Mcp App Builder

Build new MCP Apps (MCP servers with React UI output) using @modelcontextprotocol/ext-apps and the MCP SDK. Use when asked to scaffold or implement MCP App s...

Security Scan

The skill's code, assets, and runtime instructions align with its stated purpose (scaffolding and implementing MCP Apps); there are no disproportionate credentials, hidden network endpoints, or unexpected install steps.

Purpose & Capability

Name/description match the included assets and SKILL.md: a runnable MCP App template (server + single-file React UI) and an authoritative spec. Required files, dependencies, and patterns (registerAppTool/registerAppResource, createServer(), createMcpExpressApp, vite single-file) are coherent with the stated goal; no unrelated credentials, binaries, or config paths are requested.

Instruction Scope

Instructions are narrowly focused on scaffolding, implementing, building, and serving MCP Apps using the provided template and exact dependency versions. They read local project files (e.g., serving built HTML from dist/) and suggest optionally exposing the local server via a tunnel (cloudflared) for testing — that exposure is operationally risky if done insecurely but is not itself malicious. The SKILL.md does not instruct reading secrets or arbitrary host files.

Install Mechanism

No install spec is included (instruction-only), and the template relies on standard npm/tsx tooling declared in package.json. There are no download URLs or archives that would write arbitrary code at install time.

Credentials

The skill declares no required environment variables or credentials. The code uses non-secret env values (PORT and build INPUT) only. There are no requests for unrelated tokens/keys or access to other skill configs.

Persistence & Privilege

always is false, the skill is user-invocable and may be invoked autonomously (platform default). It does not request permanent presence, nor does it modify other skills or system-wide settings.

Assessment

This appears to be a legitimate MCP App scaffolding template. Before installing or running it: (1) review and, if desired, pin/verify the npm dependencies in package.json (trust the @modelcontextprotocol packages used); (2) run builds and the server locally first — the template serves local HTML from the dist/ directory; (3) be cautious if you follow the instructions to expose your dev server with a tunnel (e.g., cloudflared) because that makes your local service publicly reachable; and (4) there are no secret env vars requested, but audit any added code or third-party packages you install from npm for supply-chain risk.

Overview

Create MCP Apps that expose tools with visual React UIs for ChatGPT or Claude. Follow the exact dependency versions and server/UI patterns in references/mcp-app-spec.md.

Workflow

1. Clarify requirements: what data to visualize, UI pattern (card, table, chart, dashboard, form), data source, and how many tools (start with 1-2).
2. Design tools and UI mapping: define tool names, zod input schemas, output shape, and UI resource URIs (ui://.../app.html). Map each tool to one React entrypoint and one HTML file.
3. Scaffold the project: start from assets/mcp-app-template/ when possible, then customize tool names, schemas, and UI. Ensure package.json uses the exact versions, plus tsconfig.json, vite.config.ts, Tailwind + PostCSS, and per-tool build scripts.
4. Implement the server: use registerAppTool/registerAppResource, zod schemas directly, createServer() factory per request, and createMcpExpressApp with app.all("/mcp", ...).
5. Implement the UI: use useApp + useHostStyles, parse tool results, handle loading/error/empty states, and apply safe-area insets.
6. Build and test: run npm run build, then npm run serve, then verify via a tunnel if needed.

Hard Requirements

• Use the exact dependency versions listed in references/mcp-app-spec.md.
• Use registerAppTool/registerAppResource and zod schemas directly (not JSON Schema objects).
• Create a new McpServer instance per request via createServer().
• Use createMcpExpressApp and app.all("/mcp", ...).
• Bundle UI into single-file HTML via vite-plugin-singlefile.
• Use host CSS variables for theme compatibility.

References

• references/mcp-app-spec.md (authoritative spec, patterns, code templates, gotchas)

Assets

• assets/mcp-app-template/ (ready-to-copy MCP App skeleton with one tool + UI)