MCP currently has no way to show interactive UI to users — every tool response is plain text. This adds MCP App support: a tool linked to an AppResource can render a self-contained HTML app inside a sandboxed iframe in the host.

Usage

php artisan make:mcp-app-resource DashboardApp

This generates two files. The PHP class registers the resource — the default handle() auto-infers the Blade view from the class name, so no code is needed unless you're passing server-side data:

class DashboardApp extends AppResource
{
    public function handle(Request $request): Response
    {
        return Response::view('mcp.dashboard-app', [
            'title' => $this->title(),
        ]);
    }
}

The Blade view is the entire app — HTML, JS, and CSS in one file:

<x-mcp::app title="Dashboard">
    <x-slot:head>
        <script type="module">
        createMcpApp(async (app) => {
            const result = await app.callTool('get-data');
            document.getElementById('output').textContent = result.content[0]?.text;
        });
        </script>
    </x-slot:head>
    <div id="output"></div>
</x-mcp::app>

Link a tool to display the app when called:

#[RendersApp(resource: DashboardApp::class)]
class ShowDashboard extends Tool
{
    public function handle(Request $request): Response
    {
        return Response::text('Dashboard loaded.');
    }
}

App-only tools (invisible to the model, callable only from the UI):

#[RendersApp(resource: DashboardApp::class, visibility: ['app'])]
class GetDashboardData extends Tool { ... }

Approach

• AppResource extends Resource with ui:// URI scheme and text/html;profile=mcp-app MIME type; serves self-contained HTML via handle() which renders a Blade view
• #[RendersApp] attribute on a tool injects _meta.ui.resourceUri into its tool listing so the host knows which resource to fetch
• The x-mcp::app Blade component inlines the pre-bundled JS SDK so apps require no npm or Vite
• AppMeta / Csp / Permissions provide structured configuration for iframe sandbox permissions and CSP
• Server advertises io.modelcontextprotocol/ui capability automatically when any AppResource is registered