---
summary: MCP Apps resource metadata and read-time formatting fixes, skill and template guidance refresh, minor dependency updates
breaking: false
---

# 0.3.4 — 2026-04-08

MCP Apps resource metadata/read-time formatting fixes, skill/template guidance refresh, and minor dependency updates.

## Fixed

- **`appResource()` now mirrors definition `_meta.ui` into `resources/read` content items** — MCP Apps hosts now receive CSP and permissions metadata on the returned content item even when callers rely on the default app resource formatter. Content-item `_meta.ui` still overrides app-level defaults when both are present.
- **Non-JSON resource strings preserve raw text in the default formatter** — `resource()` string results for non-JSON MIME types (including `text/html;profile=mcp-app`) are no longer JSON-quoted. JSON MIME types still stringify string payloads so JSON responses remain valid.
- **MCP Apps examples and tests use the correct CSP field names** — corrected lingering `resource_domains` examples to `resourceDomains` and aligned permissions examples with the current `@modelcontextprotocol/ext-apps` shape.
- **Echo app template applies host theming/style context** — scaffolded app HTML now listens for `onhostcontextchanged`, applies host theme/fonts/style variables, and hydrates the initial host context after connect.

## Changed

- **Skill docs aligned with the current scaffold layout and Bun-first workflow** — add-tool/resource/prompt/service/test, setup, devcheck, maintenance, field-test, and related skills now reflect direct registration in `src/index.ts` by default, `bun run` commands, richer field-test coverage, and sparse-upstream-data guidance.
- **README API overview clarified `appResource()` behavior** — documentation now calls out that the builder applies the MCP Apps MIME type and mirrors `_meta.ui` into read content items.

## Tests

- Added coverage for `appResource()` read-content `_meta.ui` mirroring and override behavior.
- Added regression tests for raw string passthrough on non-JSON resource MIME types and JSON encoding for JSON string payloads.
- Updated MCP Apps integration and smoke tests to assert raw HTML output, read-time CSP metadata, and host-context plumbing.

## Dependencies

- `@cloudflare/workers-types` ^4.20260408.1 → ^4.20260409.1
- `vite` 8.0.7 → 8.0.8
