MCP Apps vs MCP Tools

v2026.10.1 added MCP Apps (with installed-skill discovery and full backups). Keep MCP tools vs ClawHub skills for the protocol primer. This page is the Apps layer: HTML/tool UI beside chat, opt-in, sandboxed.

v2026.10.9: MCP tools reject malformed addresses in their input definitions and follow valid relative links. That is a fast-uri 4.2.3 remediation. Schema identifiers that used to pass may now fail validation. October patch.

When to enable Apps

  • You want an MCP server to show a small UI next to the transcript, not only JSON tool results.
  • You can keep that UI in a sandbox. Do not treat it as a second Control UI on a public port.

If you only need CLI-style tools (tickets, git, shell wrappers), stay on ordinary MCP tools and ClawHub skills. Enabling Apps without a need just adds another HTML attack surface. Prompt injection from web-like content: prompt injection.

After 10.9

Malformed URIs in tool input definitions should fail. Fix the server or the skill, do not disable validation. Relative links that are valid should still resolve. If an App stopped loading on upgrade, look at the URI in its manifest before you roll back the whole Gateway.

Related