> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trygravity.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign-up MCP Apps

> Your branded sign-up card, rendered inside any AI agent — powered by the MCP Apps protocol

A sign-up MCP App is how provisioning works on the Index: the host renders
your branded card inline in the conversation, the user enters an email and
clicks Sign up, and their keys appear in the card — masked, copyable, never
touching the chat transcript.

One MCP server + one HTML View works in every MCP Apps-capable host,
including any platform embedding the Index, with no per-host integrations.

## What an MCP App is

[MCP Apps](https://github.com/modelcontextprotocol/ext-apps) (extension
`io.modelcontextprotocol/ui`) lets an MCP server ship a UI. The server exposes
a `ui://` resource — one self-contained HTML document served with MIME type
`text/html;profile=mcp-app` — and links tools to it via `_meta.ui.resourceUri`.
The host renders the document in a sandboxed iframe next to the chat; the View
talks JSON-RPC 2.0 over `postMessage` to the host, and the host proxies its
`tools/call` requests back to your server.

The View needs no network access of its own: everything — the offer data, the
provision call, the credential delivery — flows through the host bridge. Hosts
that don't support MCP Apps ignore the metadata and use each tool's plain-text
result instead, so the same server degrades gracefully.

## The flow, end to end

Three parties: a host platform, Gravity (the facilitator), and a vendor like
Neon (the provider).

<Steps>
  <Step title="Search and render">
    The host's agent calls Gravity's Index (`gravity_index_search`); Gravity
    returns the recommended vendor, a `search_id`, the vendor's MCP App
    endpoint, and a short-lived **signed grant**. The host connects to the
    vendor's MCP server, fetches the `ui://` resource, and renders the
    vendor's branded card inline — no vendor-specific UI on the host.
  </Step>

  <Step title="Consent-gated provisioning">
    Email + one click, and the click **is** the consent: the View calls the
    provision tool with `user_consent: true` and the Gravity grant. The
    vendor verifies the grant — no valid grant, no account — then calls its
    own account-creation API and returns a **one-time credentials URL**,
    never the raw keys. The View redeems it through an app-only tool; values
    render masked inside the iframe, and the model and transcript learn only
    key *names* and status.
  </Step>

  <Step title="Attribution and billing">
    The vendor reports the provision to Gravity with the `search_id` — CPA
    billing and platform rev-share work just like
    [click-through attribution](/gravity-index/for-service-providers).
  </Step>
</Steps>

## What stays secure (and what gets simpler)

MCP Apps standardizes the UI and the wiring — it does not replace
authorization. What it removes is the bespoke part: per-host signup UIs,
custom consent plumbing, and invented key-handoff channels.

<CardGroup cols={2}>
  <Card title="Transport auth" icon="lock">
    A deployed sign-up server is a protected MCP resource: unauthenticated
    requests get `401` + `WWW-Authenticate` with protected-resource metadata,
    and the host runs standard OAuth 2.1 (authorization-code + PKCE,
    audience-bound tokens).
  </Card>

  <Card title="Facilitation grants" icon="signature">
    Gravity signs a short-lived HMAC grant binding `(search_id, slug)` into
    facilitated recommendations. The vendor's provision tool refuses anything
    missing, tampered, expired, or bound to a different service or search —
    arbitrary callers cannot create accounts.
  </Card>

  <Card title="One-time credentials" icon="key">
    Keys travel as a one-time URL that burns on first read. Values appear
    only in the sandboxed View's `structuredContent`, never in tool text or
    model context.
  </Card>

  <Card title="Explicit consent" icon="hand">
    The provision tool rejects any call without `user_consent: true`. In the
    card, the user's click on the Sign up button is that consent — not an
    agent's guess.
  </Card>
</CardGroup>

## Build one

One small MCP server and one HTML View:
[Build your sign-up app](/gravity-index/build-signup-app).