed iframe next to the chat; the View
talks JSON-RPC 2.0 over postMessage to the host, and the host proxies its
tools/call requests back to your server.
The View needs no network access of its own: everything — the offer data, the
provision call, the credential delivery — flows through the host bridge. Hosts
that don’t support MCP Apps ignore the metadata and use each tool’s plain-text
result instead, so the same server degrades gracefully.
The flow, end to end
Three parties: a host platform, Gravity (the facilitator), and a vendor like Neon (the provider).1
Search and render
The host’s agent calls Gravity’s Index (
gravity_index_search); Gravity
returns the recommended vendor, a search_id, the vendor’s MCP App
endpoint, and a short-lived signed grant. The host connects to the
vendor’s MCP server, fetches the ui:// resource, and renders the
vendor’s branded card inline — no vendor-specific UI on the host.2
Consent-gated provisioning
Email + one click, and the click is the consent: the View calls the
provision tool with
user_consent: true and the Gravity grant. The
vendor verifies the grant — no valid grant, no account — then calls its
own account-creation API and returns a one-time credentials URL,
never the raw keys. The View redeems it through an app-only tool; values
render masked inside the iframe, and the model and transcript learn only
key names and status.3
Attribution and billing
The vendor reports the provision to Gravity with the
search_id — CPA
billing and platform rev-share work just like
click-through attribution.What stays secure (and what gets simpler)
MCP Apps standardizes the UI and the wiring — it does not replace authorization. What it removes is the bespoke part: per-host signup UIs, custom consent plumbing, and invented key-handoff channels.Transport auth
A deployed sign-up server is a protected MCP resource: unauthenticated
requests get
401 + WWW-Authenticate with protected-resource metadata,
and the host runs standard OAuth 2.1 (authorization-code + PKCE,
audience-bound tokens).Facilitation grants
Gravity signs a short-lived HMAC grant binding
(search_id, slug) into
facilitated recommendations. The vendor’s provision tool refuses anything
missing, tampered, expired, or bound to a different service or search —
arbitrary callers cannot create accounts.One-time credentials
Keys travel as a one-time URL that burns on first read. Values appear
only in the sandboxed View’s
structuredContent, never in tool text or
model context.Explicit consent
The provision tool rejects any call without
user_consent: true. In the
card, the user’s click on the Sign up button is that consent — not an
agent’s guess.