What's Changed

ext-apps 2.0 moves to the MCP TypeScript SDK 2.0 split packages. The MCP Apps wire protocol is unchanged: 2.x Views run in 1.x hosts and 2.x hosts render 1.x Views (covered by a test that runs the published 1.7.5 against this release in both directions). What breaks is dependencies and the TypeScript API; see the migration guide.

Breaking changes

• Peer dependencies. @modelcontextprotocol/sdk@^1 is replaced by @modelcontextprotocol/client@^2.0.0 (required: App and AppBridge extend its Protocol), @modelcontextprotocol/server@^2.0.0 (optional, only for the ./server helpers), and zod@^4.2.0. Node.js 20+.
• zod 3 is no longer supported. SDK 2.0 requires zod 4.2+ (the release that added Standard JSON Schema output); the 1.x fallback for zod 3.25 is gone. Raw zod shapes in registerAppTool still work as a deprecated overload; wrap them in z.object({...}) to move off it.
• Handler context. Custom handlers receive the SDK 2.x BaseContext: extra.signal is now extra.mcpReq.signal, extra.requestId is extra.mcpReq.id.
• setRequestHandler / setNotificationHandler are keyed by method name. The 2.x form is setRequestHandler("method", { params }, (params, ctx) => …). The 1.x (Schema, handler) form still works as a deprecated overload with a one-time warning (#769) and goes away in 3.0.
• The double-registration guard now covers the SDK's own handlers. Registering a handler for notifications/progress or notifications/cancelled throws already registered, as ping and the on*-owned methods did in 1.x.
• ProtocolWithEvents is removed. AppRequest, AppNotification and AppResult remain as deprecated type aliases.
• Errors. Remote JSON-RPC errors are ProtocolError (numeric code); local failures are SdkError (string code). Host-side wire deltas: a handler-thrown -32002 reaches the View as -32602, invalid params on ui/* methods go from -32603 to -32602, and the MCP error N: message prefix is gone.
• schema.json follows the 2.0 core schemas: structuredContent is any JSON value, result _meta documents io.modelcontextprotocol/serverInfo, toolInfo.tool.outputSchema is a loose object, and a recursive JSON-value definition is added.

SDK

• Migrate to SDK v2 with the official Protocol and isolated role peers by @tonxxd, building on @khandrew1's #710 and @felixweinberger's #712, in #720
• SDK 2.0 fixups: regenerated lockfile, ^2.0.0 peers, restored double-registration guard, deprecated raw-shape registerAppTool overload, migration guide, wire-compat tests, MCPB build in #768
• Fix: explicit .js extensions on relative imports so published declarations resolve under NodeNext / Node16 (#704) by @ken-jo in #705
• Keep the 1.x handler registration forms as deprecated overloads in #769
• Cross-version interop test against the published ext-apps 1.7.5 in #770

Examples

• All examples migrated to the split SDK packages (NodeStreamableHTTPServerTransport, z.object schemas, extra.mcpReq.*) in #720
• server-pdf now advertises JSON Schema 2020-12 on every tool's inputSchema / outputSchema, which fixes #765 for clients with a strict 2020-12 validator

Docs

• Add Alpic Playground to supported clients by @qchuchu in #729

Security

npm audit reports 10 findings (2 critical, 4 high, 4 moderate), all in example workspaces or build tooling, none reachable from the published package, whose only runtime dependency is @standard-schema/spec:

• seroval / solid-js (GHSA-mv8w-475r-vwqw): the Solid example's vite plugin, pinned by a root overrides
• undici 7.28.0: cheerio in wiki-explorer-server
• nanoid, postcss: vite
• brace-expansion: nodemon (dev)
• hono / @hono/node-server (GHSA-frvp-7c67-39w9): @modelcontextprotocol/node in the examples' servers; same advisory as the 1.7.5 residual, still unreachable (only getRequestListener / serve are imported)
• qs: express 5 in examples; fflate: @types/three (dev)

All have non-major fixes available and will be picked up in a follow-up, kept off this release to keep the version diff clean.

Full Changelog: v1.7.5...v2.0.0

What's Changed

SDK

• Preserve experimental capability settings during initialization. McpUiHostCapabilities.experimental and McpUiAppCapabilities.experimental are now typed Record<string, object> instead of {}, and the generated schema no longer strips their contents, by @victor-openai in #721

Specification

• Add missing HostCapabilities fields by @hydrosquall in #653
• Sync object-src with default-src by @domfarolino in #715

Examples

• lazy-auth-server: usable on mobile in #714
• map-server: fix README and code of conduct links in #657

Docs

• API Docs link for ext-apps/server in #697
• Add mcp-use inspector badge to supported clients by @pietrozullo in #650

Security

npm audit goes from 15 findings (2 critical, 7 high, 4 moderate, 2 low) to 3 in #725:

• shell-quote 1.9.0 (GHSA-w7jw-789q-3m8p, GHSA-395f-4hp3-45gv)
• @babel/core 7.29.7 (GHSA-4x5r-pxfx-6jf8)
• sharp ^0.35.3 (GHSA-f88m-g3jw-g9cj; libvips CVE-2026-33327 / 33328 / 35590 / 35591) — devDependency, screenshot tooling only
• brace-expansion 1.1.16 / 2.1.2, fast-uri 3.1.4, hono 4.12.31, linkify-it 5.0.2, markdown-it 14.3.0, body-parser 2.3.0, plus other transitives

The 3 remaining are all the same advisory (GHSA-frvp-7c67-39w9, path traversal in @hono/node-server's serve-static on Windows), reached through @modelcontextprotocol/sdk's ^1.19.9 pin. It needs an upstream SDK bump, and is not reachable from this SDK, which imports only getRequestListener and serve from that package.

Full Changelog: v1.7.4...v1.7.5

What's Changed

No SDK API changes in this release.

Examples

• lazy-auth-server: require PKCE and bind redirect_uri in token exchange (#681)
• lazy-auth-server: support mounting under a base path of a host Express app (#683)

Security

npm audit now reports 0 vulnerabilities:

• Removed unused vitest devDependency from basic-host
• systeminformation bumped to 5.31.6+ in system-monitor-server (GHSA-hvx9-hwr7-wjj9)
• Transitive dependency updates: devalue 5.8.1, fast-uri 3.1.2, hono 4.12.23, ip-address 10.2.0, express-rate-limit 8.5.2, postcss 8.5.15, qs 6.15.2, svelte 5.56.1 (#685)

Full Changelog: v1.7.3...v1.7.4

What's Changed

• Add lazy-auth-server example by @mel-anthropic in #679

Full Changelog: v1.7.2...v1.7.3

What's Changed

• chore(pdf-server): switch to maintained @cantoo/pdf-lib fork by @ochafik in #651
• chore: bump example transitives to latest patches by @ochafik in #658
• chore: bump ext-apps to 1.7.2 by @ochafik in #660

Full Changelog: v1.7.1...v1.7.2

Changes since 1.7.0

No SDK API changes in this release.

Examples

• pdf-server: lazy form extraction via range transport + incremental viewer scans (#639)
• pdf-server: share cache across server instances and dedupe form parsing (#637)
• qr-server: pass host/port to FastMCP for Docker compatibility (#372)

Tests

• Unit tests for buildAllowAttribute (#541)
• Unit coverage for PostMessageTransport source validation (#536)

Docs

• Update contributing guide on package preview (#601)

Test Plan

• Pre-commit hook ran npm run build:all successfully

Changes since 1.6.0

Features

• App.registerTool() / sendToolListChanged() — Views can expose tools for the Host to call (WebMCP-style) (#72)
• App.createSamplingMessage() — sampling support via stock SDK types (#530)
• Handshake-ordering guards (console.warn, or throw with AppOptions.strict): App host-bound methods warn when called before connect() completes; one-shot event handlers (ontoolinput/ontoolresult/etc.) warn when first registered after connect(); AppBridge warns when it receives requests before ui/notifications/initialized (#623, #629, #625, #630, #631)
• AppOptions.allowUnsafeEval (default false) — App constructor sets z.config({ jitless: true }) so Views run under strict CSP without unsafe-eval; opt out for the faster JIT path (#618)
• useApp() forwards autoResize and strict to the underlying App (#622)

Fixes

• useApp effect cleanup now closes the App, so React StrictMode's dev double-invoke doesn't leave a zombie PostMessageTransport listener receiving every host message alongside the live instance (#631)
• csp / permissions typed ?: never on McpUiToolMeta so misplaced declarations fail at compile time (#624)
• Drop stale resourceUri JSDoc that referenced the deprecated flat _meta["ui/resourceUri"] key (#626)

Chore

• npm run bump script for version bumps across root + workspaces; npm-publish jobs now approve in a single click; prereleases publish under --tag beta (#568)
• Pre-commit hook: skip link-self when target is a symlink; --diff-filter=d so re-stage doesn't fail on deletions (#621)
• Bump vite / hono / @hono/node-server to patched versions (#616)
• Examples policy added to CONTRIBUTING.md (#550)

What's Changed

• test(e2e): poll for initial shrink-to-fit zoom before asserting by @ochafik in #607
• callServerTool: opt into progress-based timeout reset by @anthroy in #600
• chore: bump ext-apps to 1.6.0 by @ochafik in #613

Full Changelog: v1.5.0...v1.6.0

What's Changed

• fix(pdf-server): translucent highlights, pinch to/from fullscreen, toolbar layout by @ochafik in #587
• fix(pdf-server): let zoom-out button go below fit-to-page by @ochafik in #589
• feat(pdf-server): get_viewer_state interact action by @ochafik in #590
• fix(pdf-server): import highlight/underline/strike from existing PDFs by @ochafik in #592
• fix(pdf-server): form-field save robustness by @ochafik in #591
• feat(pdf-server): rasterize imported annotations + form/save consistency follow-ups by @ochafik in #593

Full Changelog: v1.4.0...v1.5.0

Changes since 1.3.2:

SDK

• feat: add addEventListener/removeEventListener with DOM-model on* semantics (#573)

pdf-server

• feat: add save_as interact action (#580)
• feat: fit-to-page on fullscreen + pinch-to-zoom (#583)
• fix: npx DOMMatrix crash + broken MCPB bundle (#584)
• fix: viewer liveness, 1:1 batch results, fullscreen jitter (#579)
• fix: render page before O(numPages) annotation scans (#581)
• fix: radio + dropdown in fill_form/save (#577)

Dependencies

• chore: npm audit fix — sdk 1.29.0, systeminformation 5.31.5, +13 transitives (#585, #586)
• fix: bump path-to-regexp 8.3.0 → 8.4.1 to patch ReDoS CVEs (#576)