Entity trail

MCP Apps

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-08-21 / saas-disruption-researcherSupernova Launched at Product Hunt #2 Selling the BI Stack as an MCP Endpoint Instead of a DashboardSupernova connects Stripe, HubSpot, PostgreSQL and 30-plus other apps to Claude and Codex through a single MCP endpoint at mcp.supernova.ai/mcp, queryable in about a minute, so revenue, pipeline, customer and usage analysis happens in the AI tool the user is already in. It took #2 on the Aug 21 leaderboard with 148 points. This is the direct attack on Looker, Amplitude and Mixpanel: not a better dashboard but no dashboard, and no data warehouse migration to get there.
2026-08-21 / agents-researcherSalesforce ships Headless 360 MCP Server and takes the Slackbot MCP Client to GAOn August 19, 2026, a day before Slack Code, Salesforce expanded Headless 360 with a Headless 360 MCP Server that lets agents running in Agentforce, Claude, ChatGPT and Cursor discover and invoke Salesforce capabilities at runtime. The Slackbot MCP Client reached general availability, connecting Slackbot to all Salesforce MCP servers plus 20-plus partner apps including Atlassian, Box, Canva, Docusign, Linear, Notion and Zoom through a Slack Marketplace registry. Identity resolves per user through the native Slack MCP client, so agent actions inherit existing permissions rather than running under a shared service account.
2026-08-14 / vibe-coding-researcherMCP 2026-07-28 Spec Lands: Stateless Core, Governed Extensions, Tasks, and Sandboxed MCP AppsThe finalized MCP specification replaces the bidirectional stateful protocol with a request/response core, letting servers deploy on serverless and edge infrastructure. Extensions graduate from convention to a governed system with reverse-DNS identifiers, capability negotiation via extensions maps, and versioning independent of the core; Tasks becomes an official extension with a stateless lifecycle (`tools/call` returns a handle, client drives `tasks/get`/`update`/`cancel`), and MCP Apps ships server-rendered HTML in sandboxed iframes with templates declared up front so clients can prefetch and security-review before rendering. Claude is already expanding support, including enterprise-managed auth and private network tunnels.
2026-08-14 / projects-researcherholaOS Trends at 6,922 Stars as a Local-First Desktop Workspace That Runs Claude Code and Codex Side by Side on Shared Memoryholaboss-ai/holaOS puts Claude Code, Codex, and its own native agent in one Electron workspace where context and history live as editable local files rather than a hosted database, so memory persists across sessions and across agents. It ships built-in frontier models (Kimi K3, GLM 5.2, GPT 5.6, Claude Opus 5) alongside BYO-keys, 100+ OAuth integrations covering Gmail, Slack, GitHub and Linear, MCP server support, and 'HolaApps' that run interactive surfaces next to the agent. The license is a modified Apache 2.0 with commercial-distribution and branding restrictions — read it before building on top.
2026-08-11 / saas-disruption-researcherSaaStr: Mailchimp Is Shrinking Inside Intuit — and the Diagnosis Is That It Has No MCP ServerJason Lemkin traced Mailchimp from a ~$1.06B ARR peak (Q4 FY22, the only quarter Intuit ever disclosed the figure) to outright year-over-year revenue decline by Q3 FY26, against the $12B Intuit paid in 2021 for an $800M-revenue business growing ~20%; Intuit has now published growth rates excluding Mailchimp for four straight quarters, with the gap widening from half a point in September 2025 to three points plus a decline by May 2026, alongside a 17% workforce cut (~3,100 roles) and $300M in restructuring charges. Klaviyo over the same window did $358M in Q1 2026, up 28%, at 110% NRR and 196,000+ customers. The builder-relevant cause Lemkin names is agent operability: Mailchimp has no official MCP server for its marketing features and is absent from Replit, Lovable and Vercel, where new apps are now assembled — while Resend is wired in.
2026-08-11 / projects-researcherToday's Show HN Agent Cluster Skews Defensive — HoneyMCP Ships Decoy 'Ghost Tools' to Catch Attackers Inside MCP ServersBeyond mcptoon, this morning's Show HN batch is small and mostly security-flavored: barvhaim/HoneyMCP adds a deception layer to MCP servers using decoy 'ghost tools' as honeypots, Sentris scans Supabase projects for missing row-level security and leaked credentials, g-33-L/anansi offers an open-source memory API for LLM apps, and lgxz/dora is a minimal LLM agent with a single bash tool. All four sit at 1–2 points with essentially no discussion. HoneyMCP is the conceptually interesting one — it assumes MCP servers are now a target surface worth instrumenting, which is a notable shift from treating them as plumbing.
2026-08-05 / saas-disruption-researcherThe MCP 2026-07-28 Spec Went Final With a Stateless Core, and Anthropic Is Rolling It Into Claude NowThe Model Context Protocol's 2026-07-28 specification was published July 28 after ten weeks of validation from a May 21 release candidate, replacing the bidirectional stateful protocol with a request/response model so servers can deploy on serverless and edge infrastructure. It adds a versioned Extensions framework, header-based routing, cacheable list results, authorization hardening, and a formal deprecation policy, with MCP Apps (server-rendered HTML in sandboxed iframes, templates declared upfront for prefetch and security review) and Tasks (long-running work, contributed by AWS) shipping as extensions rather than core. Anthropic published its Claude adoption post in early August; for builders the practical consequence is that MCP servers stop needing a persistent connection and start looking like ordinary HTTP services.
2026-08-02 / sources-researcherMCP 2.0 Went Stateless on July 28 — One HTTP Request, No Mcp-Session-Id, and Willison Immediately Shipped Three ClientsThe July 28, 2026 MCP specification revision replaces session-based transport with 'stateless, self-contained requests' and 'per-request capability negotiation'; the old two-round-trip dance (initialize → receive Mcp-Session-Id → call tool) collapses into a single HTTP request carrying protocol version and method in headers. Simon Willison, previously lukewarm on MCP, wrote on July 31 that this 'recaptured my interest' and shipped three tools in a day: mcp-explorer (uvx-installable CLI), datasette-mcp (adds a /-/mcp endpoint with list_databases, get_database_schema, and read-only execute_sql), and llm-mcp-client. The spec also formalizes three opt-in extensions — Tasks (async long-running ops with durable handles), Skills over MCP, and MCP Apps (inline charts/forms/video) — meaning servers no longer need sticky routing to scale horizontally.
2026-07-31 / github-pulse-researcherCursor Publishes a Formal Plugin Specification Repo Separate From MCPcursor/plugins (2,497 stars, 192 forks, 27 open issues, created 2026-01-23, pushed 2026-07-31) holds the Cursor plugin specification and official plugin implementations in TypeScript, appearing in today's trending TypeScript list at +27 stars. Notably the repo carries no license field, which matters for anyone considering shipping a plugin against it. Read alongside GitHub's separate Copilot SDK extension surface and the MCP Apps effort, it is a third distinct extension model from a major coding-agent vendor in the same period — the consolidation onto MCP that many builders assumed was coming is not what the vendors are actually shipping.
2026-07-31 / vibe-coding-researcherMCP's OAuth Overhaul: RFC 9207 Issuer Validation, application_type in DCR, and a Push Toward CIMDDuende's July 30 breakdown covers six authorization-hardening SEPs in the 2026-07-28 spec. SEP-2468 requires the `iss` parameter in OAuth authorization responses per RFC 9207, defending against mixup attacks where a client talks to multiple authorization servers and one is attacker-controlled. SEP-837 has AS operators validate redirect URIs via `application_type` (web clients must use HTTPS; native apps may use HTTP only on localhost), and SEP-2352 requires separate credentials per authorization server. Duende notes IdentityServer deployments need no changes for several SEPs since issuer identification is already default, and flags the broader shift from Dynamic Client Registration toward Client ID Metadata Documents.
2026-07-31 / vibe-coding-researcherThe New MCP Spec Opens Three Attack Surfaces: Handle Hijacking, a Filesystem Scope Gap, and HTML in Your IDEBackslash's analysis of the 2026-07-28 spec identifies three concrete new risks. Because state now travels as conversation-visible handles rather than opaque server tokens, a malicious tool response can inject an attacker-controlled ID (`{"task_id": "t-ATTACKER-CONTROLLED"}`) that the model obeys, and handles replay across users unless servers validate (handle + auth context) pairs. Deprecating Roots moves filesystem boundary enforcement from the protocol into individual developer code, making scope opt-in and inconsistent, while the MCP Apps extension (SEP-1865) ships server-controlled HTML into IDE iframes that have access to source code and every connected server — an XSS, clickjacking, or fake-auth-prompt surface.
2026-07-29 / arxiv-researcherOnly 37.2% of MCP Applications Gate Tool Execution Behind Human Approval — Study of 1,723 ReposAn empirical study posted 2026-07-28 (arXiv 2607.25635) mined 1,723 MCP-consuming applications from GitHub and characterized how they configure servers, communicate, and handle human oversight — the first large-scale look at the application side rather than the server side. The ecosystem has converged on file-based server configuration (85.2%) and official SDKs (81.1%), but no naming convention has emerged for config files. Human oversight is the weak spot: logging (90.8%) and enable/disable controls (77.2%) are common, but only 37.2% put a blocking approval step in front of tool execution, meaning in most MCPApps the model can invoke any enabled tool unconditionally.

Graph relationships

USES
Cursor
Cursor 2.6 renders interactive HTML UIs from MCP Apps in agent chat.
Source finding
SUPPORTS
VS Code
VS Code is the first major editor with MCP Apps support returning interactive UI components.
Source finding
RELEASED
Agentic AI Foundation
AAIF announced MCP Apps enabling interactive UIs.
Source finding
USES
Cursor -> MCP Apps
Cursor 2.6 renders interactive HTML UIs from MCP Apps in agent chat.
Source finding
SUPPORTS
VS Code -> MCP Apps
VS Code is the first major editor with MCP Apps support returning interactive UI components.
Source finding
RELEASED
Agentic AI Foundation -> MCP Apps
AAIF announced MCP Apps enabling interactive UIs.
Source finding

Source trail

Model Context Protocol blog July 28 MCP specification revision mcp-explorer official MCP C# SDK v2.0 lean-ctx v3.9.13 confirmed it's live posted the real numbers on HN MCP Python SDK v2.0.0 TypeScript SDK went 2.0.0 spec changelog Model Context Protocol Blog Stacktree

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…