Hi all! We've just released @modelcontextprotocol/ext-apps v0.4.0 with new protocol capabilities, improved security controls, and exciting new examples. Here's what's changed:

Key Highlights

• ui/update-model-context (App.updateModelContext) — New protocol method enabling guests to dynamically update their model context. Apps can now provide real-time context updates to the host without a full refresh (feat: add ui/update-model-context #125)

• Enhanced sandbox capability negotiation — Hosts can now configure more granular security policies with frameDomains, baseUriDomains, and Permission Policy options (e.g., camera, microphone, geolocation) for tighter sandboxing control (feat: enhance sandbox capability negotiation #158)

• Structured tool output — Example servers now demonstrate structuredContent with outputSchema for improved data handling and type-safe responses. Results can also include _meta for host-only data not shared with the model (feat: use structuredContent with outputSchema in example servers #220)

New Examples

• transcript-server — Live speech transcription using the Web Speech API (examples: add transcript-server example with live speech transcription #240)
• map-server — CesiumJS-based 3D globe visualization with location search and markers (examples: Add CesiumJS Map App example #235)
• shadertoy-server — WebGL shader rendering demonstration (Add shadertoy-server example for WebGL shader rendering #226)

API & Protocol Changes

• ui/update-model-context method added to protocol for dynamic context updates
• Enhanced sandbox capabilities in host context with new domain configuration options

Platform & DX

• Dev mode with auto-restart — npm start now runs examples in dev mode with --watch, automatically restarting on changes (feat(examples): add --watch to bun serve commands for auto-restart, and have npm start hit dev mode of all examples #246)
• Collapsible panels in basic-host — Improved host UI with collapsible sections and SDK type support (feat(basic-host): improve host UI with collapsible panels and SDK types #244)
• Added AGENTS.md and CLAUDE.md for AI assistant guidance (Add {AGENTS,CLAUDE}.md for AI assistant guidance #218)
• Restored educational comments in basic-server-* examples (Restore educational comments in basic-server-* examples #228)
• Support for safeAreaInsets and type-checking in video-resource-server (Support safeAreaInsets + type-checking in video-resource-server #212)
• Updated README with "How It Works" section and quickstart improvements (Update quickstart guide #155, Add "How It Works" section to README #209)

Bug Fixes

• Fixed CSP handling in basic-host sandboxing via HTTP headers, proper worker-src and document.write handling (fix: proper CSP handling in basic-host sandboxing (HTTP headers, worker-src, document.write) #234, fix: follow-up to PR #234 (remove accidental file, revert from document.write to equiv. srcdoc) #248)
• Fixed system-monitor-server (Add missing refresh-stats tool to system-monitor-server #227)
• Aligned CSP sample configuration with resourceDomains spec (fix: align CSP sample with resourceDomains spec #233)
• Added error handling for server startup failures (fix: add error handling for server startup failures #236)
• Updated qr-server SDK to 0.3.1 (fix(qr-server): Update SDK to 0.3.1 with app-with-deps bundle #247)

Full Changelog: v0.3.1...v0.4.0