MCP Apps
How Fabric Agents shows MCP Apps, the interactive views MCP servers attach to their tools, and what a view may do.
An MCP App is an interactive view that an MCP server attaches to a tool: a chart, a form, a preview, a dashboard. Fabric Agents supports the MCP Apps extension (io.modelcontextprotocol/ui, stable revision 2026-01-26). When the agent calls a tool that has a view, the view appears in the chat under the turn's steps, while the tool runs and after it finishes. It stays there when you reopen the chat.
Nothing needs turning on. Fabric tells every MCP server it connects to that it can show apps, and servers that check for that offer their app tools.
What you can do with a view
- Use it. It gets the tool's input and result, follows Fabric's light or dark theme, and sizes itself to its content.
- Full screen. Use the button in the view's header, or let the view ask for it. Press Esc to return.
- Reload or collapse it from its header. Collapsing closes the view; expanding starts it again.
What a view may ask Fabric to do
| Request | What happens |
|---|---|
| Call a tool on its own server | Only tools the server marks as callable by apps, never on another server, and only from your own workspace's chats. A read-only tool runs. A tool that may change data follows the chat's permission mode: refused in Explore, run in Execute, and in Ask or Guarded Fabric asks you first (Allow once, Allow in this chat, or Deny). The view itself can never answer that prompt. |
| Read a resource on its own server | Allowed. |
| Send a message into the chat | Sent as your message, at most six a minute. |
| Tell the agent what it shows | Added to your next message as context, labelled as coming from the app. Only each view's latest update is sent. |
| Open a link | Web and mail links open in your browser. |
Tools only apps can call
A server can mark a tool as visible to apps only (_meta.ui.visibility: ["app"]), for example a refresh button. Fabric never lists such a tool to the agent.
Security
- Isolated. On the desktop each view runs in a sandbox on its own origin (
fabric-mcp-app://, one per workspace and server), never Fabric's. Views of one server share storage only with each other. In the Web UI a view runs in a fully isolated frame without storage. - Can't leave. A view can't navigate itself anywhere its server didn't declare: the navigation is refused before any request is made, so it can't carry data out in a URL either.
- No undeclared network access. A view may load scripts, styles and images, connect, or embed frames only from the domains its server declared for it. By default it may reach nothing. Fabric checks every declared domain and drops keywords, paths and wildcards that are too broad.
- No devices. Views can't use your camera, microphone, location or clipboard; Fabric doesn't grant those permissions to apps yet.
- Logged. Fabric logs each view's declared domains when it loads, and every call a view makes, without its arguments.
For server authors
A tool names its view in _meta.ui.resourceUri (a ui:// resource). The resource returns HTML with the MIME type text/html;profile=mcp-app, and declares in _meta.ui the domains it needs (csp.connectDomains, resourceDomains, frameDomains, baseUriDomains). Fabric doesn't grant the device permissions a view may ask for (camera, microphone, geolocation, clipboardWrite); the host context says so (hostCapabilities.sandbox.permissions is empty). Build views with the official SDK, @modelcontextprotocol/ext-apps, or speak the protocol directly. Fabric passes the standard style variables (--color-background-primary, --color-text-primary, --font-sans and the rest) and supports the inline and fullscreen display modes.
MCP Authentication
Authentication for MCP sources in Fabric Agents — bearer tokens, OAuth with dynamic client registration, token refresh, and credential storage.
REST APIs
Connect Fabric Agents to any REST API — authentication options, raw body support, query presets, and token refresh via renewEndpoint.