chore: release 0.3.0

[ochafik]

Summary

Bumps version to 0.3.0.

Breaking Changes

• viewport replaced with containerDimensions — The viewport property in host context has been replaced with containerDimensions, which provides a clearer distinction between fixed dimensions and maximum constraints. The new type allows specifying either height or maxHeight, and either width or maxWidth (PR [MCP Apps] Update viewport type #153)

• eventSource now required in PostMessageTransport — The constructor now requires an eventSource parameter to enforce security by validating message sources. This prevents potential cross-app message spoofing attacks (PR fix!: require eventSource in PostMessageTransport + add security tests #208)

New Features

• Framework examples for Vue, Svelte, Preact, and Solid — Added basic-server-vue, basic-server-svelte, basic-server-preact, and basic-server-solid examples demonstrating MCP App SDK usage across all major frontend frameworks (PR Add basic-server-* examples for Vue, Svelte, Preact, and Solid #141)

• safeAreaInsets support — Host context now includes safe area insets, allowing apps to properly handle device notches and system UI elements. All example apps updated to use this for proper padding (PR Add safeAreaInsets support to all example apps #202)

• ui.resourceUri optional — Tools that need visibility but don't require a UI resource can now omit resourceUri in the schema (PR Make ui.resourceUri optional (for tools that just need visibility) #210)

• Method names exported as constants — MCP method names are now exported as typed constants, enabling easier external library integration without brittle schema introspection (PR feat: export method names as consts #192)

• Example servers publishable to npm — All 15 example servers are now published to npm under @modelcontextprotocol scope. Users can run examples directly via npx @modelcontextprotocol/server-basic-react etc. (PR feat: publish example servers to npm #184)

• toolInfo.id optional — Aligned TypeScript types with spec by making toolInfo.id optional, allowing hosts to pass just the tool definition (PR fix: make toolInfo.id optional per spec #216)

New Examples

• Video resource server — Demonstrates video resource handling with proper mimeType declarations (PR feat(examples): Add video-resource-server example #175)
• Sheet music server — Interactive sheet music notation example (PR Add sheet-music-server example #196)

Developer Experience

• npm start alias — Added npm start as alias for npm run examples:start (PR Add npm start alias for examples:start #183)
• Examples cleanup — Improved consistency across example servers (PR Clean up examples #182)
• Documentation fixes — Fixed tsc command in docs to use tsconfig.json (PR docs: fix tsc command to use tsconfig.json #188)

Security Fixes

• PostMessageTransport origin verification — Added proper source validation to default constructor and sandbox proxy to prevent cross-origin message spoofing (PR fix: Add missing origin parameter to PostMessageTransport default constructor, verify origins in example sandbox proxy #207)
• Security E2E tests — Added 14 comprehensive tests for origin validation and cross-app message injection protection (PR fix!: require eventSource in PostMessageTransport + add security tests #208)

Bug Fixes

• Move prettier to dev dependency — Fixed incorrect dependency classification (PR fix: move prettier to dev dependency #179)
• Fix build errors in examples — Resolved build issues across example servers (PR Fix build errors in examples #180)
• Host resilience improvements — Server connections now use Promise.allSettled so one failure doesn't crash the entire UI (PR fix: make example host more resilient to broken servers #206)
• E2E test reliability — Fixed flaky Three.js E2E tests with reliable canvas ID masking (PR fix: make example host more resilient to broken servers #206)

---

Note: A backward compatibility shim for the deprecated viewport property is available in PR #TBD (branch ochafik/viewport-compat-shim). Consider merging that first if backward compat is needed.

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/ext-apps

npm i https://pkg.pr.new/modelcontextprotocol/ext-apps/@modelcontextprotocol/ext-apps@204

@modelcontextprotocol/server-basic-react

npm i https://pkg.pr.new/modelcontextprotocol/ext-apps/@modelcontextprotocol/server-basic-react@204

@modelcontextprotocol/server-basic-vanillajs

npm i https://pkg.pr.new/modelcontextprotocol/ext-apps/@modelcontextprotocol/server-basic-vanillajs@204

@modelcontextprotocol/server-budget-allocator

npm i https://pkg.pr.new/modelcontextprotocol/ext-apps/@modelcontextprotocol/server-budget-allocator@204

@modelcontextprotocol/server-cohort-heatmap

npm i https://pkg.pr.new/modelcontextprotocol/ext-apps/@modelcontextprotocol/server-cohort-heatmap@204

@modelcontextprotocol/server-customer-segmentation

npm i https://pkg.pr.new/modelcontextprotocol/ext-apps/@modelcontextprotocol/server-customer-segmentation@204

@modelcontextprotocol/server-scenario-modeler

npm i https://pkg.pr.new/modelcontextprotocol/ext-apps/@modelcontextprotocol/server-scenario-modeler@204

@modelcontextprotocol/server-system-monitor

npm i https://pkg.pr.new/modelcontextprotocol/ext-apps/@modelcontextprotocol/server-system-monitor@204

@modelcontextprotocol/server-threejs

npm i https://pkg.pr.new/modelcontextprotocol/ext-apps/@modelcontextprotocol/server-threejs@204

@modelcontextprotocol/server-wiki-explorer

npm i https://pkg.pr.new/modelcontextprotocol/ext-apps/@modelcontextprotocol/server-wiki-explorer@204

commit: 0263c65