Skip to content
Back to skills

Developing Mcp Apps

ASecurity

Develop, migrate, build, and test MCP Apps for ZCode using the official MCP Apps SDK. Covers ZCode plugin manifests, persistent panel entries, host capabilities, and standalone distribution.

  • 6 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added November 7, 2026
ai-agentspythonnodegitapidatabase

Works with

  • cli
  • api
  • mcp

Security analysis

A100/100

Pro scans all 3 files and shows the line behind each finding

Scanned November 7, 2026

npx -y skills add MuLiuSaMa/MeowCode --skill developing-mcp-apps --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Developing Mcp Apps?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Developing Mcp Apps
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/muliusama-developing-mcp-apps/badge)](https://www.skillsdirectory.com/skills/muliusama-developing-mcp-apps)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: developing-mcp-apps
description: Develop, migrate, build, and test MCP Apps for ZCode using the official MCP Apps SDK. Covers ZCode plugin manifests, persistent panel entries, host capabilities, and standalone distribution.
---

# Develop MCP Apps for ZCode

Use the official `@modelcontextprotocol/ext-apps` package for page communication and the official MCP server SDK for tools/resources. A separate ZCode SDK package is not required.

Read the installed SDK types and its [official quickstart](https://github.com/modelcontextprotocol/ext-apps/blob/main/docs/quickstart.md) for standard APIs. Keep SDK dependencies pinned in the plugin build lockfile; do not mix server examples from different major SDK versions.

For ZCode-specific behavior, read [host extensions](references/zcode-host.md). Use [the page example](assets/app.ts) for connection ordering and session widget state. Adapt it to the plugin's needs; it is source owned by the plugin, not a separately versioned runtime dependency.

## Development boundary

- Keep exactly one `App` per page. Register handlers before connecting. If a small loader reads a large UI bundle through MCP resources, pass the same client and its captured initial data to the UI.
- Use `app.callServerTool` and `app.readServerResource` for the plugin's own server. Do not import application source or use workspace dependencies on the ZCode repository.
- Check `getHostCapabilities()` for optional operations and ZCode extensions. A missing required capability needs a clear unsupported message; do not silently change persistence semantics.
- Keep committed documents in the plugin's server, file, or database owner. Host widget state is temporary presentation state. Preserve revision/conflict and cancellation behavior during migrations.
- Existing compatibility pages may use the host's injected `window.zcode` API. Do not access it on a page that creates an official `App`, because it may establish a second connection.

## Build and verify

In zcode-plugins, source/build inputs live in `ui-plugins/<name>/`; install metadata, skills, README and licenses live in `plugins/<name>/`. `pnpm build` bundles and stages runtime files into install directories. Keep developer `node_modules`, tests, and source-only files outside those directories.

1. Update the plugin contract and meaningful tests before changing behavior.
2. Build the actual server and self-contained UI; ship required fonts, workers, WASM, licenses, and external runtime data dependencies.
3. Run `pnpm typecheck`, `pnpm lint`, `pnpm test`, `pnpm test:artifacts`, `python3 scripts/validate.py`, and `python3 scripts/build_dist.py`.
4. Test the built package outside the checkout. In ZCode verify tool launch, manual panel open, theme, resource load, close/reopen, state restoration, and failure/cancellation paths. Report checks that were not executed.
5. For installable changes, bump both the manifest and matching root marketplace version; keep source package/server versions consistent. Plugin versions evolve independently from the host application.

Do not publish, install into a production profile, or send messages merely because this skill was loaded; follow the user's requested scope.

Files in this skill

  • SKILL.md3.1 KB
  • assets/app.ts1.1 KB
  • references/zcode-host.md4.1 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.