feat: add MCP Apps (SEP-1865) support

[mattdholloway]

Adds opt-in MCP Apps (SEP-1865) support to the SDK.

What

• New enableMcpApps session capability (SessionConfig + ResumeSessionConfig). When true, the runtime advertises the extensions.io.modelcontextprotocol/ui extension to MCP servers and exposes the session.rpc.mcp.apps.{listTools,callTool,readResource,setHostContext,getHostContext} JSON-RPC methods. Defaults to false so hosts without an iframe renderer don't accidentally register UI-enabled tool variants they can't display.
• Two new pure helpers in the Node SDK for hosts that render ui:// MCP App bundles in iframes:
  • buildMcpAppsCspHeader(csp) — builds the Content-Security-Policy header per SEP-1865 §UI Resource Format + §Security Implications. Emits the restrictive default (connect-src 'none') when _meta.ui.csp is absent, and the constructed default (connect-src 'self' + declared domains, etc.) when it is declared (even with empty arrays).
  • buildMcpAppsAllowAttribute(permissions) — maps _meta.ui.permissions to the iframe allow attribute (Permission Policy), including the hyphenated clipboard-write name.
• Regenerated RPC/session-event types across Node, Python, Go, .NET, and Rust to pick up the new schema.

 sequenceDiagram
     autonumber
     participant Host as Host App
     participant SDK as Copilot SDK
     participant Sandbox as mcpAppsSandbox helpers
     participant Conn as JSON-RPC Connection
     participant Runtime as Copilot Runtime
     participant Iframe as ui iframe
 
     Note over Host,Runtime: 1. Opt-in via SDK config
     Host->>SDK: createSession({ enableMcpApps: true })
     SDK->>Conn: session.create { ..., requestMcpApps: true }
     Conn->>Runtime: JSON-RPC request
     Runtime-->>Conn: CreateSessionResponse
     Conn-->>SDK: response
     SDK-->>Host: CopilotSession
 
     Note over Runtime,Host: 2. Tool execution events forwarded unchanged
     Runtime-->>Conn: tool.execution_complete { uiResource, toolDescription._meta.ui }
     Conn-->>SDK: SessionEvent (untyped pass-through)
     SDK-->>Host: onEvent(event)
 
     Note over Host,Iframe: 3. Host builds sandboxed iframe using SDK helpers
     Host->>Sandbox: buildMcpAppsCspHeader(uiResource._meta.ui.csp)
     Sandbox-->>Host: CSP header value
     Host->>Sandbox: buildMcpAppsAllowAttribute(uiResource._meta.ui.permissions)
     Sandbox-->>Host: allow attribute value
     Host->>Iframe: render with CSP + allow + uiResource
 
     Note over Iframe,Runtime: 4. App-to-server RPCs (no typed SDK surface)
     Iframe->>Host: postMessage RPC
     Host->>Conn: raw JSON-RPC: session.rpc.mcp.apps.{listTools|callTool|readResource}
     Conn->>Runtime: forwarded
     Runtime-->>Conn: result (+ optional ephemeral mcp_app.tool_call_complete event)
     Conn-->>SDK: SessionEvent (untyped pass-through, callTool only)
     SDK-->>Host: onEvent(event)
     Conn-->>Host: RPC response
     Host-->>Iframe: postMessage response
 
     Note over Host,Runtime: 5. Resume preserves opt-in
     Host->>SDK: resumeSession({ enableMcpApps: true })
     SDK->>Conn: session.resume { ..., requestMcpApps: true }

Loading

Closes https://github.com/github/copilot-mcp-core/issues/1715
Depends on https://github.com/github/copilot-agent-runtime/pull/7605

[mattdholloway]

@copilot resolve the merge conflicts in this pull request

[github-actions]

Generated by SDK Consistency Review Agent for issue #1335 · ● 793.2K

[mattdholloway]

@copilot resolve the merge conflicts in this pull request

[github-actions]

Generated by SDK Consistency Review Agent for issue #1335 · ● 8.7M

[github-actions]

Cross-SDK consistency nit: The Python, Go, .NET, and Rust implementations all include the sessionId in this warning to help users identify which session has the issue. For example, Python logs "Session %s: enable_mcp_apps was requested..." and Go logs "[copilot-sdk] Session %s: EnableMcpApps was requested...".

The sessionId variable is available at the call sites (lines ~918 and ~1056). Consider threading it through:

function warnIfMcpAppsDropped(
    requested: boolean | undefined,
    capabilities: { ui?: { mcpApps?: boolean } } | undefined,
    sessionId: string,
): void {
    if (requested && !capabilities?.ui?.mcpApps) {
        console.warn(
            `[copilot-sdk] Session ${sessionId}: enableMcpApps was requested but the runtime did not advertise capabilities.ui.mcpApps. ...`
        );
    }
}

[Copilot]

Pull request overview

Adds opt-in MCP Apps (SEP-1865) support across the multi-language SDKs by introducing a new session opt-in flag, exposing/typing the runtime capability (capabilities.ui.mcpApps), and providing Node-only helpers for safely sandboxing ui:// iframe rendering.

Changes:

• Adds enableMcpApps / enable_mcp_apps (create + resume) and plumbs it through to the JSON-RPC wire flag requestMcpApps.
• Extends session UI capabilities types to include mcpApps and adds “opt-in dropped” warnings in each SDK when the runtime gate is off.
• Adds Node SDK sandbox helper utilities (buildMcpAppsCspHeader, buildMcpAppsAllowAttribute) with dedicated tests.

Show a summary per file

File	Description
rust/tests/e2e/elicitation.rs	Updates struct literal to account for new UiCapabilities.mcp_apps field.
rust/src/wire.rs	Adds request_mcp_apps to create/resume wire payloads (camelCase serialization).
rust/src/types.rs	Adds enable_mcp_apps to SessionConfig/ResumeSessionConfig, new builder methods, and UiCapabilities.mcp_apps.
rust/src/session.rs	Warns (via tracing::warn!) when MCP Apps was requested but not advertised by runtime capabilities.
python/copilot/session.py	Extends typed capabilities (SessionUiCapabilities) with mcpApps.
python/copilot/client.py	Adds enable_mcp_apps parameters; sends requestMcpApps; logs warning if opt-in dropped.
nodejs/test/mcpAppsSandbox.test.ts	Adds tests pinning SEP-1865 CSP/Permission Policy mapping + sanitization behavior.
nodejs/src/types.ts	Adds mcpApps capability typing and enableMcpApps config option (documented).
nodejs/src/mcpAppsSandbox.ts	Introduces pure CSP header + iframe allow attribute builders with sanitization.
nodejs/src/index.ts	Exports MCP Apps sandbox helpers from package entrypoint.
nodejs/src/client.ts	Sends requestMcpApps when enabled; warns when runtime drops opt-in.
java/src/main/java/com/github/copilot/sdk/SessionRequestBuilder.java	Plumbs enableMcpApps into requestMcpApps for create/resume payloads.
java/src/main/java/com/github/copilot/sdk/json/SessionUiCapabilities.java	Adds mcpApps capability field + Optional getter/set/clear helpers.
java/src/main/java/com/github/copilot/sdk/json/SessionConfig.java	Adds enableMcpApps config flag, docs, and clone propagation.
java/src/main/java/com/github/copilot/sdk/json/ResumeSessionRequest.java	Adds requestMcpApps to resume wire request type.
java/src/main/java/com/github/copilot/sdk/json/ResumeSessionConfig.java	Adds enableMcpApps to resume config and clone propagation.
java/src/main/java/com/github/copilot/sdk/json/CreateSessionRequest.java	Adds requestMcpApps to create wire request type.
java/src/main/java/com/github/copilot/sdk/CopilotClient.java	Emits warning when opt-in requested but runtime doesn’t advertise capability.
go/types.go	Adds EnableMcpApps config fields + RequestMcpApps wire fields + mcpApps capability.
go/client.go	Sends RequestMcpApps when enabled; emits warning when dropped.
dotnet/src/Types.cs	Adds McpApps capability + EnableMcpApps session config property (copied in clone ctor).
dotnet/src/Client.cs	Sends RequestMcpApps and logs warning when MCP Apps was requested but not advertised.

Copilot's findings

• Files reviewed: 22/22 changed files
• Comments generated: 7

[Copilot]

Copilot's findings

• Files reviewed: 23/23 changed files
• Comments generated: 2

[github-actions]

Cross-SDK Consistency Review ✅

This PR maintains excellent cross-SDK consistency. Here's the summary:

Features added across all SDKs (Node, Python, Go, .NET, Java, Rust)

Feature	Node	Python	Go	.NET	Java	Rust
enableMcpApps / enable_mcp_apps in SessionConfig	✅	✅	✅	✅	✅	✅
enableMcpApps / enable_mcp_apps in ResumeSessionConfig	✅ (via shared base)	✅	✅	✅	✅	✅
mcpApps in SessionUiCapabilities	✅	✅	✅	✅	✅	✅
warnIfMcpAppsDropped (runtime dropped opt-in warning)	✅	✅	✅	✅	✅	✅

Node-only additions

• buildMcpAppsCspHeader(csp) — builds the CSP header for MCP App iframes
• buildMcpAppsAllowAttribute(permissions) — builds the iframe allow attribute

These are intentionally Node-only per the PR description, as they are pure helpers for hosts rendering `(redacted) MCP App bundles in iframes — a use-case primarily driven by JavaScript/TypeScript renderer contexts. No consistency gap here.

API naming conventions followed correctly

• TypeScript: enableMcpApps (camelCase) ✅
• Python: enable_mcp_apps (snake_case) ✅
• Go: EnableMcpApps (PascalCase on exported struct fields) ✅
• .NET: EnableMcpApps (PascalCase) ✅
• Java: enableMcpApps / isEnableMcpApps() (camelCase per Java bean convention) ✅
• Rust: enable_mcp_apps (snake_case) ✅

No cross-SDK consistency issues found. 🎉

Generated by SDK Consistency Review Agent for issue #1335 · ● 5.1M · ◷