One read of Model Context Protocolmcp-20261109T133707Z
13 pages moved out of 360 read.
What this read moved
1-13 of 13community/antitrust Changed · +1 / -7 lines
community/charter-template Changed · +34 / -69 lines
## Submitting a charter ## Template ## Example Mission Statements
community/communication Changed · +18 / -96 lines
# Communication ## Channels ## Decision records # Contributor Communication ## Communication Channels ### Public Channels (Default) ### Private Channels (Exceptions) ## GitHub Discussions ## GitHub Issues ## Security Issues ## Decision Records
community/contributor-ladder Changed · +86 / -305 lines
## Roles at a glance ## Leading a working or interest group ## Advancement process ## Escalation ## Inactivity, stepping down and removal ### Inactivity ### Stepping down ### Emeritus status ### Removal ## Guiding Principles ## Roles at a Glance ## Working Group and Interest Group Leadership ## Advancement Process ### Self-Nomination vs. Recognition ### Process Steps ## Decision-Making and Escalation ### Delegation as Default ### Escalation Matrix ## Contribution Pathways ## Stepping Down and Emeritus Status ## Recognition and Visibility
community/design-principles Changed · +7 / -13 lines
community/feature-lifecycle Changed · +61 / -71 lines
# Feature Lifecycle and Deprecation # Feature Lifecycle and Deprecation Policy
community/policies New page · 35 lines, new page
# Project Policies ## Code of Conduct ## Antitrust ## Licensing and intellectual property ## AI-assisted contributions ## Reporting a vulnerability ## Communication and records
A whole new page. There's nothing to diff it against, so here is what it says.
# Project Policies > The standing policies that apply to everyone who takes part in the MCP project, and where each one is defined. This page lists the policies that apply to everyone who takes part in the MCP project: in meetings, on Discord, and in every repository under the [`modelcontextprotocol`](https://github.com/modelcontextprotocol) organization. Group Leads and Facilitators link it from meeting agendas. ## Code of Conduct The [Code of Conduct](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/CODE_OF_CONDUCT.md) governs every channel, repository and meeting. Send reports to [[email protected]](mailto:[email protected]). The [Community Moderators](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/MAINTAINERS.md#community-moderators) handle them under the [Contributor Ladder](https://modelcontextprotocol.io/community/contributor-ladder.md#community-moderator) and escalate to Core Maintainers when needed. ## Antitrust Participants often work for competing organizations. MCP is organized as Model Context Protocol a Series of LF Projects, LLC, so the [LF Projects policies](https://www.lfprojects.org/policies/), including its antitrust policy, apply to all participants. The project's own [Antitrust Policy](https://modelcontextprotocol.io/community/antitrust.md) sets out how meetings and standard-setting discussions are conducted. ## Licensing and intellectual property Code and specification contributions are made under the Apache License 2.0 and other documentation under CC-BY-4.0, with no copyright assignment. The governing text is [General Project Policies](https://modelcontextprotocol.io/community/governance.md#general-project-policies). ## AI-assisted contributions Any AI assistance used for a contribution must be disclosed in the pull request or issue, together with its extent. This includes AI-written review responses and comments; trivial spacing or typo fixes are the only exception. The full policy is [AI\_POLICY.md](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/AI_POLICY.md), which applies to every repository in the organization. ## Reporting a vulnerability > [!WARNING] > > Do not report security issues in public issues, discussions or pull requests. Open a private advisory on the affected repository at `github.com/modelcontextprotocol/<repo>/security/advisories/new`. Private vulnerability reporting is enabled on the specification repository and on every official SDK and project repository. Before filing, read [SECURITY.md](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/SECURITY.md): it says [what to include](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/SECURITY.md#what-to-include), describes the [trust model and the behaviors that are intentional rather than vulnerabilities](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/SECURITY.md#intended-behaviors-and-trust-model) (stdio command execution, denial of service by a stdio peer, server side effects, LLM-driven tool invocation), and lists [what remains in scope](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/SECURITY.md#what-remains-in-scope). The maintainers who receive a report coordinate the fix and advisory across every affected SDK so that advisories are released together, and raise it with the specification maintainers when the root cause is in the specification (see [SDK Vulnerability Disclosure](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/SECURITY.md#sdk-vulnerability-disclosure)). CVEs are assigned through GitHub's CNA. Questions that are not themselves a report, including which repository to file against, go to the [Security Interest Group](https://modelcontextprotocol.io/community/interest-groups/security.md) in `#security-ig`. ## Communication and records [Communication](https://modelcontextprotocol.io/community/communication.md) sets out which channel is for what, when a channel may be private, and where decisions are recorded.
community/sdk-tiers Changed · +34 / -71 lines
# SDK Tiers ## Tier requirements ## Conformance testing ## Tier advancement ## Tier relegation ## Issue triage labels # SDK Tiering System ## Overview ## Tier Requirements ## Conformance Testing ## Tier Advancement ## Tier Relegation ## Issue Triage Labels
community/security Page removed · 66 lines, page removed
# Security Policy ## Reporting a vulnerability ## SDK disclosure and cross-SDK coordination ## Scope ### Stdio transport trust boundary ## Security Interest Group
The page is gone upstream. What it last said is kept here.
community/sep-guidelines Changed · +83 / -224 lines
## When you need a SEP ## SEP types ## Before you write ## Workflow ## Sponsors ## Review and acceptance ## After the decision ## Template and tooling ## What is a SEP? ## When to Write a SEP ## SEP Types ## SEP Workflow ### Step-by-Step Process ### SEP Statuses ## SEP Format ### 1. Preamble ### 2. Abstract ### 3. Motivation ### 4. Specification ### 5. Rationale ### 6. Backward Compatibility ### 7. Reference Implementation ### 8. Security Implications ## The Sponsor Role ## Status Management ## SEP Review & Resolution ## After Rejection ## Reporting SEP Bugs or Updates ## Transferring SEP Ownership ## Copyright
community/working-groups/apps New page · 123 lines, new page
# MCP Apps Working Group Charter ## Group Type ## Mission Statement ## Scope ### In Scope ### Out of Scope ### Related Groups ## Leadership ## Authority & Decision Rights ## Membership ## Operations ## Resources ## Deliverables & Success Metrics ### Active Work Items ### Success Criteria ## Changelog
A whole new page. There's nothing to diff it against, so here is what it says.
# MCP Apps Working Group Charter > Charter for the MCP Apps Working Group. ## Group Type **Working Group** ## Mission Statement The MCP Apps Working Group defines, evolves, and maintains the official extension for interactive user interfaces over MCP. The working group oversees the extension specification, SDK, reference implementations, security model, conformance work, and guidance so that apps can run safely and consistently across independent MCP hosts. ## Scope ### In Scope * **Specification Work**: The [MCP Apps extension specification](https://github.com/modelcontextprotocol/ext-apps/tree/main/specification) and related SEPs, covering the areas below under the `io.modelcontextprotocol/ui` namespace. * **App Lifecycle**: How apps are declared, initialized, persisted, and torn down, including UI resource declaration and tool metadata. * **App Interaction Model**: The interaction protocol between user, app, and host, such as bi-directional messaging, app tools, etc. * **Content Types and Rendering Targets**: Support for different content types and methodologies like generative UI, with interoperability with external protocols such as [A2UI](https://a2ui.org/) and [AG-UI](https://ag-ui.com/). * **Security Model**: The threat model, sandboxing, security policy, permissions, and auditability of UI-initiated actions. * **SDKs and Reference Implementations**: The [`@modelcontextprotocol/ext-apps`](https://github.com/modelcontextprotocol/ext-apps) SDK, reference host, example servers, and host integration examples. * **Conformance**: Compatibility tests, app validation, and the definition of conformance requirements for apps and hosts. * **Cross-Cutting Coordination**: App discovery and metadata (with the Registry WG), UI in agentic flows (with the Agents IG), and per-language SDK support (with the SDK WG). * **Documentation**: API references, authoring guidance, host integration guidance, starter resources, and examples. ### Out of Scope * **Core protocol ownership**: Changes to base MCP semantics, transports, or lifecycle are proposed through the [SEP process](https://modelcontextprotocol.io/community/sep-guidelines.md) and owned by the relevant group or Core Maintainers. * **Host-specific product and design decisions**: Hosts control their user experience and visual design. The WG standardizes the interoperability and security contract. * **Individual app implementations**: Apps built on the extension remain the responsibility of their authors. * **General agent orchestration**: Agent loops and sub-agent coordination belong to the Agents IG, and task management belongs to the Tasks and Events WG. This WG covers only the interactive UI surface and its integration points. ### Related Groups * **Agents IG**: Interactive UI within agentic flows and task lifecycles. * **[Registry WG](https://modelcontextprotocol.io/community/working-groups/registry.md)**: App discovery, distribution, and metadata. * **[Security IG](https://modelcontextprotocol.io/community/interest-groups/security.md)**: Sandboxing, permissions, and review of UI-initiated actions. * **[SDK WG](https://modelcontextprotocol.io/community/working-groups/sdk.md)**: SDK consistency and support outside the TypeScript reference implementation. ## Leadership | Role | Name | Organization | GitHub | Term | | - | - | - | - | - | | Lead | Ido Salomon | MCP-UI | [@idosal](https://github.com/idosal) | Initial | | Lead | Liad Yosef | MCP-UI / Ora | [@liady](https://github.com/liady) | Initial | | Lead | Olivier Chafik | Anthropic | [@ochafik](https://github.com/ochafik) | Initial | ## Authority & Decision Rights | Decision Type | Authority Level | | - | - | | Meeting logistics & scheduling | WG Leads (autonomous) | | Proposal prioritization within WG | WG Leads (autonomous) | | SEP triage & closure (in scope) | WG Leads (autonomous, with documented rationale) | | Technical design within scope | WG consensus | | Spec changes (additive) | WG consensus → Core Maintainer approval | | Spec changes (breaking/fundamental) | WG consensus → Core Maintainer approval + wider review | | Scope expansion | Core Maintainer approval required | | WG Member approval | WG Member sponsors | ## Membership | Name | Organization | GitHub | Discord | Level | | - | - | - | - | - | | Ido Salomon | MCP-UI | [@idosal](https://github.com/idosal) | | Lead | | Liad Yosef | MCP-UI / Ora | [@liady](https://github.com/liady) | | Lead | | Olivier Chafik | Anthropic | [@ochafik](https://github.com/ochafik) | | Lead | | Anton Pidkuiko | Anthropic | [@antonpk1](https://github.com/antonpk1) | | WG Member | | Max Stoiber | OpenAI | [@mstoiber-oai](https://github.com/mstoiber-oai) | | WG Member | | Dominic Farolino | Google | [@domfarolino](https://github.com/domfarolino) | | WG Member | ## Operations | Meeting | Frequency | Duration | Purpose | | - | - | - | - | | Working Session | Tri-weekly (Wednesday, 08:00 Pacific) | 60 minutes | Specification review, roadmap discussion, and app/host feedback | Meetings are published on the [MCP community calendar](https://meet.modelcontextprotocol.io/tag/mcp-apps-wg) under the `#mcp-apps-wg` tag. Agendas and notes are maintained in the public [MCP Apps Working Group agenda](https://docs.google.com/document/d/103S6IjN9D80ntbPIcK3mP_ZWdeFom2Mq8qpkpIsXRVI/edit) and linked from calendar entries. Discord: `#mcp-apps-wg` ## Resources * Specification and SDK: [modelcontextprotocol/ext-apps](https://github.com/modelcontextprotocol/ext-apps) (`@modelcontextprotocol/ext-apps`) * Foundational proposal: [SEP-1865](https://modelcontextprotocol.io/seps/1865-mcp-apps-interactive-user-interfaces-for-mcp.md) * Guides: [MCP Apps overview](https://modelcontextprotocol.io/extensions/apps/overview.md) and [Build an MCP App](https://modelcontextprotocol.io/extensions/apps/build.md) * API documentation: [apps.extensions.modelcontextprotocol.io](https://apps.extensions.modelcontextprotocol.io/) * Work tracking: [ext-apps issues](https://github.com/modelcontextprotocol/ext-apps/issues) and [pull requests](https://github.com/modelcontextprotocol/ext-apps/pulls) ## Deliverables & Success Metrics ### Active Work Items Live work is tracked in the ext-apps [issue tracker](https://github.com/modelcontextprotocol/ext-apps/issues) and [pull requests](https://github.com/modelcontextprotocol/ext-apps/pulls). Headline workstreams are: | Item | Status | Target Date | Champion | | - | - | - | - | | Specification and SDK evolution: protocol alignment, capability negotiation, versioning, and maintenance of `@modelcontextprotocol/ext-apps` | In Progress | | [@idosal](https://github.com/idosal), [@liady](https://github.com/liady), [@ochafik](https://github.com/ochafik) | | Address view sprawl across tools and servers (reusable and independent views) | In Progress | | [@mstoiber-oai](https://github.com/mstoiber-oai), [@idosal](https://github.com/idosal), [@liady](https://github.com/liady) | | Formalize security model and extend sandboxing and permissions | In Progress | | [@idosal](https://github.com/idosal) | | Experiment with the app tools interaction model (WebMCP approach) | In Progress | | [@ochafik](https://github.com/ochafik) | | Address dynamic resource content and non-HTML hosts | Draft | | [@liady](https://github.com/liady), [@idosal](https://github.com/idosal) | | Conformance and cross-host interoperability: official validator, public platform tests, and compatibility reporting | In Progress | | [@idosal](https://github.com/idosal) | | Developer experience and ecosystem adoption: reference host, authoring tools, examples, documentation, accessibility, and discovery coordination | Maintained | | [@idosal](https://github.com/idosal) | ### Success Criteria * The extension specification, SDK, reference host, and examples are actively maintained, with responsive triage of specification and SDK issues. * MCP Apps can run unmodified across multiple major hosts. * Conforming hosts implement the documented sandboxing, permissions, content security policy, and auditability requirements, verified by the conformance suite. * Breaking changes are rare, documented, and preceded by an appropriate deprecation and migration path. * MCP Apps is the standard UI layer of the agentic web. ## Changelog | Date | Change | | - | - | | 2025-11-21 | SEP-1865 proposed, unifying the MCP-UI and OpenAI Apps SDK approaches | | 2025-12-17 | First MCP Apps Working Group meeting | | 2026-01-26 | Initial stable MCP Apps extension specification published | | 2026-01-28 | SEP-1865 marked Final | | 2026-05-21 | Initial charter |
community/working-interest-groups Changed · +97 / -239 lines
# Working Groups and Interest Groups ## Working groups and interest groups ## Current groups ## Joining a group ## Leadership ## Participation levels ## Making decisions ## Escalation ## Meetings and channels ## Reporting ## Forming a group ### Working group ### Interest group ## Amending or retiring a group # Working and Interest Groups ## Quick Reference ## When to Use Which ## Interest Groups (IGs) ## Working Groups (WGs) ## Governance ### Leadership ### Participation Levels ### Decision-Making Process ### Escalation Path ### Meeting Requirements ### Communication Channels ### Reporting ### Lifecycle ### Charter Amendments ## Charters ## FAQ ### How do I get involved contributing to MCP? ### Where can I find a list of all current WGs and IGs? ### Do I need to join an IG before starting a WG? ### Do I need to be in a WG to submit a SEP? ### What if my IG discussion leads to a concrete solution? ### Can one person be in multiple IGs/WGs?