github TypeScript analyzed 6d9bdc7

modelcontextprotocol/ext-apps

github

Official repo for spec & SDK of MCP Apps protocol - standard for UIs embedded AI chatbots, served by MCP servers

maintainer: modelcontextprotocol
licence: NOASSERTION
first seen: 2026-06-01
last seen: 2026-09-09
releases · 30d: 1
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 1 tools

transport stdio counts 1 tools · 0 res · 0 prompts permission surface via code analysis

tools

weather

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 6d9bdc7 · analyzer v33 · 4d ago

skills & prompt files 5

danger signals2

dynamic code execution new Function() modelcontextprotocol-ext-apps-6d9bdc7/examples/threejs-server/src/threejs-app.tsx :182 const fn = new Function(
suspicious endpoint 169.254.169.254 (cloud metadata) modelcontextprotocol-ext-apps-6d9bdc7/examples/pdf-server/server.test.ts :549 expect(validateUrl("http://169.254.169.254/").valid).toBe(false);

code evidence vv2.0.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 191

filesystem 40

fs modelcontextprotocol-ext-apps-6d9bdc7/build.bun.ts :3 import { cpSync, mkdirSync, rmSync } from "node:fs";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/basic-server-preact/server.ts :6 import fs from "node:fs/promises";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/basic-server-react/server.ts :7 import fs from "node:fs/promises";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/basic-server-solid/server.ts :6 import fs from "node:fs/promises";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/basic-server-svelte/server.ts :6 import fs from "node:fs/promises";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/basic-server-vanillajs/server.ts :7 import fs from "node:fs/promises";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/basic-server-vue/server.ts :6 import fs from "node:fs/promises";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/budget-allocator-server/server.ts :12 import fs from "node:fs/promises";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/cohort-heatmap-server/server.ts :5 import fs from "node:fs/promises";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/customer-segmentation-server/server.ts :6 import fs from "node:fs/promises";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/debug-server/server.ts :11 import fs from "node:fs/promises";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/integration-server/server.ts :11 import fs from "node:fs/promises";

show 28 more

fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/lazy-auth-server/server.ts :35 import fs from "node:fs/promises";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/map-server/server.ts :13 import fs from "node:fs/promises";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/pdf-server/build-mcpb.mjs :21 } from "node:fs";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/pdf-server/main.ts :7 import fs from "node:fs";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/pdf-server/server.test.ts :2 import fs from "node:fs";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/pdf-server/server.ts :14 import fs from "node:fs";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/quickstart/server.ts :7 import fs from "node:fs/promises";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/run-all.ts :14 import { readdirSync, statSync, existsSync } from "fs";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/scenario-modeler-server/server.ts :11 import fs from "node:fs/promises";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/shadertoy-server/server.ts :11 import fs from "node:fs/promises";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/sheet-music-server/server.ts :6 import fs from "node:fs/promises";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/system-monitor-server/server.ts :11 import fs from "node:fs/promises";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/threejs-server/server.ts :15 import fs from "node:fs/promises";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/transcript-server/server.ts :6 import fs from "node:fs/promises";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/video-resource-server/server.ts :18 import fs from "node:fs/promises";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/wiki-explorer-server/server.ts :12 import fs from "node:fs/promises";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/scripts/bump-version.mjs :17 import { readFileSync } from "node:fs";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/scripts/check-dependency-isolation.mjs :9 } from "node:fs";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/scripts/check-versions.mjs :9 import { readFileSync, readdirSync, statSync, existsSync } from "fs";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/scripts/generate-schemas.ts :57 import { readFileSync, writeFileSync } from "node:fs";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/scripts/link-self.mjs :8 import { cpSync, existsSync, lstatSync } from "fs";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/scripts/run-bun.mjs :8 import { existsSync } from "fs";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/scripts/sync-snippets.ts :49 import { readFileSync, writeFileSync, readdirSync } from "node:fs";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/scripts/typedoc-plugin-seo.mjs :11 import fs from "node:fs";
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/src/interop-v1.test.ts :12 import { readFileSync } from "node:fs";
fs modelcontextprotocol-ext-apps-6d9bdc7/src/server/index.examples.ts :11 import * as fs from "node:fs/promises";
fs modelcontextprotocol-ext-apps-6d9bdc7/src/server/index.ts :351 * text: await fs.readFile("dist/view.html", "utf-8"),
fs (weak) modelcontextprotocol-ext-apps-6d9bdc7/tests/e2e/generate-grid-screenshots.spec.ts :15 import * as fs from "fs";

shell / exec 5

shell modelcontextprotocol-ext-apps-6d9bdc7/build.bun.ts :9 await $`tsc`;
shell (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/pdf-server/build-mcpb.mjs :22 import { execSync } from "node:child_process";
shell (weak) modelcontextprotocol-ext-apps-6d9bdc7/scripts/bump-version.mjs :16 import { execSync } from "node:child_process";
shell (weak) modelcontextprotocol-ext-apps-6d9bdc7/scripts/check-dependency-isolation.mjs :1 import { execFileSync } from "node:child_process";
shell (weak) modelcontextprotocol-ext-apps-6d9bdc7/scripts/run-bun.mjs :7 import { spawn } from "child_process";

network 8

net (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/basic-host/src/index.tsx :579 const serverUrlsResponse = await fetch("/api/servers");
net (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/map-server/server.ts :68 const response = await fetch(
net (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/pdf-server/server.test.ts :410 // display_pdf gets totalBytes. Every subsequent fetch (made by
net (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/pdf-server/server.ts :52 /** pdf.js font factory that uses fetch() instead of fs.readFile. */
net (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/video-resource-server/server.ts :96 const response = await fetch(video.url);
net (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/wiki-explorer-server/server.ts :122 const response = await fetch(url);
net (weak) modelcontextprotocol-ext-apps-6d9bdc7/tests/e2e/pdf-annotations-api.spec.ts :224 const response = await fetch("https://api.anthropic.com/v1/messages", {
net (weak) modelcontextprotocol-ext-apps-6d9bdc7/tests/helpers/range-counting-server.ts :9 import http from "node:http";

secrets 2

secrets (weak) modelcontextprotocol-ext-apps-6d9bdc7/examples/lazy-auth-server/server.ts :53 process.env.JWT_SECRET ??
secrets (weak) modelcontextprotocol-ext-apps-6d9bdc7/tests/e2e/pdf-annotations-api.spec.ts :14 const API_KEY = process.env.ANTHROPIC_API_KEY;

tool registrations 2

weather modelcontextprotocol-ext-apps-6d9bdc7/src/app.examples.ts :52
weather modelcontextprotocol-ext-apps-6d9bdc7/src/server/index.examples.ts :278

install hooks 23

prepublishOnly modelcontextprotocol-ext-apps-6d9bdc7/examples/basic-server-preact/package.json :24 npm run build
prepublishOnly modelcontextprotocol-ext-apps-6d9bdc7/examples/basic-server-react/package.json :34 npm run build
prepublishOnly modelcontextprotocol-ext-apps-6d9bdc7/examples/basic-server-solid/package.json :24 npm run build
prepublishOnly modelcontextprotocol-ext-apps-6d9bdc7/examples/basic-server-svelte/package.json :24 npm run build
prepublishOnly modelcontextprotocol-ext-apps-6d9bdc7/examples/basic-server-vanillajs/package.json :24 npm run build
prepublishOnly modelcontextprotocol-ext-apps-6d9bdc7/examples/basic-server-vue/package.json :24 npm run build
prepublishOnly modelcontextprotocol-ext-apps-6d9bdc7/examples/budget-allocator-server/package.json :25 npm run build
prepublishOnly modelcontextprotocol-ext-apps-6d9bdc7/examples/cohort-heatmap-server/package.json :25 npm run build
prepublishOnly modelcontextprotocol-ext-apps-6d9bdc7/examples/customer-segmentation-server/package.json :25 npm run build
prepublishOnly modelcontextprotocol-ext-apps-6d9bdc7/examples/debug-server/package.json :34 npm run build
prepublishOnly modelcontextprotocol-ext-apps-6d9bdc7/examples/lazy-auth-server/package.json :22 npm run build
prepublishOnly modelcontextprotocol-ext-apps-6d9bdc7/examples/map-server/package.json :25 npm run build

show 11 more

prepublishOnly modelcontextprotocol-ext-apps-6d9bdc7/examples/pdf-server/package.json :24 npm run build
prepublishOnly modelcontextprotocol-ext-apps-6d9bdc7/examples/scenario-modeler-server/package.json :25 npm run build
prepublishOnly modelcontextprotocol-ext-apps-6d9bdc7/examples/shadertoy-server/package.json :24 npm run build
prepublishOnly modelcontextprotocol-ext-apps-6d9bdc7/examples/sheet-music-server/package.json :24 npm run build
prepublishOnly modelcontextprotocol-ext-apps-6d9bdc7/examples/system-monitor-server/package.json :25 npm run build
prepublishOnly modelcontextprotocol-ext-apps-6d9bdc7/examples/threejs-server/package.json :25 npm run build
prepublishOnly modelcontextprotocol-ext-apps-6d9bdc7/examples/transcript-server/package.json :24 npm run build
prepublishOnly modelcontextprotocol-ext-apps-6d9bdc7/examples/video-resource-server/package.json :24 npm run build
prepublishOnly modelcontextprotocol-ext-apps-6d9bdc7/examples/wiki-explorer-server/package.json :25 npm run build
prepack modelcontextprotocol-ext-apps-6d9bdc7/package.json :54 npm run build
prepare modelcontextprotocol-ext-apps-6d9bdc7/package.json :68 npm run build && husky

declared dependencies 35

@modelcontextprotocol/client@2.0.0
@modelcontextprotocol/core@2.0.0
@modelcontextprotocol/sdk@1.30.0
@modelcontextprotocol/server@2.0.0
@standard-schema/spec@^1.1.0
@boneskull/typedoc-plugin-mermaid@^0.2.0
@playwright/test@1.57.0
@types/bun@^1.3.2
@types/node@20.19.27
@types/react@^19.2.2
@types/react-dom@^19.2.2
bun@^1.2.21

show 23 more

caniuse-lite@1.0.30001763
cheerio@1.1.2
concurrently@^9.2.1
cors@^2.8.5
cross-env@^10.1.0
electron-to-chromium@1.5.267
esbuild@^0.25.12
express@^5.1.0
ext-apps-v1@npm:@modelcontextprotocol/ext-apps@1.7.5
husky@^9.1.7
nodemon@^3.1.0
playwright@1.57.0
playwright-core@1.57.0
prettier@^3.6.2
react@^19.2.0
react-dom@^19.2.0
sharp@^0.35.3
ts-to-zod@^5.1.0
tsx@^4.21.0
typedoc@^0.28.14
typedoc-github-theme@^0.4.0
typescript@^5.9.3
zod@^4.2.0