MCP Adds Native HTML UI Support, But Default Security Policy Blocks All External Requests

·1 views

The Model Context Protocol has introduced MCP Apps, its first native UI extension built into the stable core spec, allowing tools to declare interactive HTML interfaces rendered inside sandboxed iframes. Developers must use the exact MIME type 'text/html;profile=mcp-app' or the host will treat the resource as a plain document with no interactive features. The platform's Content Security Policy defaults to fully blocking all external domains, meaning fetch calls or CDN script loads silently fail unless each domain is explicitly whitelisted. Communication between the host and iframe relies on hand-rolled JSON-RPC over postMessage, with no client library available yet and silent message drops for malformed requests. A browser-based validator has been released at bracketly.pages.dev to help developers check their MCP Apps configurations against the published spec before hitting these pitfalls.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds browser-based collaborative sheet music editor using AI and CRDTs

A solo developer built ScoreTail, a browser-based sheet music editor designed to enable real-time collaborative score editing, similar to how Google Docs handles text. Around 90% of the code was written using AI tools, with the developer focusing on architecture decisions and defining correctness through a test suite of roughly 250 real-world scores. One of the biggest technical challenges was implementing MusicXML's backup and forward elements, which require parsers to track timeline position independently of document order across multiple voices and staves. For real-time collaboration, the project uses Yjs, a CRDT library that allows edits from multiple clients to converge automatically without server-side conflict resolution. The editor enforces musical validity on every operation, ensuring that users without formal notation knowledge still produce structurally correct scores.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Bilingual Hindi-English AI Voice Tutor for Indian Students in 10 Days

A developer participating in the #VoiceForBharat challenge created Vidya, a real-time bilingual AI voice tutor supporting English, Hindi, and Hinglish, aimed at breaking language and literacy barriers for learners across India. The system was built over 10 days using Murf Falcon text-to-speech, Deepgram Nova-3 speech recognition, LiveKit Agents, and Google Gemini as its core technologies. Vidya features a persistent memory system that recalls individual student profiles, progress levels, and past sessions to deliver personalised greetings and continuity. The tutor includes specialised tools for fetching exercises, scoring spoken answers, awarding motivational stars, and scraping live web content for up-to-date context. Additional capabilities include outbound phone calls via SIP trunking for daily study check-ins, human escalation support, and strict privacy guardrails requiring explicit user consent before storing personal data.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Interactive North Indian Gravy Guide in a Single HTML File

A developer has created 'Gravy Theory,' an interactive web guide to North Indian gravy, submitted for the DEV Community Frontend Challenge's Comfort Food Edition. The project argues that butter chicken and chicken curry share the same onion-tomato masala base, differing only in how and when the cooking is stopped and finished. An interactive dial lets users visually track the masala as it cooks through six ingredient stages, while separate sections cover timing, heat, spices, and dish variations. The entire project runs from a single HTML file of roughly 147 KB, with no frameworks, build tools, or external assets beyond Google Fonts — all visuals drawn using CSS gradients and inline SVG. The source code is publicly available on GitHub under the MIT license.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Multilingual Voice AI Tutor for India in 10-Day Sprint

A developer built Vidya Vani, a voice-first AI tutoring system, during a 10-day challenge hosted by Murf AI. The platform features two AI agents — Vidya Vani for English practice and Aryabhata for mathematics — that can hand off conversations between each other in real time. The system uses Murf Falcon text-to-speech and LiveKit WebRTC to achieve low-latency audio on Indian networks, removing the typing friction common in text-based ed-tech tools. Key features include dynamic question generation, session memory, and a live analytics dashboard. The project was designed to address the education access gap in India by making AI tutoring as natural as speaking to a real teacher.

0 comments Read more at DEV Community