Build1 publisher3 min readPublished
MCP Apps pairs some tool responses with an HTML resource the host renders
AWS's Bedrock AgentCore walkthrough deploys a sample MCP server whose four tools carry two widget resources. The hosting properties it leans on are session isolation and a single endpoint that AI hosts can reach.
The Engineer · Build desk
What happened
- MCP Apps extends the Model Context Protocol with interactive HTML widgets that render directly inside AI hosts, and AWS has published a walkthrough for deploying one on Amazon Bedrock AgentCore.
- The sample app, Unicorn Rentals, backs its tools with two resources, unicorn-list and booking-confirmation, which supply the widget HTML for a response.
- AWS WAF checks each request against an IP allowlist and managed rules before the Gateway routes it on to the AgentCore runtime.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- decision Widget HTML becomes an artifact shipped and versioned alongside the tool schema, and the team owning the tool now decides per response whether a card is worth building at all.
- constraint An IP allowlist in front of the endpoint has to name its callers, so reachability for this design depends on egress addresses owned by the companies running the AI hosts.
- capability One deployed server can present the same interface in several AI hosts with no per-host client code, provided each host implements the Apps extension.
- precedent If hosts adopt the extension widely, a service team's integration work stops at a JSON tool result and starts including the markup a stranger's chat window will draw.
Registration is one field. You hand the host an MCP server URL, and the host calls `tools/list` and `resources/list` against the endpoint the AgentCore Gateway exposes [4]. The tools are the ones you already had. The resources are the new part: `unicorn-list` and `booking-confirmation` supply the widget HTML for the responses that render [6].
That makes the unit of adoption a resource per rendered response. The sample exposes four tools and two widget resources [5][6], so two of the four responses come back without one [13]. AWS shows one of them. Ask "Show me my unicorn bookings" and the answer is text, because in AWS's words not every request needs a rich interface [10]. The return flow likewise computes total cost from duration and hourly rate and reports it in the conversation [16].
Two properties carry the hosting story. AgentCore runtime is described as a secure, serverless, session-isolated host with native MCP support [2]. AgentCore Gateway puts a single secure endpoint in front of it that MCP Apps-compatible hosts can reach [3]. If you keep this server on your own infrastructure, those are the two things you have to reproduce: state kept apart per session for concurrent users, and one address a third-party host can resolve and call. Behind the runtime, the sample's business logic is a Lambda function with DynamoDB for persistence [9], and the Gateway invokes the runtime under an IAM execution role [8].
In front of the endpoint sits AWS WAF, validating each request against an IP allowlist and managed rules before the Gateway routes it to the runtime [7]. An allowlist has to enumerate its callers. The callers here are ChatGPT and Claude [11], which means the addresses belong to whoever operates those hosts. Allowlists pinned to someone else's egress ranges tend to age faster than the code behind them.
The portability claim comes with its condition attached, and AWS states it: because MCP Apps is a host-agnostic standard, the same app delivers the same experience across AI hosts that support the Apps extension [11]. The demo runs in ChatGPT [11]. For the pattern to transfer to your service, two things have to hold. Your responses need a shape worth drawing as a card, the way the fleet listing carries an image, name, description, hourly rate and availability [14]. And the hosts your users actually open have to implement the extension, since a server that returns widget HTML to a host that ignores resources is a text server with extra artifacts to version.
What AWS published is a working sample and an architecture: four prompts against a fleet of rental unicorns [12], served by one MCP server on AgentCore runtime behind one Gateway [17].
What to watch
- Whether the AI host operators publish stable egress IP ranges an allowlist can be pinned to.
- Which hosts besides ChatGPT ship the MCP Apps extension, and against which version of the spec.
- Whether AWS publishes session limits or per-session pricing for AgentCore runtime under widget traffic.