- Supported MCP clients: VS Code Insiders, Goose and other implementations of the MCP Apps specification
- To disable DNS rebinding protection (if required), pass `--disable-dns-rebinding-protection` to HTTP transport
- XSS prevention via escaping status labels, using `textContent` for error rendering, and avoiding inline handlers on copy buttons
- Timer leak mitigation with cleanup in `callServerToolSafe()` finally blocks
- Circuit breaker recovery ensuring retry button resets state flags
- Pipeline Runs Dashboard (`open_pipeline_run_dashboard`) with server-side pagination, expandable step details and logs
- Run Activity Chart (`open_run_activity_chart`) showing daily run counts as status-colored stacked bars
Full changelog
MCP Apps 🎨
This release introduces MCP Apps — interactive HTML UIs that render directly inside supported MCP clients (VS Code Insiders, Goose, and others that support the MCP Apps specification).
New Apps
-
Pipeline Runs Dashboard (
open_pipeline_run_dashboard) — Interactive table of recent pipeline runs with status indicators, expandable step details with logs, server-side pagination, and filtering by pipeline name or status
-
Run Activity Chart (
open_run_activity_chart) — SVG bar chart showing daily pipeline run counts over the last 30 days with status-colored stacked bars (green = completed, red = failed, amber = other) and hover tooltips
Both apps are self-contained single-file HTML apps using the @modelcontextprotocol/ext-apps SDK. They fetch data dynamically from the MCP server via callServerTool().
Security Hardening
- XSS prevention: status labels escaped in dashboard summary, error rendering uses
textContentinstead ofinnerHTML, copy buttons usedata-*attributes instead of inline handlers - Timer leak prevention:
callServerToolSafe()cleans upsetTimeoutviafinallyblocks - Circuit breaker recovery: retry button properly resets
serverToolCallsEnabledandconsecutiveFailures - DNS rebinding protection: requires explicit
--disable-dns-rebinding-protectionflag for HTTP transport
Other Changes
ZenMLFastMCPsubclass for injecting_meta(includingui.resourceUri) on tools and resourceslist_appsresource for discovering available MCP Apps- Dockerfile updated to include
server/ui/directory - Smoke tests cover both new
open_*tools
Full Changelog: https://github.com/zenml-io/mcp-zenml/compare/v1.4.0...v1.5.0
What's Changed
- Add MCP Apps: Pipeline Runs Dashboard and Run Activity Chart by @strickvl in https://github.com/zenml-io/mcp-zenml/pull/36
Full Changelog: https://github.com/zenml-io/mcp-zenml/compare/v1.4.0...v1.5.0