1.3.2

What's Changed

• Remove examples/pdf-server/plugin/ — canonical copy is upcoming in knowledge-work-plugins by @ochafik in #565
• Fix auto-resize destroying horizontal scroll positions by @mel-anthropic in #567
  • Revert fullscreen size-changed skip by @mel-anthropic in #570
• chore: bump ext-apps to 1.3.2 by @ochafik in #569

Full Changelog: v1.3.1...v1.3.2

1.3.1

What's Changed

• fix(pdf-server): detached-buffer on range re-request + stale e2e assertion by @ochafik in #561
• chore: bump ext-apps to 1.3.1 by @ochafik in #562

Full Changelog: v1.3.0...v1.3.1

1.3.0

What's Changed

• fix(examples): improve mobile support for map, pdf, and threejs examples by @mel-anthropic in #555
• pdf-server: annotations, interact tool, page extraction & prompt engineering by @ochafik in #506
• Add ui/notifications/request-close notification for UI to initiate termination by @fredericbarthelet in #215
• chore: bump ext-apps to 1.3.0 by @ochafik in #560

Full Changelog: v1.2.2...v1.3.0

1.2.2

What's Changed

• fix(schemas): import from zod/v4 to match SDK's zod API by @ochafik in #548
• chore: bump ext-apps to 1.2.2 by @ochafik in #549

Full Changelog: v1.2.1...v1.2.2

1.2.1

What's Changed

• test: exclude screenshot-gen from default E2E run; wire pdf-server tests by @ochafik in #537
• fix(build): copy schema.json to dist and externalize zod by @ochafik in #534
• ci: use npm ci with caching, validate typedoc links, align Node versions by @ochafik in #533
• fix: pre-commit stages only originally-staged files; add .npmrc by @ochafik in #538
• fix(deps): drop @hono/node-server override to patch GHSA-wc8c-qw6v-h7f6 by @ochafik in #535
• fix(ci): require maintainer association for /update-snapshots trigger by @ochafik in #532
• fix: skip debug log for high-frequency tool-input-partial notifications by @antonpk1 in #546
• fix: theme-aware README logo + docs preview CI by @localden in #545
• fix: bundle SDK+zod in react-with-deps (was byte-identical to ./react) by @ochafik in #539
• test(e2e): fix no-op security injection test via frames[] traversal by @ochafik in #540
• chore: bump ext-apps to 1.2.1 by @ochafik in #547

Full Changelog: v1.2.0...v1.2.1

1.2.0

Changes since 1.1.2:

Features

• feat: add readServerResource() and listServerResources() API to App (#470, #528)

Fixes

• fix: replace platform-specific optionalDependencies with bun devDependency (#518)
• fix: autoResize reporting viewport height when content is taller (#525)
• fix: remove duplicate --color-text-ghost from McpUiStyleVariableKey (#523)
• fix: examples servers' npm run start:stdio (#507)
• fix: work around tsx watch hang on Windows in quickstart (#428)

Refactors

• refactor: remove unnecessary type assertions (#471)
• refactor: replace deprecated RESOURCE_URI_META_KEY with modern format (#457)

Examples & Plugin

• pdf-server: ignore client roots by default (#510)
• plugin: refactor create-mcp-app skill to reference patterns.md (#416)

Docs

• docs: add Security documentation section and SEO improvements (#524)
• docs: add MCP client configuration examples to CONTRIBUTING.md (#508, #526)
• docs: use apps.extensions.modelcontextprotocol.io domain for docs URLs (#499)
• docs: add SECURITY.md with GitHub Security Advisories guidance (#472)

Full Changelog: v1.1.2...v1.2.0

1.1.2

What's Changed

• pdf-server: robust path validation + folder/file root support by @ochafik in #497
• feat: add ui/download-file method for host-mediated file downloads by @antonpk1 in #475
• ci: auto-fix prettier formatting in pre-commit hook and CI by @ochafik in #498
• fix: sync local SDK build into node_modules for examples by @ochafik in #504
• chore: bump ext-apps to 1.1.2 by @ochafik in #503

Full Changelog: v1.1.1...v1.1.2

1.1.1

What's Changed

• fix: add audio/video support for basic-host by @Avcharov in #460
• Adding ChatGPT to the readme by @conorkel in #486
• fix(pdf-server): remove page-loading overlay by @ochafik in #493
• pdf-server: remove domain allowlist, require HTTPS only by @ochafik in #487
• ci: add missing examples to deploy workflows by @ochafik in #494
• Add MCPB packaging and Claude Code plugin for pdf-server by @bryan-anthropic in #491
• ci: build and publish MCPB bundle for pdf-server by @ochafik in #495
• Set audioSession.type to playback in sheet music app by @mel-anthropic in #489
• chore: bump ext-apps to 1.1.1 by @ochafik in #496

Full Changelog: v1.1.0...v1.1.1

1.1.0

What's Changed

• Fix: registerAppResource does not return registered resource, but void by @KKonstantinov in #370
• Use escaped newlines in ShaderToy README JSON examples by @jonathanhefner in #375
• Fix extractRegion() matching region names that are substrings of others by @jonathanhefner in #376
• Improve patterns guide with concrete examples and safe area insets by @jonathanhefner in #381
• feat(pdf-server): send screenshot to updateModelContext by @ochafik in #373
• Separate static and dynamic data in system-monitor-server tools by @jonathanhefner in #388
• docs: add root npm install step for basic-host setup by @GiladShoham in #371
• Add polling pattern to patterns guide by @jonathanhefner in #389
• Add binary blob resource pattern to patterns guide by @jonathanhefner in #391
• Add server-side persistence guidance to view state pattern by @jonathanhefner in #397
• examples: add MCP Apps arcade server by @idosal in #346
• examples: add arcade example to servers by @idosal in #399
• docs: fix basic-host setup instructions in quickstart by @rafa-thayto in #398
• Improve global.css as scaffolding template by @jonathanhefner in #403
• Improve documentation for CSP and permissions types by @jonathanhefner in #409
• Improve example CSS files to better demonstrate host style integration by @jonathanhefner in #404
• Extract getUiCapability example to type-checked examples file by @jonathanhefner in #406
• examples: remove arcade by @idosal in #414
• Cache full PDF bodies from servers without Range support by @ochafik in #411
• Add CSP and CORS section to patterns docs by @jonathanhefner in #415
• Add isToolVisibilityModelOnly and isToolVisibilityAppOnly helper functions by @matteo8p in #294
• Use escaped double quotes in npm scripts for Windows compatibility by @jonathanhefner in #421
• Replace "external" with "network" in CSP documentation by @jonathanhefner in #422
• Clarify spec and SDK: accept UIResourceMeta in both resources/list and resources/read by @ochafik in #410
• Rename skill to 'create-mcp-app' to align with spec by @vgshenoy in #443
• Rename migrate-oai-app skill name to align with spec by @jonathanhefner in #444
• Handle non-JSON-RPC messages gracefully in PostMessageTransport by @ochafik in #448
• Update theme toggle button position in CSS from top to bottom by @healthkowshik in #441
• fix: align basic-host dark mode styles by @Avcharov in #438
• Change Host <> Sandbox communication protocol to "SHOULD" by @mstoiber-oai in #435
• Upgrade GitHub Actions to latest versions by @salmanmkc in #393
• Upgrade GitHub Actions for Node 24 compatibility by @salmanmkc in #392
• Apply typedoc-github-theme typography fixes locally via customCss by @jonathanhefner in #442
• Add validation for callServerTool params argument by @ochafik in #449
• fix: update e2e test snapshots for shadertoy and wiki-explorer images by @Avcharov in #461
• README update by @localden in #463
• Upgrade typedoc-github-theme to v0.4.0 and remove local CSS workaround by @jonathanhefner in #462
• Add double-connect guard to prevent protocol message handling errors by @ochafik in #450
• Add PDF search feature to pdf-server by @ochafik in #445
• Add fullscreen button to threejs-server by @ochafik in #446
• feat(pdf-server): use MCP roots to auto-allow local directories by @ochafik in #479
• Lead README with agent skills for faster onboarding by @localden in #478
• Update README.md by @localden in #483
• pdf: ignore safe area insets in fullscreen mode by @ochafik in #484
• feat(pdf-server): lazy range-based loading + eager background preloading by @ochafik in #480
• chore: bump ext-apps to 1.1.0 by @ochafik in #485

Full Changelog: v1.0.1...v1.1.0

1.0.1

What's Changed

• docs: update MCP-UI SDK description in README by @idosal in #365
• fix(qr-server): use stable mcp SDK from PyPI by @malbari in #360
• fix(say-server): pin to released mcp version by @ochafik in #366
• chore: bump to 1.0.1 - fix npm reference for ext-apps dependency in examples + update zod to 4.x by @ochafik in #368
• chore: bump ext-apps to 1.0.1 by @ochafik in #369

Full Changelog: v1.0.0...v1.0.1