OptionalallowUnsafeEval?: booleanAllow code paths that require CSP unsafe-eval (e.g. new Function()).
Views typically run under a strict CSP without unsafe-eval. Zod's JIT
object parser uses new Function() and throws on the first message parse
under such a policy. By default (allowUnsafeEval: false) the
App constructor sets z.config({ jitless: true }) so the
SDK works out of the box under the spec's default CSP. Set
allowUnsafeEval: true to skip that and keep the faster JIT path when
the host's CSP permits unsafe-eval.
OptionalautoResize?: booleanAutomatically report size changes to the host using ResizeObserver.
When enabled, the App monitors document.body and document.documentElement
for size changes and automatically sends ui/notifications/size-changed
notifications to the host.
Optionalstrict?: booleanThrow on detected misuse instead of logging a console warning.
Currently this affects calling host-bound methods (e.g.
callServerTool, sendMessage)
before connect has completed the ui/initialize
handshake. With strict: false (default) a console.warn is emitted;
with strict: true an Error is thrown.
OptionalwebMcpBridge?: booleanBridge tools between the Apps SDK and WebMCP, in both directions:
registerTool are
mirrored into document.modelContext when the document provides one,
so WebMCP-enabled hosts discover them without speaking the Apps
tools/list channel (the tools/list / tools/call wire path is
unaffected either way);document.modelContext are served over
the Apps tools/list / tools/call channel, so WebMCP-authored Views
work on MCP Apps hosts that do not provide WebMCP themselves. Tools
registered with registerTool win on name
collisions, and tools the App itself mirrored into
WebMCP are never echoed back.Pass false to disable the bridge.
Options for configuring
Appbehavior.Extends
ProtocolOptionsfrom the base MCP SDK withApp-specific configuration.