feat(apps): render show_attention as an MCP App panel and sidebar entry

.oxfmtrc.json

@@ -2,5 +2,8 @@
   "$schema": "./node_modules/oxfmt/configuration_schema.json",
   "singleQuote": true,
   "semi": false,
-  "trailingComma": "none"
+  "trailingComma": "none",
+  "ignorePatterns": [
+    "src/apps/attention/panel-html.ts"
+  ]
 }

AGENTS.md

@@ -116,6 +116,12 @@ The core innovation: instead of 2,500 MCP tools (~244K tokens), two tools handle
 
 `docs` (documentation search) and `whoami` are registered in both tool modes. `whoami` (`src/tools/whoami.ts`) returns the credential's identity as `user:<id>` or `account:<id>` and carries `_meta['openai/profile']` so ChatGPT can tell connected accounts apart. That ID format is a permanent contract: clients store it, so never change it. Its definition is static like every other tool's; only `tools/call` reads the credential.
 
+### Attention panel (MCP App)
+
+- `src/apps/attention/` serves `show_attention` in both tool modes and the `ui://cloudflare/attention-panel.html` resource through the same `resources/list` and `resources/read` handlers as skills.
+- `sources.ts` reads three feeds with the caller's token. A 401/403 names the missing permission, a 5xx is retried, and either way the feed is reported in `unavailable` instead of as empty. An `account_id` the session cannot reach is rejected before any feed call, and only `https://dash.cloudflare.com` links reach the panel.
+- The panel is React on `@openai/apps-sdk-ui` in `ui/`, typechecked by `tsconfig.attention-ui.json`. `npm run build:attention-panel` bundles it into one HTML file and regenerates `panel-html.ts`; commit the regenerated file with any UI change.
+
 ### MCP HTTP serving
 
 - `src/mcp-handler.ts` uses `createMcpHandler(factory)` directly from `@modelcontextprotocol/server`; this repository does not depend on the Agents SDK.

README.md

@@ -96,12 +96,13 @@ This server solves the problem by using **code execution** in a [Code Mode](http
 
 Agent writes code to search the spec and execute API calls. It can also search Cloudflare's developer documentation directly.
 
-| Tool      | Description                                                                   |
-| --------- | ----------------------------------------------------------------------------- |
-| `docs`    | Search Cloudflare developer documentation                                     |
-| `search`  | Write JavaScript to query `spec.paths` and find endpoints                     |
-| `execute` | Write JavaScript to call `cloudflare.request()` with the discovered endpoints |
-| `whoami`  | Return the Cloudflare user or account this connection is authenticated as     |
+| Tool             | Description                                                                   |
+| ---------------- | ----------------------------------------------------------------------------- |
+| `docs`           | Search Cloudflare developer documentation                                     |
+| `search`         | Write JavaScript to query `spec.paths` and find endpoints                     |
+| `execute`        | Write JavaScript to call `cloudflare.request()` with the discovered endpoints |
+| `whoami`         | Return the Cloudflare user or account this connection is authenticated as     |
+| `show_attention` | Show what in an account needs action now, as an interactive panel             |
 
 ```
 Agent                         MCP Server
@@ -115,6 +116,8 @@ Agent                         MCP Server
 
 `whoami` takes no arguments and returns `{ id, email }` for a user credential or `{ id, name }` for an account token. The `id` is `user:<user id>` or `account:<account id>`, so it stays the same across token refresh, reconnection and permission changes. Clients can use it to tell connected accounts apart; it is marked as an [OpenAI profile tool](https://developers.openai.com/plugins/build/auth#implement-and-declare-your-profile-tool).
 
+`show_attention` lists what needs action in an account: notifications that fired in the last 7 days, open Security Center insights and active Workers Observability issues. It reads them with the connection's own credential, so it needs Notifications Read, Account Security Center Insights Read and Workers Observability Read. A feed the credential cannot read is reported by name instead of shown as empty. Clients that support [MCP Apps](https://modelcontextprotocol.io/extensions/apps/overview) render it as a panel (`ui://cloudflare/attention-panel.html`) with a **Look into this** button per item, and hosts that support the `openai/ui` global entrypoint, such as Codex desktop, also list it in the sidebar. Other clients get the same report as text.
+
 ## Skills
 
 The server also serves the [Cloudflare skills](https://github.com/cloudflare/skills) (Wrangler, Durable Objects, Agents SDK, Workers best practices and more) through the MCP [Skills extension](https://modelcontextprotocol.io/extensions/skills/overview). Clients that support it discover them with `skills/list` and read each file at `skill://<name>/<path>`. The catalog is synced from GitHub every six hours.