Individual skill
chat-apps-ui-sdk
Interactive UI rendered inside ChatGPT or Claude — OpenAI Apps SDK apps, MCP Apps (the @modelcontextprotocol/ext-apps standard), or MCP-UI components, with a Next.js/React server. Covers the MCP tool and resource architecture, the window.openai / ui-bridge data flow, widget state, sandbox/CSP security, display modes, visual design, and directory submission. Trigger when building, reviewing, or designing such apps — even when the user only says "chat app", "ChatGPT widget", "Claude app", "render UI in chat", "window.openai", "createUIResource", "outputTemplate", or "MCP app UI" without naming a specific SDK.
skills/.experimental/chat-apps-ui-sdk/SKILL.md
Source commit cf93c57cac89d6fc3e4194686000411567f5caf3
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Instructions only
- Last checked
- Nov 5, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 221
- Repository last updated
- Aug 15, 2026
- License
- MIT
Observed agent integration: codex
- design Derived category
- engineering Derived category
- data Derived category
- security Derived category
- design-interface Derived category
- engineering-web Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
AGENTS.mddoc · 10,972 bytesSKILL.mdcore · 9,803 bytesSKILL.mdcore · 9,803 bytesassets/templates/_template.mddoc · 1,630 bytesmetadata.jsonasset · 1,912 bytesreferences/_sections.mddoc · 4,222 bytesreferences/bridge-call-tools-app-visibility.mddoc · 1,489 bytesreferences/bridge-followup-vs-silent-call.mddoc · 1,453 bytesreferences/bridge-handle-all-mcpui-actions.mddoc · 1,374 bytesreferences/bridge-render-from-notifications.mddoc · 1,544 bytesreferences/bridge-use-host-apis.mddoc · 1,394 bytesreferences/bridge-validate-postmessage-origin.mddoc · 1,364 bytesreferences/design-inherit-native-typography.mddoc · 1,138 bytesreferences/design-limit-actions-hierarchy.mddoc · 1,136 bytesreferences/design-meet-wcag-contrast.mddoc · 1,101 bytesreferences/design-render-loading-empty-error.mddoc · 1,241 bytesreferences/design-respect-reduced-motion.mddoc · 1,016 bytesreferences/design-restrain-brand-color.mddoc · 1,154 bytesreferences/display-avoid-nested-scroll.mddoc · 1,131 bytesreferences/display-pick-the-right-mode.mddoc · 1,268 bytesreferences/display-report-intrinsic-height.mddoc · 1,305 bytesreferences/display-request-mode-with-fallback.mddoc · 1,273 bytesreferences/display-respect-theme.mddoc · 1,314 bytesreferences/display-responsive-breakpoints.mddoc · 1,177 bytesreferences/dist-build-on-mcp-apps-standard.mddoc · 1,293 bytesreferences/dist-degrade-without-ui.mddoc · 1,215 bytesreferences/dist-feature-detect-host-apis.mddoc · 1,128 bytesreferences/dist-provide-submission-metadata.mddoc · 1,186 bytesreferences/sec-avoid-frame-domains.mddoc · 1,362 bytesreferences/sec-declare-csp-allowlist.mddoc · 1,315 bytesreferences/sec-enforce-server-side-auth.mddoc · 1,150 bytesreferences/sec-minimize-restricted-data.mddoc · 1,222 bytesreferences/sec-no-secrets-in-payloads.mddoc · 1,288 bytesreferences/sec-signal-oauth-challenge.mddoc · 1,324 bytesreferences/state-keep-state-small.mddoc · 1,040 bytesreferences/state-no-secrets-in-state.mddoc · 1,143 bytesreferences/state-persist-widget-state.mddoc · 1,296 bytesreferences/state-separate-three-stores.mddoc · 1,672 bytesreferences/state-update-model-context.mddoc · 1,307 bytesreferences/tool-feed-widget-in-response.mddoc · 1,475 bytesreferences/tool-honest-descriptions.mddoc · 1,438 bytesreferences/tool-minimal-scoped-inputs.mddoc · 1,365 bytesreferences/tool-output-schema-validation.mddoc · 1,639 bytesreferences/tool-safety-annotations.mddoc · 1,452 bytesreferences/tool-specific-verb-names.mddoc · 1,322 bytesreferences/tool-structured-content-contract.mddoc · 1,763 bytesreferences/wire-inline-self-contained-bundle.mddoc · 1,499 bytesreferences/wire-mcp-app-mimetype.mddoc · 1,247 bytesreferences/wire-resource-uri-link.mddoc · 1,454 bytesreferences/wire-set-ui-domain.mddoc · 1,301 bytesreferences/wire-ui-scheme-and-handler.mddoc · 1,343 bytesreferences/wire-version-uri-cache-key.mddoc · 1,243 bytes
Read excerpt
# Chat Apps UI SDK Best Practices
A reference for building beautiful, review-ready apps that render interactive UI inside the chat surface of ChatGPT and Claude. As of January 2026 these platforms share one foundation — the **MCP Apps** standard (`@modelcontextprotocol/ext-apps`), rendered by Claude, ChatGPT, VS Code, and Goose. The **OpenAI Apps SDK** is a superset adding the `window.openai` bridge, and **MCP-UI** (`@mcp-ui/server` / `@mcp-ui/client`) is the community implementation. This skill contains 46 rules across 8 categories, ordered by impact so the highest-leverage decisions come first.
The mental model: an app is an **MCP tool first, UI second**. The model invokes a tool; the tool returns data plus a link to a UI resource; the host renders that resource in a sandboxed iframe; the iframe talks back over a defined bridge. Mistakes early in that chain mean nothing renders; mistakes later mean it renders broken, unsafe, or unpolished.
## When to Apply
Reference these guidelines when:
- Designing the MCP tool and `structuredContent` / `content` / `_meta` contract for a chat app
- Wiring a tool to a component (`_meta.ui.resourceUri`, the `text/html;profile=mcp-app` MIME type, the `ui://` scheme)
- Writing the iframe component and its bridge (`window.openai`, `ui/notifications/*`, MCP-UI `onUIAction`)
- Choosing display modes, widget state, theming, and responsive layout
- Hardening a chat app (CSP, sandbox, secrets, OAuth) or preparing it for directory submission
- Reviewing or refactoring existing ChatGPT-app / Claude-app / MCP-UI code