Atlas / MCP servers / openai / Apps SDK Examples Gallery

Apps SDK Examples GallerySAFE

Name: Apps SDK Examples Gallery
Author: openai

mcp/openai/apps-sdk-examples-gallery

MCP server by openai · Audited 2026-09-23

⚑ Report / re-scan Source ↗

Example apps for the Apps SDK

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

7 7r · 0w · 0d

Transport

sse · streamable-http

License

MIT

Stars

2,339

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](LICENSE)

This repository showcases example UI components to be used with the Apps SDK, as well as example MCP servers that expose a collection of components as tools. It is meant to be used as a starting point and source of inspiration to build your own apps for ChatGPT.

Note: If you are on Chrome and have recently updated to version 142, you will need to disable the `local-network-access` flag to see the widget UI.

How to disable it:

Go to chrome://flags/
Find #local-network-access-check
Set it to Disabled

⚠️ Note 🚨 Make sure to restart Chrome after changing this flag for the update to take effect.

MCP + Apps SDK overview

The Model Context Protocol (MCP) is an open specification for connecting large language model clients to external tools, data, and user interfaces. An MCP server exposes tools that a model can call during a conversation and returns results according to the tool contracts. Those results can include extra metadata—such as inline HTML—that the Apps SDK uses to render rich UI components (widgets) alongside assistant messages.

Within the Apps SDK, MCP keeps the server, model, and UI in sync. By standardizing the wire format, authentication, and metadata, it lets ChatGPT reason about your connector the same way it reasons about built-in tools. A minimal MCP integration for Apps SDK implements three capabilities:

List tools – Your server advertises the tools it supports, including their JSON Schema input/output contracts and optional annotations (for example, readOnlyHint).
Call tools – When a model selects a tool, it issues a call_tool request with arguments that match the user intent. Your server executes the action and returns structured content the model can parse.
Return widgets –

Read from source at commit 73c52aca9e6cOBSERVED · 2026-09-23

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add pizzaz-mcp-node --env AUTHORIZATION_SERVER_URL=${AUTHORIZATION_SERVER_URL} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "pizzaz-mcp-node": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "AUTHORIZATION_SERVER_URL": "${AUTHORIZATION_SERVER_URL}"
      }
    }
  }
}

Exposed tools (7)

7 read · 0 write · 0 destructive.

Tool	Risk	Description
`Avocados`	read	Perfectly ripe
`Bread`	read	Fresh and toasty
`Eggs`	read	Breakfast basics
`Tomatoes`	read	Juicy and bright
`kitchen-sink-refresh`	read	Lightweight echo tool called from the widget via callTool.
`kitchen-sink-show`	read	Returns the widget template with the provided message.
`kitchen_sink_refresh`	read	# Simple echo tool used by the widget via window.openai.callTool.

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: declared (1 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (13)

LOWInventory / provenance · inv.hidden_file · CWE-1104

.pre-commit-config.yaml

.pre-commit-config.yaml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

cards_against_ai_server_node/src/shared-types.ts:13

} from "../../src/cards-against-ai/types.js";

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

authenticated_server_python/README.md:95

The server listens on `http://127.0.0.1:8000` and exposes the standard MCP endpoint at `GET /mcp`.

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

pizzaz_server_python/README.md:31

This boots a FastAPI app with uvicorn on `http://127.0.0.1:8000` (equivalently `uvicorn pizzaz_server_python.main:app --port 8000`). The endpoints mirror the Node demo:

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

solar-system_server_python/README.md:31

This boots a FastAPI app with uvicorn on `http://127.0.0.1:8000` (equivalently