MCP

The protocol comes down to one envelope (JSON-RPC 2.0) and two gestures: a service declares itself, the host makes use of the declaration. What it announces may be a tool, a document, and lately an interface. The three steps below follow that order.

1. 01

   What a service announces

   A service’s reply to the question “what can you do?”. It is the ordinary tool declaration, carried by a standard envelope: what the protocol standardises is the transport and the names, not the principle.

   jsonCopy

   {
     "jsonrpc": "2.0",
     "id": 3,
     "result": {
       "tools": [
         {
           "name": "city_weather",
           "description": "Seven-day forecast for a city.",
           "inputSchema": {
             "type": "object",
             "properties": { "city": { "type": "string" } },
             "required": ["city"]
           },
           "_meta": {
             "ui": { "resourceUri": "ui://weather/table", "visibility": ["model", "app"] }
           }
         }
       ]
     }
   }
   

   jsonrpc

   The same envelope for everything: listing, calling, reading a document. That is the whole economy of the protocol, and the reason why changing service does not require rewriting the harness.

   inputSchema

   The same object as a tool declaration written by hand, down to the name of the field. The model will never know where this description comes from: the harness presents it like the others.

   _meta.ui

   The hook towards an interface. Its presence announces that this tool’s reply can be displayed rather than read, and lets the host load and inspect the interface before the very first call.

   The trapThe description comes from the service, therefore from a third party, and it ends up in the context the model reads. A connected service literally writes part of your prompt: this is the way in that layer 2 points to, and it is here, in this field.

2. 02

   When the reply is an interface

   The resource named above. It is neither an image nor a template with gaps to fill: it is a complete page, loaded by the host and not by the model, which will never see its code.

   jsonCopy

   {
     "uri": "ui://weather/table",
     "name": "weather_table",
     "mimeType": "text/html;profile=mcp-app",
     "_meta": {
       "ui": {
         "csp": {
           "connectDomains": ["https://api.example.org"],
           "resourceDomains": ["https://cdn.example.org"]
         },
         "prefersBorder": true
       }
     }
   }
   

   ui://

   An address scheme reserved for interfaces. It cannot be reached from a browser: only the host resolves it, through the protocol.

   mimeType

   The type that declares “this is an interface, not a document to read”. It is what switches the host from text mode to display mode.

   csp

   The only outside origins the page will be able to reach. Everything else is refused by default: the isolation is not declared by the service, it is imposed by the host.

   The trapThis is the point that steps outside the usual regime of the glossary. Everywhere else, what comes back from a tool is text that the model reads; here, what comes back is code that the person sees. The model, for its part, still sees nothing but text.

3. 03

   What the interface is allowed to do

   The displayed page can execute nothing itself: it asks, and the host arbitrates. The channel is a simple exchange of messages between the isolated frame and the page containing it, in the same JSON-RPC envelope as the rest.

   jsCopy

   // inside the isolated frame: the view introduces itself, then waits to be fed
   await host.request('ui/initialize', { appCapabilities: {} });
   host.on('ui/notifications/tool-result', (r) => draw(r.content));
   
   // the person clicks: the view does nothing, it ASKS
   button.onclick = () =>
     host.request('tools/call', {
       name: 'city_weather',
       arguments: { city: 'Lyon' },
     });
   
   // the host then applies the consent and the rights of the session,
   // exactly as if the model had produced the request itself.
   // An interface therefore opens no shortcut: it takes the same
   // point of control, that of execution.
   

   ui/initialize

   The handshake. The view announces what it can do, the host replies with what it allows: opening a link, writing into the conversation, calling this tool and not that one.

   tools/call

   The same method as the model’s. This is the architectural guarantee of the extension: two requesters, a single path of execution, therefore a single place to control and to log.

   The trapThe isolated frame prevents the page from reaching the host application, its tokens and its storage. It does not prevent what the page displays from being misleading: a button may carry a label that does not match the call it triggers, and it is the host, not the service, that has to show what is really going to run.

What variesThis is the only block in the glossary whose content follows a dated specification, therefore the only one to re-read when it moves: the core of the protocol is versioned by revision date, and the extension that carries the interfaces is versioned separately. The method and field names cited here hold for the revisions in force at the date of this card. What does not vary: a JSON-RPC envelope, a service that describes without ever executing on your side, a host that remains the sole point of execution, and an isolated interface that has to go back through that point like everyone else.