Developer runs 36 controlled tests to decode silent MCP widget rendering failures

·6 views

A developer investigated a widespread but poorly documented bug where MCP App widgets silently fail to render on claude.ai despite successful tool calls and correct server responses. To study the black-box host environment without access to source code or a debugger, they built a probe server and ran 36 structured experiments on July 31, 2026. A key community-suggested fix — adding a sha256-derived domain value to the resource's _meta.ui.domain field — turned out to be risky if applied imprecisely, as a slightly incorrect value completely blocks iframe creation rather than helping. The investigation also revealed that a static visual marker requiring no JavaScript was the critical technique for determining whether the host ever created an iframe at all, eliminating entire categories of false diagnoses. The author notes that host behavior can change over time and that their own measurement data misled them twice during the process, underscoring the difficulty of debugging opaque rendering environments.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Opinion: Online Friendships Deserve Recognition as Genuine Connections

A blog post published on Bearblog argues that friendships formed online are just as valid and meaningful as those developed in person. The piece challenges the common social tendency to dismiss or undervalue relationships that exist primarily in digital spaces. The author contends that shared experiences, emotional support, and mutual understanding — hallmarks of real friendship — can all exist between people who have never met physically. The post gained traction on Hacker News, accumulating 13 points from the community.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Qwen2.5-Coder Edges DeepSeek-Coder in Local Solidity Security Reviews at 7B Scale

A developer tested Qwen2.5-Coder and DeepSeek-Coder locally via Ollama on WSL2, running both 7B-and-below models against ten small Solidity contracts containing deliberately planted security bugs. Each contract was evaluated using three prompt types — open-ended, targeted, and structured — with results scored manually on bug detection, accuracy, and output noise. Qwen2.5-Coder showed a clear advantage in instruction-following, consistently respecting structured output formats critical for automated pipelines. While DeepSeek-Coder matched Qwen on detecting classic vulnerabilities, it more frequently drifted off-topic and produced generic explanations rather than specific attack sequences. The author notes the comparison was motivated by model selection for an open-source auditing tool and cautions that neither model is suited for large, real-world contract audits.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Investigation Exposes How Big Food Industry Fights Public Health Policies

A new investigative report by Lighthouse Reports examines how major food corporations resist public health regulations aimed at improving nutrition. The investigation suggests that large food companies deploy lobbying and other tactics to counter policies that could limit their profits. The report highlights the tension between corporate interests and efforts by governments or health advocates to protect consumers. It raises concerns about the influence the food industry wields over regulatory and legislative processes. The findings have drawn attention online, sparking discussion about accountability in the food sector.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

React challenger Octane debuts; TanStack drops RSC; npm to scan for malware at publish

Octane, a new framework from former React and Svelte contributor Dominic Gannaway, compiles React's programming model — including Hooks, Suspense, and Actions — ahead of time, eliminating the Virtual DOM and manual dependency arrays. The project launches with built-in integrations for TanStack, React Three Fiber, and other popular libraries. TanStack has moved its website away from React Server Components, instead adopting SSR alongside two new lightweight packages, TanStack Markdown and TanStack Highlight, to improve performance. npm announced it will begin scanning packages for malware at publish time, adding a new layer of supply-chain security. Additionally, several JavaScript proposals advanced at a recent TC39 meeting, and Core Web Vitals will now measure soft navigations in single-page applications.

0 comments Read more at DEV Community