Serve the run report UI to MCP clients as an MCP App

[wasimxyz]

Summary

Data Hub's MCP server now ships the run report as an MCP App, so a client that supports the extension renders the same report the web app shows instead of rebuilding it from JSON.

MCP Apps (SEP-1865) is an extension where the server publishes an HTML page at a ui:// address. The client fetches the page, runs it in a sandboxed iframe, and the page calls back into the server through the client.

What changed

• get_run_report points at the page it belongs to, ui://data-hub/run-report.
• That page is registered as a resource with the MCP Apps media type and a content security policy naming the S3 origin it loads images, video, and PDFs from.
• Three tools feed the page and are marked visible to the app only. report_view_items returns a page of report items with fresh download links, report_view_table returns parsed CSV rows, and report_view_artifact returns a parsed JSON artifact. All three check the same permissions the REST API does.
• The page is one self-contained HTML file built with Vite. next build runs mcp-apps:build first, and the output in web/mcp-apps/dist/ is gitignored.
• The seven instrument renderers take a data source now instead of assuming they run inside Next.js, so the same components serve the web app and the page.
• Tool count goes from 32 to 35.

The built page is 1,279 KB raw and 347 KB gzipped. Hosts may cache it.

Testing

Checked in a browser against a local MCP Apps host:

• Gel doc: the image carousel pages, and images load.
• Plate reader: the plate map renders and paging works.
• Aunty: the plate report renders, and opening a well shows the dialog and chart.

No local fixture data exists for the microscopy carousel, Raman spectra, qPCR, or a PDF with real page content, so none of those were checked.

• make check-all
• Confirm the three report_view_* descriptions say what they return and steer other clients to get_run_report

Limitations

• The three app-only tools stay visible in tools/list to every client. Hiding them is the host's job under the spec, and mcp-handler builds a fresh server per request and registers tools before initialize, so this server cannot vary its list by client.
• Presigned S3 links expire after 15 minutes. The View refreshes a cached URL after 80% of that window.
• Production hosts need a second hostname for the sandbox. That is configured on the host side.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
data-hub	Ready	Preview	Aug 29, 2026 12:23am