fastmcp.apps.config

MCP Apps support — extension negotiation and typed UI metadata models.

Provides constants and Pydantic models for the MCP Apps extension (io.modelcontextprotocol/ui), enabling tools and resources to carry UI metadata for clients that support interactive app rendering.

Functions

app_config_to_meta_dict ^{<a href="https://github.com/PrefectHQ/fastmcp/blob/main/fastmcp_slim/fastmcp/apps/config.py#L181" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a>}

app_config_to_meta_dict(app: AppConfig | dict[str, Any]) -> dict[str, Any]

Convert an AppConfig or dict to the wire-format dict for meta["ui"].

is_model_visible ^{<a href="https://github.com/PrefectHQ/fastmcp/blob/main/fastmcp_slim/fastmcp/apps/config.py#L188" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a>}

is_model_visible(component: FastMCPComponent) -> bool

Whether a component may be shown to, or invoked by, the model.

Visibility is a declaration, and the MCP Apps spec puts the filtering on the host — so tools/list carries app-only tools and the host keeps them from the model. That division only works where a host stands between the server and the model.

It does not hold for surfaces a server drives itself. A search result or a code-mode catalog reaches the model as ordinary tool output, and a call-tool proxy invokes on a name the model supplies; nothing downstream can filter either. Those surfaces have to apply the declaration here.

A component with no visibility is visible: the field marks the exception, and the spec's default is both audiences.

Classes

ResourceCSP ^{<a href="https://github.com/PrefectHQ/fastmcp/blob/main/fastmcp_slim/fastmcp/apps/config.py#L21" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a>}

Content Security Policy for MCP App resources.

Declares which external origins the app is allowed to connect to or load resources from. Hosts use these declarations to build the Content-Security-Policy header for the sandboxed iframe.

ResourcePermissions ^{<a href="https://github.com/PrefectHQ/fastmcp/blob/main/fastmcp_slim/fastmcp/apps/config.py#L57" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a>}

Iframe sandbox permissions for MCP App resources.

Each field, when set (typically to {}), requests that the host grant the corresponding Permission Policy feature to the sandboxed iframe. Hosts MAY honour these; apps should use JS feature detection as a fallback.

AppConfig ^{<a href="https://github.com/PrefectHQ/fastmcp/blob/main/fastmcp_slim/fastmcp/apps/config.py#L85" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a>}

Configuration for MCP App tools and resources.

Controls how a tool or resource participates in the MCP Apps extension. On tools, resource_uri and visibility specify which UI resource to render and where the tool appears. On resources, those fields must be left unset (the resource itself is the UI).

All fields use exclude_none serialization so only explicitly-set values appear on the wire. Aliases match the MCP Apps wire format (camelCase).

PrefabAppConfig ^{<a href="https://github.com/PrefectHQ/fastmcp/blob/main/fastmcp_slim/fastmcp/apps/config.py#L125" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a>}

App configuration for Prefab tools with sensible defaults.

Like app=True but customizable. Auto-wires the Prefab renderer URI and merges the renderer's CSP with any additional domains you specify. The renderer resource is registered automatically.

Example::

@mcp.tool(app=PrefabAppConfig())  # same as app=True

@mcp.tool(app=PrefabAppConfig(
    csp=ResourceCSP(frame_domains=["https://example.com"]),
))

Methods:

model_post_init ^{<a href="https://github.com/PrefectHQ/fastmcp/blob/main/fastmcp_slim/fastmcp/apps/config.py#L141" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a>}

model_post_init(self, __context: Any) -> None