Repository navigation
[MCP] Add the McpApp universal component and mcpCatalog to @a2ui/catalog-mcp - #2799
Draft
josemontespg wants to merge 1 commit into
Draft
josemontespg wants to merge 1 commit into
josemontespg wants to merge 1 commit into
Conversation
josemontespg
force-pushed
the
catalogs-mcp-app-component
branch
from
September 25, 2026 05:23
9e0636d to
f562b15
Compare
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request introduces the sandboxed McpApp component to the A2UI MCP catalog, enabling secure rendering of MCP Apps inside an iframe with JSON-RPC communication, data model synchronization, and tool/function execution. It also restructures the package entry points to support DOM-free environments and adds comprehensive tests. The review feedback highlights three key improvement opportunities: using a single-pass regex replacement when unescaping JSON Pointer sequences to prevent order-of-operations bugs, wrapping decodeURIComponent in a try-catch block to handle malformed encoding errors gracefully, and deferring action dispatching to safely catch synchronous errors.
josemontespg
force-pushed
the
catalogs-mcp-app-component
branch
from
September 25, 2026 17:40
f562b15 to
63a21f5
Compare
josemontespg
added this pull request to stack #2804
September 25, 2026 18:11
josemontespg
force-pushed
the
catalogs-mcp-app-component
branch
from
September 25, 2026 18:37
63a21f5 to
ed54574
Compare
josemontespg
force-pushed
the
catalogs-mcp-app-component
branch
from
September 25, 2026 20:21
ed54574 to
5692925
Compare
josemontespg
force-pushed
the
catalogs-mcp-app-component
branch
from
October 1, 2026 20:11
5692925 to
e9da27f
Compare
josemontespg
removed this pull request from stack #2804
October 1, 2026 20:12
josemontespg
added this pull request to stack #2940
October 1, 2026 20:12
josemontespg
force-pushed
the
catalogs-mcp-app-component
branch
from
October 1, 2026 20:43
e9da27f to
6155ab4
Compare
josemontespg
force-pushed
the
catalogs-mcp-app-component
branch
from
October 1, 2026 21:42
6155ab4 to
7d1a93d
Compare
josemontespg
removed this pull request from stack #2940
October 1, 2026 21:56
josemontespg
changed the base branch from
catalogs-iframe-components
to
catalogs-mcp-app-schema
October 1, 2026 21:56
josemontespg
force-pushed
the
catalogs-mcp-app-component
branch
from
October 1, 2026 21:56
7d1a93d to
7a053a3
Compare
josemontespg
added this pull request to stack #2946
October 1, 2026 21:56
josemontespg
force-pushed
the
catalogs-mcp-app-component
branch
from
October 1, 2026 22:14
7a053a3 to
bed2438
Compare
josemontespg
added a commit
that referenced
this pull request
Oct 1, 2026
### Summary `ResolveA2uiProp` turns every prop whose type matches `ActionLike` into a `() => Promise<void>` thunk. Since #2859 added `V1Action` to `ActionLike`, whose function-call variant infers as the weak type `{functionCall?: any}`, every object type matches it, so props declared as `z.record(z.unknown())` (or any `Record<string, ...>`) now resolve to an action thunk instead of their data type. The runtime binder is unaffected (it reads the zod schema), so this is a type-only regression, but it breaks `tsc` for catalogs that read such props, for example the iframe and MCP catalogs in #2797 and #2799. Object types with a string index signature now resolve as data, as before #2859. Props shaped like an action (`{event: ...}`, `{functionCall: ...}`, `V1Action`) still resolve to the thunk. ### Changes * `typescript/web_core/src/resolution/generic-binder.ts`: add `HasStringIndex<T>` and check it inside the `ActionLike` branch of `ResolveA2uiProp` before producing the thunk type. * `typescript/web_core/CHANGELOG.md`: Unreleased entry. ### Verification * `yarn --cwd typescript/web_core test` (842 tests) and `./scripts/fix_format.sh --check` pass locally. * The iframe and MCP catalog packages of the stack above typecheck again with this change.
josemontespg
force-pushed
the
catalogs-mcp-app-component
branch
from
October 1, 2026 22:41
bed2438 to
fafc22c
Compare
josemontespg
changed the title
josemontespg
added this pull request to stack #3011
October 5, 2026 20:45
josemontespg
removed this pull request from stack #3011
October 7, 2026 23:18
josemontespg
force-pushed
the
catalogs-mcp-app-component
branch
from
October 7, 2026 23:19
3f9c7e7 to
62ca645
Compare
josemontespg
added this pull request to stack #3055
October 7, 2026 23:19
josemontespg
removed this pull request from stack #3055
October 7, 2026 23:32
josemontespg
changed the base branch from
catalogs-mcp-app-schema
to
catalogs-shared-sandbox
October 7, 2026 23:33
josemontespg
force-pushed
the
catalogs-mcp-app-component
branch
from
October 7, 2026 23:33
62ca645 to
938293d
Compare
josemontespg
changed the title
josemontespg
added this pull request to stack #3057
October 7, 2026 23:34
josemontespg
changed the title
josemontespg
force-pushed
the
catalogs-mcp-app-component
branch
2 times, most recently
from
October 8, 2026 21:34
0ee35a4 to
f47d2e6
Compare
josemontespg
commented
Oct 8, 2026
josemontespg
force-pushed
the
catalogs-mcp-app-component
branch
2 times, most recently
from
October 9, 2026 18:18
0157eac to
7ca0b1f
Compare
josemontespg
removed this pull request from stack #3057
October 9, 2026 18:19
josemontespg
commented
Oct 9, 2026
josemontespg
commented
Oct 9, 2026
josemontespg
commented
Oct 9, 2026
josemontespg
commented
Oct 12, 2026
This was referenced Oct 12, 2026
…og to @a2ui/catalog-mcp Add mcpCatalog, the v1 MCP catalog with the McpApp universal component (A2uiMcpApp) and callMcpTool, backed by the shared double-iframe sandbox runtime from typescript/catalogs/shared/sandbox/. McpAppBridge implements the MCP Apps host side on @modelcontextprotocol/ext-apps/app-bridge (ui/open-link, ui/message, ui/request-display-mode, ui/update-model-context, tool input and result notifications, tool execution through callMcpTool, host context), and payload validation checks function call arguments against allowedFunctions. Without a configured client, McpApp dispatches allowed tools/call requests as A2UI actions.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the
McpAppuniversal component (A2uiMcpApp) andmcpCatalogto@a2ui/catalog-mcp, on top of the host configuration from the parent PRs and the shared double-iframe sandbox from #3056.A host registers
mcpCatalog(the component pluscallMcpTool) with itsMessageProcessorand callsconfigureMcpCatalogonce. Without a configured client,McpAppdispatches allowedtools/callrequests as A2UI actions.Changes
src/components/mcp_app.ts: theMcpAppelement onSandboxedFrameElement, with the MCP Apps sandbox handshake,allowedFunctions/allowedTools, data model binding and frame sizing;callMcpToolis resolved from the component's catalog first, then the surface's.src/components/mcp_app_bridge.ts:McpAppBridgeon@modelcontextprotocol/ext-apps/app-bridge:ui/open-link,ui/message,ui/request-display-mode,ui/update-model-context, tool input and result notifications, tool execution throughcallMcpTool, enrichedMcpUiHostContext.src/components/payload_validation.ts: JSON Schema validation of function call arguments againstallowedFunctions.src/catalog.ts,src/index.ts:mcpCatalog = new Catalog(MCP_CATALOG_ID, '1.0', [A2uiMcpApp], [CallMcpToolImplementation]); the entry point exportsmcpCatalogandA2uiMcpApp.src/testing/frame_test_support.ts,tests/fixtures/apps/test_app.ts,tests/mcp_app_scenarios.test.ts: Karma scenarios against a real App SDK guest, including tool execution through a configured client.README.md,CHANGELOG.md: theMcpAppsection.Verification
yarn workspace @a2ui/catalog-mcp test: 82 Node tests, 211 Karma tests../scripts/fix_format.sh --check,python3 scripts/fix_licenses.py --check.Related to #3157