diff --git a/package-lock.json b/package-lock.json
index f3417b8..26aae58 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -15,7 +15,7 @@
         "@electron-toolkit/utils": "^3.0.0",
         "@fontsource-variable/geist": "^5.2.9",
         "@fontsource-variable/geist-mono": "^5.2.8",
-        "@modelcontextprotocol/sdk": "^1.29.0",
+        "@modelcontextprotocol/client": "^2.0.0",
         "@pierre/diffs": "^1.2.11",
         "ai": "^5.0.210",
         "better-sqlite3": "^12.11.1",
@@ -1313,18 +1313,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/@hono/node-server": {
-      "version": "1.19.14",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.14.tgz",
-      "integrity": "sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18.14.1"
-      },
-      "peerDependencies": {
-        "hono": "^4"
-      }
-    },
     "node_modules/@iconify/types": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/@iconify/types/-/types-2.0.0.tgz",
@@ -2116,68 +2104,36 @@
         "@chevrotain/types": "~11.1.1"
       }
     },
-    "node_modules/@modelcontextprotocol/sdk": {
-      "version": "1.29.0",
-      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.29.0.tgz",
-      "integrity": "sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ==",
+    "node_modules/@modelcontextprotocol/client": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/client/-/client-2.0.0.tgz",
+      "integrity": "sha512-8f1OghQ2rjzIOfqgUCP+8GiUWqRs89njoWLNqAe8kWmDePv3s1fZXseej+QXemssEuuOvLLmLO/kqM3IQHtISw==",
       "license": "MIT",
       "dependencies": {
-        "@hono/node-server": "^1.19.9",
-        "ajv": "^8.17.1",
-        "ajv-formats": "^3.0.1",
-        "content-type": "^1.0.5",
-        "cors": "^2.8.5",
+        "@modelcontextprotocol/core": "2.0.0",
         "cross-spawn": "^7.0.5",
         "eventsource": "^3.0.2",
         "eventsource-parser": "^3.0.0",
-        "express": "^5.2.1",
-        "express-rate-limit": "^8.2.1",
-        "hono": "^4.11.4",
         "jose": "^6.1.3",
-        "json-schema-typed": "^8.0.2",
         "pkce-challenge": "^5.0.0",
-        "raw-body": "^3.0.0",
-        "zod": "^3.25 || ^4.0",
-        "zod-to-json-schema": "^3.25.1"
+        "zod": "^4.2.0"
       },
       "engines": {
-        "node": ">=18"
-      },
-      "peerDependencies": {
-        "@cfworker/json-schema": "^4.1.1",
-        "zod": "^3.25 || ^4.0"
-      },
-      "peerDependenciesMeta": {
-        "@cfworker/json-schema": {
-          "optional": true
-        },
-        "zod": {
-          "optional": false
-        }
+        "node": ">=20"
       }
     },
-    "node_modules/@modelcontextprotocol/sdk/node_modules/ajv": {
-      "version": "8.20.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
-      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
+    "node_modules/@modelcontextprotocol/core": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/core/-/core-2.0.0.tgz",
+      "integrity": "sha512-pJCEwGG7Lfr/+PQp9ZTwKXNeO5wzbfKL7H3MYpCorM4oFBoQrdjnBgEoqG+RjhsvS1FKrDbKux+M1HhlnGWqcA==",
       "license": "MIT",
       "dependencies": {
-        "fast-deep-equal": "^3.1.3",
-        "fast-uri": "^3.0.1",
-        "json-schema-traverse": "^1.0.0",
-        "require-from-string": "^2.0.2"
+        "zod": "^4.2.0"
       },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/epoberezkin"
+      "engines": {
+        "node": ">=20"
       }
     },
-    "node_modules/@modelcontextprotocol/sdk/node_modules/json-schema-traverse": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
-      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
-      "license": "MIT"
-    },
     "node_modules/@npmcli/fs": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-2.1.2.tgz",
@@ -3648,53 +3604,6 @@
       "dev": true,
       "license": "ISC"
     },
-    "node_modules/accepts": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz",
-      "integrity": "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==",
-      "license": "MIT",
-      "dependencies": {
-        "mime-types": "^3.0.0",
-        "negotiator": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/accepts/node_modules/mime-db": {
-      "version": "1.54.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
-      "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/accepts/node_modules/mime-types": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
-      "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
-      "license": "MIT",
-      "dependencies": {
-        "mime-db": "^1.54.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/accepts/node_modules/negotiator": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.0.0.tgz",
-      "integrity": "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
     "node_modules/agent-base": {
       "version": "7.1.4",
       "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
@@ -3767,45 +3676,6 @@
         "url": "https://github.com/sponsors/epoberezkin"
       }
     },
-    "node_modules/ajv-formats": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz",
-      "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==",
-      "license": "MIT",
-      "dependencies": {
-        "ajv": "^8.0.0"
-      },
-      "peerDependencies": {
-        "ajv": "^8.0.0"
-      },
-      "peerDependenciesMeta": {
-        "ajv": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/ajv-formats/node_modules/ajv": {
-      "version": "8.20.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
-      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
-      "license": "MIT",
-      "dependencies": {
-        "fast-deep-equal": "^3.1.3",
-        "fast-uri": "^3.0.1",
-        "json-schema-traverse": "^1.0.0",
-        "require-from-string": "^2.0.2"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/epoberezkin"
-      }
-    },
-    "node_modules/ajv-formats/node_modules/json-schema-traverse": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
-      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
-      "license": "MIT"
-    },
     "node_modules/ajv-keywords": {
       "version": "3.5.2",
       "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-3.5.2.tgz",
@@ -4215,59 +4085,6 @@
         "bluebird": "^3.5.5"
       }
     },
-    "node_modules/body-parser": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
-      "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
-      "license": "MIT",
-      "dependencies": {
-        "bytes": "^3.1.2",
-        "content-type": "^2.0.0",
-        "debug": "^4.4.3",
-        "http-errors": "^2.0.1",
-        "iconv-lite": "^0.7.2",
-        "on-finished": "^2.4.1",
-        "qs": "^6.15.2",
-        "raw-body": "^3.0.2",
-        "type-is": "^2.1.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/body-parser/node_modules/content-type": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
-      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/body-parser/node_modules/iconv-lite": {
-      "version": "0.7.3",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
-      "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
-      "license": "MIT",
-      "dependencies": {
-        "safer-buffer": ">= 2.1.2 < 3.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
     "node_modules/boolean": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/boolean/-/boolean-3.2.0.tgz",
@@ -4440,15 +4257,6 @@
         "node": ">= 10.0.0"
       }
     },
-    "node_modules/bytes": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
-      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
     "node_modules/cac": {
       "version": "6.7.14",
       "resolved": "https://registry.npmjs.org/cac/-/cac-6.7.14.tgz",
@@ -4581,6 +4389,7 @@
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
       "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
@@ -4590,22 +4399,6 @@
         "node": ">= 0.4"
       }
     },
-    "node_modules/call-bound": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
-      "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind-apply-helpers": "^1.0.2",
-        "get-intrinsic": "^1.3.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
     "node_modules/caniuse-lite": {
       "version": "1.0.30001799",
       "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001799.tgz",
@@ -5007,28 +4800,6 @@
       "dev": true,
       "license": "ISC"
     },
-    "node_modules/content-disposition": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-1.1.0.tgz",
-      "integrity": "sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/content-type": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
-      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
     "node_modules/convert-source-map": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
@@ -5049,15 +4820,6 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/cookie-signature": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz",
-      "integrity": "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6.6.0"
-      }
-    },
     "node_modules/core-util-is": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.2.tgz",
@@ -5065,23 +4827,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/cors": {
-      "version": "2.8.6",
-      "resolved": "https://registry.npmjs.org/cors/-/cors-2.8.6.tgz",
-      "integrity": "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw==",
-      "license": "MIT",
-      "dependencies": {
-        "object-assign": "^4",
-        "vary": "^1"
-      },
-      "engines": {
-        "node": ">= 0.10"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
     "node_modules/cose-base": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/cose-base/-/cose-base-1.0.3.tgz",
@@ -5816,15 +5561,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/depd": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
-      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
     "node_modules/dequal": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz",
@@ -6039,6 +5775,7 @@
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
       "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "call-bind-apply-helpers": "^1.0.1",
@@ -6056,12 +5793,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/ee-first": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
-      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
-      "license": "MIT"
-    },
     "node_modules/ejs": {
       "version": "3.1.10",
       "resolved": "https://registry.npmjs.org/ejs/-/ejs-3.1.10.tgz",
@@ -6398,15 +6129,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/encodeurl": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
-      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
     "node_modules/encoding": {
       "version": "0.1.13",
       "resolved": "https://registry.npmjs.org/encoding/-/encoding-0.1.13.tgz",
@@ -6473,6 +6195,7 @@
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
       "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -6482,6 +6205,7 @@
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
       "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -6491,6 +6215,7 @@
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
       "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0"
@@ -6581,12 +6306,6 @@
         "node": ">=6"
       }
     },
-    "node_modules/escape-html": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
-      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
-      "license": "MIT"
-    },
     "node_modules/escape-string-regexp": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
@@ -6610,15 +6329,6 @@
         "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/etag": {
-      "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
-      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
     "node_modules/eventsource": {
       "version": "3.0.7",
       "resolved": "https://registry.npmjs.org/eventsource/-/eventsource-3.0.7.tgz",
@@ -6656,101 +6366,6 @@
       "dev": true,
       "license": "Apache-2.0"
     },
-    "node_modules/express": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
-      "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
-      "license": "MIT",
-      "dependencies": {
-        "accepts": "^2.0.0",
-        "body-parser": "^2.2.1",
-        "content-disposition": "^1.0.0",
-        "content-type": "^1.0.5",
-        "cookie": "^0.7.1",
-        "cookie-signature": "^1.2.1",
-        "debug": "^4.4.0",
-        "depd": "^2.0.0",
-        "encodeurl": "^2.0.0",
-        "escape-html": "^1.0.3",
-        "etag": "^1.8.1",
-        "finalhandler": "^2.1.0",
-        "fresh": "^2.0.0",
-        "http-errors": "^2.0.0",
-        "merge-descriptors": "^2.0.0",
-        "mime-types": "^3.0.0",
-        "on-finished": "^2.4.1",
-        "once": "^1.4.0",
-        "parseurl": "^1.3.3",
-        "proxy-addr": "^2.0.7",
-        "qs": "^6.14.0",
-        "range-parser": "^1.2.1",
-        "router": "^2.2.0",
-        "send": "^1.1.0",
-        "serve-static": "^2.2.0",
-        "statuses": "^2.0.1",
-        "type-is": "^2.0.1",
-        "vary": "^1.1.2"
-      },
-      "engines": {
-        "node": ">= 18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/express-rate-limit": {
-      "version": "8.5.2",
-      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.5.2.tgz",
-      "integrity": "sha512-5Kb34ipNX694DH48vN9irak1Qx30nb0PLYHXfJgw4YEjiC3ZEmZJhwOp+VfiCYwFzvFTdB9QkArYS5kXa2cx2A==",
-      "license": "MIT",
-      "dependencies": {
-        "ip-address": "^10.2.0"
-      },
-      "engines": {
-        "node": ">= 16"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/express-rate-limit"
-      },
-      "peerDependencies": {
-        "express": ">= 4.11"
-      }
-    },
-    "node_modules/express/node_modules/cookie": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
-      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/express/node_modules/mime-db": {
-      "version": "1.54.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
-      "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/express/node_modules/mime-types": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
-      "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
-      "license": "MIT",
-      "dependencies": {
-        "mime-db": "^1.54.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
     "node_modules/extend": {
       "version": "3.0.2",
       "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
@@ -6792,6 +6407,7 @@
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
       "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/fast-json-stable-stringify": {
@@ -6801,22 +6417,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/fast-uri": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.3.tgz",
-      "integrity": "sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "BSD-3-Clause"
-    },
     "node_modules/fd-slicer": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz",
@@ -6889,27 +6489,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/finalhandler": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-2.1.1.tgz",
-      "integrity": "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA==",
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.4.0",
-        "encodeurl": "^2.0.0",
-        "escape-html": "^1.0.3",
-        "on-finished": "^2.4.1",
-        "parseurl": "^1.3.3",
-        "statuses": "^2.0.1"
-      },
-      "engines": {
-        "node": ">= 18.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
     "node_modules/foreground-child": {
       "version": "3.3.1",
       "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
@@ -6957,24 +6536,6 @@
         "node": ">= 6"
       }
     },
-    "node_modules/forwarded": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
-      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/fresh": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/fresh/-/fresh-2.0.0.tgz",
-      "integrity": "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
     "node_modules/fs-constants": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
@@ -7034,6 +6595,7 @@
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
       "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
+      "dev": true,
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
@@ -7084,6 +6646,7 @@
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
       "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "call-bind-apply-helpers": "^1.0.2",
@@ -7108,6 +6671,7 @@
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
       "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "dunder-proto": "^1.0.1",
@@ -7243,6 +6807,7 @@
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
       "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -7315,6 +6880,7 @@
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
       "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -7350,6 +6916,7 @@
       "version": "2.0.4",
       "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
       "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "function-bind": "^1.1.2"
@@ -7530,15 +7097,6 @@
         "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/hono": {
-      "version": "4.12.27",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.27.tgz",
-      "integrity": "sha512-1yrb/+w6HWQJrUCLkJ2IF5jNIPvvFkblV5RNOYl6bV+OA6p9GLcMpHFFGTosSvHvcAUibuUukRqhlYI4z32C7Q==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=16.9.0"
-      }
-    },
     "node_modules/hosted-git-info": {
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-4.1.0.tgz",
@@ -7607,26 +7165,6 @@
       "integrity": "sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ==",
       "license": "BSD-2-Clause"
     },
-    "node_modules/http-errors": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
-      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
-      "license": "MIT",
-      "dependencies": {
-        "depd": "~2.0.0",
-        "inherits": "~2.0.4",
-        "setprototypeof": "~1.2.0",
-        "statuses": "~2.0.2",
-        "toidentifier": "~1.0.1"
-      },
-      "engines": {
-        "node": ">= 0.8"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
     "node_modules/http-proxy-agent": {
       "version": "7.0.2",
       "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
@@ -7839,20 +7377,12 @@
       "version": "10.2.0",
       "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
       "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 12"
       }
     },
-    "node_modules/ipaddr.js": {
-      "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
-      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.10"
-      }
-    },
     "node_modules/is-alphabetical": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/is-alphabetical/-/is-alphabetical-2.0.1.tgz",
@@ -7949,12 +7479,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/is-promise": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/is-promise/-/is-promise-4.0.0.tgz",
-      "integrity": "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==",
-      "license": "MIT"
-    },
     "node_modules/is-unicode-supported": {
       "version": "0.1.0",
       "resolved": "https://registry.npmjs.org/is-unicode-supported/-/is-unicode-supported-0.1.0.tgz",
@@ -8108,12 +7632,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/json-schema-typed": {
-      "version": "8.0.2",
-      "resolved": "https://registry.npmjs.org/json-schema-typed/-/json-schema-typed-8.0.2.tgz",
-      "integrity": "sha512-fQhoXdcvc3V28x7C7BMs4P5+kNlgUURe2jmUT1T//oBRMDrqy1QPelJimwZGo7Hg9VPV3EQV5Bnq4hbFy2vetA==",
-      "license": "BSD-2-Clause"
-    },
     "node_modules/json-stringify-safe": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz",
@@ -8773,6 +8291,7 @@
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
       "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -9060,27 +8579,6 @@
         "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/media-typer": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.0.tgz",
-      "integrity": "sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/merge-descriptors": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-2.0.0.tgz",
-      "integrity": "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/mermaid": {
       "version": "11.15.0",
       "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.15.0.tgz",
@@ -10126,27 +9624,6 @@
         "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
       }
     },
-    "node_modules/object-assign": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
-      "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/object-inspect": {
-      "version": "1.13.4",
-      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
-      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
     "node_modules/object-keys": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/object-keys/-/object-keys-1.1.1.tgz",
@@ -10157,18 +9634,6 @@
         "node": ">= 0.4"
       }
     },
-    "node_modules/on-finished": {
-      "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
-      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
-      "license": "MIT",
-      "dependencies": {
-        "ee-first": "1.1.1"
-      },
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
     "node_modules/once": {
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
@@ -10326,15 +9791,6 @@
         "url": "https://github.com/inikulin/parse5?sponsor=1"
       }
     },
-    "node_modules/parseurl": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
-      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
     "node_modules/path-data-parser": {
       "version": "0.1.0",
       "resolved": "https://registry.npmjs.org/path-data-parser/-/path-data-parser-0.1.0.tgz",
@@ -10394,16 +9850,6 @@
         "node": ">=16 || 14 >=14.17"
       }
     },
-    "node_modules/path-to-regexp": {
-      "version": "8.4.2",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.2.tgz",
-      "integrity": "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA==",
-      "license": "MIT",
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
     "node_modules/pe-library": {
       "version": "0.4.1",
       "resolved": "https://registry.npmjs.org/pe-library/-/pe-library-0.4.1.tgz",
@@ -10614,19 +10060,6 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/proxy-addr": {
-      "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
-      "license": "MIT",
-      "dependencies": {
-        "forwarded": "0.2.0",
-        "ipaddr.js": "1.9.1"
-      },
-      "engines": {
-        "node": ">= 0.10"
-      }
-    },
     "node_modules/pump": {
       "version": "3.0.4",
       "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.4.tgz",
@@ -10656,22 +10089,6 @@
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
-    "node_modules/qs": {
-      "version": "6.15.3",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
-      "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==",
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "es-define-property": "^1.0.1",
-        "side-channel": "^1.1.1"
-      },
-      "engines": {
-        "node": ">=0.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
     "node_modules/quick-lru": {
       "version": "5.1.1",
       "resolved": "https://registry.npmjs.org/quick-lru/-/quick-lru-5.1.1.tgz",
@@ -10684,50 +10101,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/range-parser": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.3.0.tgz",
-      "integrity": "sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/raw-body": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz",
-      "integrity": "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==",
-      "license": "MIT",
-      "dependencies": {
-        "bytes": "~3.1.2",
-        "http-errors": "~2.0.1",
-        "iconv-lite": "~0.7.0",
-        "unpipe": "~1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.10"
-      }
-    },
-    "node_modules/raw-body/node_modules/iconv-lite": {
-      "version": "0.7.3",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
-      "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
-      "license": "MIT",
-      "dependencies": {
-        "safer-buffer": ">= 2.1.2 < 3.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
     "node_modules/rc": {
       "version": "1.2.8",
       "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
@@ -11058,15 +10431,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/require-from-string": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
-      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/resedit": {
       "version": "1.7.2",
       "resolved": "https://registry.npmjs.org/resedit/-/resedit-1.7.2.tgz",
@@ -11225,22 +10589,6 @@
         "points-on-path": "^0.2.1"
       }
     },
-    "node_modules/router": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/router/-/router-2.2.0.tgz",
-      "integrity": "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==",
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.4.0",
-        "depd": "^2.0.0",
-        "is-promise": "^4.0.0",
-        "parseurl": "^1.3.3",
-        "path-to-regexp": "^8.0.0"
-      },
-      "engines": {
-        "node": ">= 18"
-      }
-    },
     "node_modules/rw": {
       "version": "1.3.3",
       "resolved": "https://registry.npmjs.org/rw/-/rw-1.3.3.tgz",
@@ -11317,57 +10665,6 @@
       "license": "MIT",
       "optional": true
     },
-    "node_modules/send": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/send/-/send-1.2.1.tgz",
-      "integrity": "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==",
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.4.3",
-        "encodeurl": "^2.0.0",
-        "escape-html": "^1.0.3",
-        "etag": "^1.8.1",
-        "fresh": "^2.0.0",
-        "http-errors": "^2.0.1",
-        "mime-types": "^3.0.2",
-        "ms": "^2.1.3",
-        "on-finished": "^2.4.1",
-        "range-parser": "^1.2.1",
-        "statuses": "^2.0.2"
-      },
-      "engines": {
-        "node": ">= 18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/send/node_modules/mime-db": {
-      "version": "1.54.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
-      "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/send/node_modules/mime-types": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
-      "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
-      "license": "MIT",
-      "dependencies": {
-        "mime-db": "^1.54.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
     "node_modules/serialize-error": {
       "version": "7.0.1",
       "resolved": "https://registry.npmjs.org/serialize-error/-/serialize-error-7.0.1.tgz",
@@ -11384,25 +10681,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/serve-static": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-2.2.1.tgz",
-      "integrity": "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==",
-      "license": "MIT",
-      "dependencies": {
-        "encodeurl": "^2.0.0",
-        "escape-html": "^1.0.3",
-        "parseurl": "^1.3.3",
-        "send": "^1.2.0"
-      },
-      "engines": {
-        "node": ">= 18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
     "node_modules/set-blocking": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/set-blocking/-/set-blocking-2.0.0.tgz",
@@ -11416,12 +10694,6 @@
       "integrity": "sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==",
       "license": "MIT"
     },
-    "node_modules/setprototypeof": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
-      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
-      "license": "ISC"
-    },
     "node_modules/sharp": {
       "version": "0.35.2",
       "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.35.2.tgz",
@@ -11520,78 +10792,6 @@
         "node": ">=20"
       }
     },
-    "node_modules/side-channel": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
-      "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
-      "license": "MIT",
-      "dependencies": {
-        "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.4",
-        "side-channel-list": "^1.0.1",
-        "side-channel-map": "^1.0.1",
-        "side-channel-weakmap": "^1.0.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/side-channel-list": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
-      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
-      "license": "MIT",
-      "dependencies": {
-        "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.4"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/side-channel-map": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
-      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
-      "license": "MIT",
-      "dependencies": {
-        "call-bound": "^1.0.2",
-        "es-errors": "^1.3.0",
-        "get-intrinsic": "^1.2.5",
-        "object-inspect": "^1.13.3"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/side-channel-weakmap": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
-      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
-      "license": "MIT",
-      "dependencies": {
-        "call-bound": "^1.0.2",
-        "es-errors": "^1.3.0",
-        "get-intrinsic": "^1.2.5",
-        "object-inspect": "^1.13.3",
-        "side-channel-map": "^1.0.1"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
     "node_modules/signal-exit": {
       "version": "3.0.7",
       "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
@@ -11811,15 +11011,6 @@
         "node": ">= 6"
       }
     },
-    "node_modules/statuses": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
-      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
     "node_modules/streamdown": {
       "version": "2.5.0",
       "resolved": "https://registry.npmjs.org/streamdown/-/streamdown-2.5.0.tgz",
@@ -12188,15 +11379,6 @@
         "tmp": "^0.2.0"
       }
     },
-    "node_modules/toidentifier": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
-      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.6"
-      }
-    },
     "node_modules/trim-lines": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/trim-lines/-/trim-lines-3.0.1.tgz",
@@ -12269,62 +11451,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/type-is": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz",
-      "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==",
-      "license": "MIT",
-      "dependencies": {
-        "content-type": "^2.0.0",
-        "media-typer": "^1.1.0",
-        "mime-types": "^3.0.0"
-      },
-      "engines": {
-        "node": ">= 18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/type-is/node_modules/content-type": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
-      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/type-is/node_modules/mime-db": {
-      "version": "1.54.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
-      "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/type-is/node_modules/mime-types": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
-      "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
-      "license": "MIT",
-      "dependencies": {
-        "mime-db": "^1.54.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
     "node_modules/typescript": {
       "version": "5.9.3",
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
@@ -12467,15 +11593,6 @@
         "node": ">= 4.0.0"
       }
     },
-    "node_modules/unpipe": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
-      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
     "node_modules/update-browserslist-db": {
       "version": "1.2.3",
       "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
@@ -12552,15 +11669,6 @@
         "uuid": "dist-node/bin/uuid"
       }
     },
-    "node_modules/vary": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
-      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
     "node_modules/verror": {
       "version": "1.10.1",
       "resolved": "https://registry.npmjs.org/verror/-/verror-1.10.1.tgz",
@@ -12924,15 +12032,6 @@
         "url": "https://github.com/sponsors/colinhacks"
       }
     },
-    "node_modules/zod-to-json-schema": {
-      "version": "3.25.2",
-      "resolved": "https://registry.npmjs.org/zod-to-json-schema/-/zod-to-json-schema-3.25.2.tgz",
-      "integrity": "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA==",
-      "license": "ISC",
-      "peerDependencies": {
-        "zod": "^3.25.28 || ^4"
-      }
-    },
     "node_modules/zustand": {
       "version": "5.0.14",
       "resolved": "https://registry.npmjs.org/zustand/-/zustand-5.0.14.tgz",
diff --git a/package.json b/package.json
index b7a7012..5262c36 100644
--- a/package.json
+++ b/package.json
@@ -56,7 +56,7 @@
     "@electron-toolkit/utils": "^3.0.0",
     "@fontsource-variable/geist": "^5.2.9",
     "@fontsource-variable/geist-mono": "^5.2.8",
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/client": "^2.0.0",
     "@pierre/diffs": "^1.2.11",
     "ai": "^5.0.210",
     "better-sqlite3": "^12.11.1",
diff --git a/src/main/db/migrations.ts b/src/main/db/migrations.ts
index 6d88a65..b496b93 100644
--- a/src/main/db/migrations.ts
+++ b/src/main/db/migrations.ts
@@ -81,6 +81,19 @@ const REPAIR_SCHEMA_SQL = /* sql */ `
         config     TEXT NOT NULL DEFAULT '{}',
         enabled    INTEGER NOT NULL DEFAULT 1,
         created_at INTEGER NOT NULL
+      , origin TEXT NOT NULL DEFAULT 'user');
+  CREATE TABLE IF NOT EXISTS mcp_trust (
+        id          TEXT NOT NULL,
+        fingerprint TEXT NOT NULL,
+        provenance  TEXT NOT NULL,
+        scope       TEXT NOT NULL DEFAULT '',
+        decision    TEXT NOT NULL,
+        decided_at  INTEGER NOT NULL,
+        PRIMARY KEY (id, fingerprint, scope)
+      );
+  CREATE TABLE IF NOT EXISTS mcp_trusted_workspaces (
+        path       TEXT PRIMARY KEY,
+        trusted_at INTEGER NOT NULL
       );
   CREATE TABLE IF NOT EXISTS messages (
         id         TEXT PRIMARY KEY,
@@ -474,6 +487,76 @@ export const MIGRATIONS: Migration[] = [
   // deliberately structure-only and runs on every open). One DELETE, once.
   /* sql */ `
     DELETE FROM settings WHERE key = 'web_search_api_key';
+  `,
+
+  // ---- v23: MCP server trust (consent before Roxy spawns anything) ----
+  // A local MCP server is an arbitrary command run with the user’s own
+  // privileges, and two of the three places Roxy reads server definitions from
+  // are not the user: a workspace `.roxy/mcp.json` arrives with `git clone`, and
+  // the `mcp` agent tool is driven by a model that reads web pages and issues.
+  // Both used to connect automatically, which made "clone a repo, send any
+  // message" enough to execute attacker-chosen code.
+  //
+  // Consent is keyed by a FINGERPRINT of what actually executes (argv, cwd, env
+  // var NAMES, never their values) rather than by server id, so renaming an entry
+  // keeps its approval while swapping its command revokes it. `scope` is the
+  // workspace a decision belongs to (empty string = anywhere), so approving `db`
+  // in one repo never pre-approves a different repo's `db`. It is NOT NULL with a
+  // default because SQLite treats NULLs as distinct in a PRIMARY KEY, which would
+  // let duplicate global rows accumulate for the same decision.
+  //
+  // Two tables, not one: individual decisions, and whole workspaces trusted
+  // wholesale, which must also cover servers added to that project later and so
+  // cannot be expressed as a set of per-server rows.
+  /* sql */ `
+    CREATE TABLE IF NOT EXISTS mcp_trust (
+      id          TEXT NOT NULL,
+      fingerprint TEXT NOT NULL,
+      provenance  TEXT NOT NULL,
+      scope       TEXT NOT NULL DEFAULT '',
+      decision    TEXT NOT NULL,
+      decided_at  INTEGER NOT NULL,
+      PRIMARY KEY (id, fingerprint, scope)
+    );
+    CREATE TABLE IF NOT EXISTS mcp_trusted_workspaces (
+      path       TEXT PRIMARY KEY,
+      trusted_at INTEGER NOT NULL
+    );
+  `,
+
+  // ---- v24: record WHO added each MCP server row ----
+  // The `mcp` agent tool writes to `mcp_servers`, the same table Settings writes
+  // to. Without this column, a server the MODEL added became indistinguishable
+  // from one the user typed in the moment it was persisted - so the consent gate
+  // would read it back as self-consenting and launch it unprompted. That would
+  // turn the trust check into a formality a single prompt-injection can bypass.
+  //
+  // Existing rows are backfilled to 'user': they predate the agent tool being
+  // gated, and they are all rows a human could see and remove in Settings.
+  (db) => {
+    addColumnIfMissing(db, 'mcp_servers', 'origin', "TEXT NOT NULL DEFAULT 'user'")
+  },
+
+  // ---- v25: OAuth credentials for remote MCP servers ----
+  // A remote MCP server is an HTTP API that may hold the user's issues, calendar
+  // or database, so the spec protects it with OAuth 2.1 + PKCE + dynamic client
+  // registration. The SDK runs that dance but needs the host to persist what it
+  // earns.
+  //
+  // `payload` is encrypted at rest via secure.ts (OS keychain when available) -
+  // a refresh token is a long-lived bearer credential for a third-party account,
+  // and the settings table is not a place to keep one. `kind` separates the
+  // three lifetimes: the client registration and tokens persist, while the PKCE
+  // verifier is single-use and deleted the moment the code is exchanged.
+  /* sql */ `
+    CREATE TABLE IF NOT EXISTS mcp_oauth (
+      server_id  TEXT NOT NULL,
+      kind       TEXT NOT NULL,
+      payload    TEXT NOT NULL,
+      encrypted  INTEGER NOT NULL DEFAULT 0,
+      updated_at INTEGER NOT NULL,
+      PRIMARY KEY (server_id, kind)
+    );
   `
 ]
 
@@ -528,6 +611,38 @@ export function repairSchema(db: Database): void {
   db.exec(
     'CREATE TABLE IF NOT EXISTS pinned_models (provider_id TEXT NOT NULL, model TEXT NOT NULL, pinned_at INTEGER NOT NULL, PRIMARY KEY (provider_id, model))'
   )
+  // v23 MCP trust. Structure only: these tables record CONSENT, so a lost row
+  // must degrade to asking the user again, never to inventing an approval.
+  // v24's provenance column on mcp_servers (see the migration for why it is
+  // security-relevant, not cosmetic).
+  addColumnIfMissing(db, 'mcp_servers', 'origin', "TEXT NOT NULL DEFAULT 'user'")
+  // v25 OAuth credentials for remote MCP servers. Structure only: a lost row
+  // means the user signs in again, never a fabricated credential.
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS mcp_oauth (
+      server_id  TEXT NOT NULL,
+      kind       TEXT NOT NULL,
+      payload    TEXT NOT NULL,
+      encrypted  INTEGER NOT NULL DEFAULT 0,
+      updated_at INTEGER NOT NULL,
+      PRIMARY KEY (server_id, kind)
+    );
+  `)
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS mcp_trust (
+      id          TEXT NOT NULL,
+      fingerprint TEXT NOT NULL,
+      provenance  TEXT NOT NULL,
+      scope       TEXT NOT NULL DEFAULT '',
+      decision    TEXT NOT NULL,
+      decided_at  INTEGER NOT NULL,
+      PRIMARY KEY (id, fingerprint, scope)
+    );
+    CREATE TABLE IF NOT EXISTS mcp_trusted_workspaces (
+      path       TEXT PRIMARY KEY,
+      trusted_at INTEGER NOT NULL
+    );
+  `)
   // `projects` is derived state — one row per workspace folder its sessions use
   // — so a restored table can be rebuilt from the chats themselves, exactly as
   // v13 did on first upgrade. Only when empty, so a hand-ordered project list is
diff --git a/src/main/db/repo.ts b/src/main/db/repo.ts
index b79421a..40025dc 100644
--- a/src/main/db/repo.ts
+++ b/src/main/db/repo.ts
@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto'
 import { resolveSeed } from '../../shared/providers'
 import { normalizeServerConfig, type McpServerConfig, type McpServerRecord } from '../../shared/mcp'
+import type { McpTrustEntry, McpTrustStore } from '../../shared/mcp-trust'
 import { DEFAULT_BRANCH_PREFIX, normalizeBranchPrefix } from '../../shared/branch'
 import { DEFAULT_LANGUAGE, normalizeLanguage } from '../../shared/i18n'
 import type { Language } from '../../shared/i18n'
@@ -251,6 +252,9 @@ export function resetAll(): void {
        DELETE FROM providers;
        DELETE FROM integrations;
        DELETE FROM mcp_servers;
+       DELETE FROM mcp_oauth;
+       DELETE FROM mcp_trust;
+       DELETE FROM mcp_trusted_workspaces;
        DELETE FROM activity;
        DELETE FROM settings;`
     )
@@ -1409,6 +1413,7 @@ interface McpServerRow {
   config: string
   enabled: number
   created_at: number
+  origin: string | null
 }
 
 /** Every configured MCP server (a bad/legacy config row is skipped, not thrown). */
@@ -1420,30 +1425,53 @@ export function listMcpServers(): McpServerRecord[] {
   for (const row of rows) {
     const config = normalizeServerConfig(safeParse(row.config))
     if (!config) continue
-    out.push({ id: row.id, config, enabled: row.enabled > 0 })
+    // Anything that isn't exactly 'user' is treated as agent-added. Unknown
+    // values must fall to the side that still requires consent.
+    out.push({
+      id: row.id,
+      config,
+      enabled: row.enabled > 0,
+      origin: row.origin === 'user' ? 'user' : 'agent'
+    })
   }
   return out
 }
 
-/** Create or replace a server by id (name). Returns the stored record. */
+/**
+ * Create or replace a server by id (name). Returns the stored record.
+ *
+ * `origin` records WHO is writing (see McpServerRecord.origin). It defaults to
+ * 'agent' so a new call site cannot accidentally mint a self-consenting row:
+ * being wrongly asked to approve a server is a papercut, being wrongly NOT asked
+ * is arbitrary code execution.
+ *
+ * An existing row's origin is preserved on conflict unless the writer is the
+ * user: the user editing a config is a fresh human decision and upgrades the
+ * row, while the agent rewriting one must never launder it into 'user'.
+ */
 export function upsertMcpServer(input: {
   id: string
   config: McpServerConfig
   enabled?: boolean
+  origin?: 'user' | 'agent'
 }): McpServerRecord {
   const id = input.id.trim()
   if (!id) throw new Error('MCP server id is required')
   const config = normalizeServerConfig(input.config)
   if (!config) throw new Error('Invalid MCP server config')
   const enabled = input.enabled === false ? 0 : 1
+  const origin = input.origin ?? 'agent'
   getDb()
     .prepare(
-      `INSERT INTO mcp_servers(id, config, enabled, created_at)
-       VALUES(?, ?, ?, ?)
-       ON CONFLICT(id) DO UPDATE SET config = excluded.config, enabled = excluded.enabled`
+      `INSERT INTO mcp_servers(id, config, enabled, created_at, origin)
+       VALUES(?, ?, ?, ?, ?)
+       ON CONFLICT(id) DO UPDATE SET
+         config  = excluded.config,
+         enabled = excluded.enabled,
+         origin  = CASE WHEN excluded.origin = 'user' THEN 'user' ELSE mcp_servers.origin END`
     )
-    .run(id, JSON.stringify(config), enabled, Date.now())
-  return { id, config, enabled: enabled > 0 }
+    .run(id, JSON.stringify(config), enabled, Date.now(), origin)
+  return { id, config, enabled: enabled > 0, origin }
 }
 
 export function deleteMcpServer(id: string): void {
@@ -1456,6 +1484,225 @@ export function setMcpServerEnabled(id: string, enabled: boolean): void {
     .run(enabled ? 1 : 0, id)
 }
 
+// ---- MCP trust (consent to actually RUN a server) ----------------------------
+// See src/shared/mcp-trust.ts for what a fingerprint is and why consent is keyed
+// by it rather than by server name. This layer is storage only: it holds no
+// policy and makes no decisions.
+//
+// Every read degrades to "nothing is trusted" rather than throwing. A corrupt or
+// missing trust store must fail CLOSED - the user gets asked again, which is
+// merely annoying, instead of an approval being fabricated for a command nobody
+// approved.
+
+interface McpTrustRow {
+  id: string
+  fingerprint: string
+  provenance: string
+  scope: string
+  decision: string
+  decided_at: number
+}
+
+/** Empty string is how "applies anywhere" is stored; see the v23 migration. */
+const GLOBAL_SCOPE = ''
+
+/** Narrow one untrusted row; anything unrecognised is dropped (fail closed). */
+function toTrustEntry(row: McpTrustRow): McpTrustEntry | null {
+  if (row.decision !== 'allow' && row.decision !== 'deny') return null
+  const p = row.provenance
+  if (p !== 'user' && p !== 'workspace' && p !== 'agent' && p !== 'import') return null
+  return {
+    id: row.id,
+    fingerprint: row.fingerprint,
+    provenance: p,
+    scope: row.scope === GLOBAL_SCOPE ? null : row.scope,
+    decision: row.decision,
+    decidedAt: row.decided_at
+  }
+}
+
+/**
+ * Whether the user opted into confirming each new MCP server BEFORE it runs.
+ *
+ * Off by default: choosing to install a server is itself the decision, so the
+ * default posture is to run it and disclose what it exposed. This is the
+ * stricter opt-in for shared machines and untrusted repos.
+ *
+ * Its own accessor rather than a field on `AppSettings` because it is read on
+ * the connect path, not from a cached settings object the renderer also writes.
+ */
+export function getMcpConfirmBeforeRun(): boolean {
+  const row = getDb()
+    .prepare('SELECT value FROM settings WHERE key = ?')
+    .get('mcp_confirm_before_run') as { value: string } | undefined
+  return row?.value === '1'
+}
+
+/** Opt into confirming each new server before it runs (default: off). */
+export function setMcpConfirmBeforeRun(enabled: boolean): void {
+  setSetting('mcp_confirm_before_run', enabled ? '1' : null)
+}
+
+/** The whole trust store, for the pure resolver in shared/mcp-trust.ts. */
+export function getMcpTrustStore(): McpTrustStore {
+  try {
+    const entries = (
+      getDb().prepare('SELECT * FROM mcp_trust ORDER BY decided_at ASC').all() as McpTrustRow[]
+    )
+      .map(toTrustEntry)
+      .filter((e): e is McpTrustEntry => e !== null)
+    const workspaces = (
+      getDb()
+        .prepare('SELECT path, trusted_at FROM mcp_trusted_workspaces ORDER BY trusted_at ASC')
+        .all() as { path: string; trusted_at: number }[]
+    ).map((r) => ({ path: r.path, trustedAt: r.trusted_at }))
+    return { entries, workspaces }
+  } catch {
+    // Fail closed: an unreadable store means "ask", never "allow".
+    return { entries: [], workspaces: [] }
+  }
+}
+
+/** Remember one decision. Re-deciding the same (id, fingerprint, scope) replaces it. */
+export function recordMcpTrust(entry: McpTrustEntry): void {
+  getDb()
+    .prepare(
+      `INSERT INTO mcp_trust(id, fingerprint, provenance, scope, decision, decided_at)
+       VALUES(?, ?, ?, ?, ?, ?)
+       ON CONFLICT(id, fingerprint, scope) DO UPDATE SET
+         decision   = excluded.decision,
+         provenance = excluded.provenance,
+         decided_at = excluded.decided_at`
+    )
+    .run(
+      entry.id,
+      entry.fingerprint,
+      entry.provenance,
+      entry.scope ?? GLOBAL_SCOPE,
+      entry.decision,
+      entry.decidedAt
+    )
+}
+
+/**
+ * Forget decisions for a server id.
+ *
+ * With a `scope` argument this is scoped, so revoking a server in one project
+ * cannot silently revoke the same-named server the user approved in another.
+ * Omit it to forget the id everywhere (what "Revoke" in Settings does).
+ */
+export function revokeMcpTrust(id: string, scope?: string | null): void {
+  if (scope === undefined) {
+    getDb().prepare('DELETE FROM mcp_trust WHERE id = ?').run(id)
+    return
+  }
+  getDb()
+    .prepare('DELETE FROM mcp_trust WHERE id = ? AND scope = ?')
+    .run(id, scope ?? GLOBAL_SCOPE)
+}
+
+// ---- MCP OAuth (credentials for remote servers) ------------------------------
+// Encrypted at rest via secure.ts. Every read fails CLOSED to `null`: a
+// credential that cannot be decrypted (keychain moved, profile copied to another
+// machine) must send the user back through sign-in, never surface a broken token
+// that fails confusingly on the wire.
+
+type McpOAuthKind = 'client' | 'tokens' | 'verifier'
+
+function readOAuth<T>(serverId: string, kind: McpOAuthKind): T | null {
+  try {
+    const row = getDb()
+      .prepare('SELECT payload, encrypted FROM mcp_oauth WHERE server_id = ? AND kind = ?')
+      .get(serverId, kind) as { payload: string; encrypted: number } | undefined
+    if (!row) return null
+    return JSON.parse(decryptSecret({ data: row.payload, encrypted: row.encrypted > 0 })) as T
+  } catch {
+    return null
+  }
+}
+
+function writeOAuth(serverId: string, kind: McpOAuthKind, value: unknown): void {
+  const secure = encryptSecret(JSON.stringify(value))
+  getDb()
+    .prepare(
+      `INSERT INTO mcp_oauth(server_id, kind, payload, encrypted, updated_at)
+       VALUES(?, ?, ?, ?, ?)
+       ON CONFLICT(server_id, kind) DO UPDATE SET
+         payload    = excluded.payload,
+         encrypted  = excluded.encrypted,
+         updated_at = excluded.updated_at`
+    )
+    .run(serverId, kind, secure.data, secure.encrypted ? 1 : 0, Date.now())
+}
+
+/** The dynamic client registration earned for this server, if any. */
+export function getMcpOAuthClient<T>(serverId: string): T | null {
+  return readOAuth<T>(serverId, 'client')
+}
+
+export function saveMcpOAuthClient(serverId: string, info: unknown): void {
+  writeOAuth(serverId, 'client', info)
+}
+
+/** The access/refresh tokens for this server, if any. */
+export function getMcpOAuthTokens<T>(serverId: string): T | null {
+  return readOAuth<T>(serverId, 'tokens')
+}
+
+export function saveMcpOAuthTokens(serverId: string, tokens: unknown): void {
+  writeOAuth(serverId, 'tokens', tokens)
+}
+
+/**
+ * The in-flight PKCE code verifier.
+ *
+ * Read-once: the verifier is single-use by design, and leaving it behind after
+ * the exchange means a stale secret sitting in the database for a flow that
+ * already completed.
+ */
+export function getMcpOAuthVerifier(serverId: string): string | null {
+  const v = readOAuth<string>(serverId, 'verifier')
+  if (v) {
+    getDb().prepare("DELETE FROM mcp_oauth WHERE server_id = ? AND kind = 'verifier'").run(serverId)
+  }
+  return v
+}
+
+export function saveMcpOAuthVerifier(serverId: string, verifier: string): void {
+  writeOAuth(serverId, 'verifier', verifier)
+}
+
+/** Whether this server has usable stored tokens (drives the "signed in" badge). */
+export function hasMcpOAuth(serverId: string): boolean {
+  return getMcpOAuthTokens(serverId) !== null
+}
+
+/** Forget every credential for a server (sign out / server removed). */
+export function clearMcpOAuth(serverId: string): void {
+  getDb().prepare('DELETE FROM mcp_oauth WHERE server_id = ?').run(serverId)
+}
+
+/** Trust a whole workspace: every server it declares, now and in the future. */
+export function trustMcpWorkspace(path: string): void {
+  getDb()
+    .prepare(
+      `INSERT INTO mcp_trusted_workspaces(path, trusted_at) VALUES(?, ?)
+       ON CONFLICT(path) DO UPDATE SET trusted_at = excluded.trusted_at`
+    )
+    .run(path, Date.now())
+}
+
+/**
+ * Withdraw workspace-wide trust.
+ *
+ * Individual per-server decisions are deliberately left alone: each was made
+ * about one specific command, and this action means "stop blanket-trusting NEW
+ * servers here", not "forget everything I ever approved".
+ */
+export function untrustMcpWorkspace(path: string): void {
+  getDb().prepare('DELETE FROM mcp_trusted_workspaces WHERE path = ?').run(path)
+}
+
 // ---- Usage / cost ------------------------------------------------------------
 
 interface UsageRow {
diff --git a/src/main/harness/agent.ts b/src/main/harness/agent.ts
index 5fb2083..3aaff1d 100644
--- a/src/main/harness/agent.ts
+++ b/src/main/harness/agent.ts
@@ -62,9 +62,16 @@ import {
   mcpInstructions,
   mcpToolSchemas,
   mcpToolTitle,
+  mcpServerSummaries,
+  mcpToolDefinition,
   isMcpTool
 } from '../services/mcp'
-import type { McpServerRecord } from '../../shared/mcp'
+import {
+  gateRecords as gateMcpRecords,
+  discloseConnected as discloseMcpConnected,
+  type McpCandidate
+} from '../services/mcp-trust'
+import { uiResourceUri } from '../../shared/mcp-apps'
 import { SKILL_TOOL_NAME, SKILL_TOOL_DESCRIPTION } from '../../shared/skills'
 import { listSkills, skillInstructions } from '../services/skills'
 import { findGitRoot } from '../services/workspace'
@@ -496,14 +503,43 @@ function stripAnsi(s: string): string {
   return s.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g, '')
 }
 
+/**
+ * The server id embedded in a namespaced MCP tool name.
+ *
+ * `mcp__<server>__<tool>`; the server half is everything between the prefix and
+ * the final separator, so a server id containing the separator still resolves.
+ */
+function mcpServerIdOf(qualified: string): string {
+  const rest = qualified.slice('mcp__'.length)
+  const cut = rest.lastIndexOf('__')
+  return cut > 0 ? rest.slice(0, cut) : rest
+}
+
 /**
  * The MCP servers to connect for a turn: DB-configured globals overlaid by any
  * workspace `.roxy/mcp.json` entries (workspace wins on an id collision).
+ *
+ * Each record keeps its PROVENANCE, because that is what decides whether it may
+ * run at all. A DB row was typed by the user in Settings and is self-consenting;
+ * a workspace entry arrived with `git clone` and is attacker-controlled, so it
+ * has to clear the consent gate first (see services/mcp-trust.ts).
+ *
+ * The workspace-wins overlay is kept - a project overriding a global server by
+ * name is a legitimate thing to want - but the override INHERITS the workspace
+ * provenance, so shadowing a trusted global name cannot launder an untrusted
+ * command into a self-consenting one.
  */
-function gatherMcpRecords(cwd: string): McpServerRecord[] {
-  const byId = new Map<string, McpServerRecord>()
-  for (const r of repo.listMcpServers()) byId.set(r.id, r)
-  for (const r of loadWorkspaceMcpServers(cwd)) byId.set(r.id, r)
+function gatherMcpCandidates(cwd: string): McpCandidate[] {
+  const byId = new Map<string, McpCandidate>()
+  for (const record of repo.listMcpServers()) {
+    // A DB row is only self-consenting when a human wrote it; rows the `mcp`
+    // tool added still have to clear the gate (see McpServerRecord.origin).
+    const provenance = record.origin === 'agent' ? 'agent' : 'user'
+    byId.set(record.id, { record, provenance, workspace: null })
+  }
+  for (const record of loadWorkspaceMcpServers(cwd)) {
+    byId.set(record.id, { record, provenance: 'workspace', workspace: cwd })
+  }
   return [...byId.values()]
 }
 
@@ -987,14 +1023,30 @@ export async function runAgentTurn(opts: RunTurnOptions): Promise<void> {
   let mcpSchemas: ReturnType<typeof mcpToolSchemas> = []
   let mcpInfo: string | undefined
   if (toolCapable && cwd && !readOnly) {
-    const records = gatherMcpRecords(cwd)
-    if (records.length) {
-      await ensureMcpConnected(records, cwd)
-      // Scope to THIS turn's records so a workspace's `.roxy/mcp.json` servers can't
-      // leak into a different workspace's chat (the pool is process-global).
-      const ids = new Set(records.map((r) => r.id))
-      mcpSchemas = mcpToolSchemas(ids)
-      mcpInfo = mcpInstructions(ids)
+    const candidates = gatherMcpCandidates(cwd)
+    if (candidates.length) {
+      // Consent gate BEFORE connect: `ensureMcpConnected` spawns processes, so a
+      // server the user has not approved must never reach it. Servers that are
+      // denied (or whose prompt times out) are simply dropped, exactly like one
+      // that fails to spawn - a turn is never blocked on them.
+      const { records, disclose } = await gateMcpRecords(candidates)
+      if (records.length) {
+        await ensureMcpConnected(records, cwd)
+        // Scope to THIS turn's records so a workspace's `.roxy/mcp.json` servers can't
+        // leak into a different workspace's chat (the pool is process-global).
+        const ids = new Set(records.map((r) => r.id))
+        mcpSchemas = mcpToolSchemas(ids)
+        mcpInfo = mcpInstructions(ids)
+        // Tell the user what any newly-seen server actually turned out to be.
+        // Deliberately AFTER connecting: the tool list is the useful part of the
+        // notice, and it does not exist until the handshake has happened.
+        if (disclose.size) {
+          for (const summary of mcpServerSummaries(new Set(disclose.keys()))) {
+            const candidate = disclose.get(summary.id)
+            if (candidate) discloseMcpConnected(candidate, summary.tools, summary.error)
+          }
+        }
+      }
     }
   }
 
@@ -1364,13 +1416,25 @@ async function runLoop(o: LoopOptions): Promise<string> {
         run.end()
         signal.removeEventListener('abort', cascade)
       }
+      // Does this tool ship its own UI? Resolved here from the definition the
+      // server sent at discovery, so the renderer never reasons about MCP
+      // metadata - it is simply told that a view exists and where it lives.
+      //
+      // Only on success: a view is handed the tool result at initialize, and
+      // mounting one for a failed call would render an interface around an
+      // error the user is better off reading as text.
+      const uiUri =
+        result.ok && isMcpTool(tc.name)
+          ? uiResourceUri(mcpToolDefinition(tc.name)?._meta)
+          : undefined
       emitTool({
         type: 'tool-end',
         callId: tc.id,
         output: result.output,
         ok: result.ok,
         image: result.image,
-        diff: result.diff
+        diff: result.diff,
+        ...(uiUri ? { mcpApp: { serverId: mcpServerIdOf(tc.name), resourceUri: uiUri } } : {})
       })
       // Count the call. `recordTool` collapses the name through the closed
       // vocabulary, so an MCP tool reports as the literal `mcp` and its
@@ -1393,7 +1457,11 @@ async function runLoop(o: LoopOptions): Promise<string> {
     // workspace's MCP schemas and merge them into the tool list so the new tools
     // are callable on the very next model step (this turn), not only next message.
     if (cwd && !readOnly && others.some((tc) => tc.name === 'mcp')) {
-      const ids = new Set(gatherMcpRecords(cwd).map((r) => r.id))
+      // No gate here: this only re-reads schemas from servers ALREADY in the
+      // warm pool, and nothing reaches that pool without passing the consent
+      // check in the `mcp` tool itself. An unapproved server contributes no
+      // connection, so it contributes no tools.
+      const ids = new Set(gatherMcpCandidates(cwd).map((c) => c.record.id))
       liveMcpTools = mcpToolSchemas(ids)
       liveTools = [...baseTools, ...liveMcpTools]
     }
diff --git a/src/main/harness/tools.ts b/src/main/harness/tools.ts
index 8f6bc74..4166295 100644
--- a/src/main/harness/tools.ts
+++ b/src/main/harness/tools.ts
@@ -39,8 +39,14 @@ import {
   normalizeServerConfig,
   qualifyToolName,
   type McpServerConfig,
+  type McpServerRecord,
   type McpServerSummary
 } from '../../shared/mcp'
+import {
+  ensureTrusted as ensureMcpTrusted,
+  discloseConnected as discloseMcpConnected,
+  type McpCandidate
+} from '../services/mcp-trust'
 import {
   loadSkill,
   listSkills,
@@ -287,9 +293,15 @@ export async function runTool(
       default:
         // Tools contributed by connected MCP servers use namespaced names
         // (`mcp__<server>__<tool>`) — route them to the MCP pool. An MCP round
-        // trip has its own 120s timeout and no signal, so the turn stops
-        // waiting rather than blocking Stop for up to two minutes.
-        if (isMcpTool(name)) return await untilAborted(ctx.signal, () => callMcpTool(name, input))
+        // trip carries the server's own timeout budget.
+        // The signal goes BOTH ways now: `untilAborted` stops the turn waiting,
+        // and passing it into `callMcpTool` cancels the request itself, so the
+        // SDK emits `notifications/cancelled` and a well-behaved server can
+        // abandon its work instead of finishing into a void. Without the inner
+        // half, Stop only stopped us listening - the server kept going.
+        if (isMcpTool(name)) {
+          return await untilAborted(ctx.signal, () => callMcpTool(name, input, ctx.signal))
+        }
         return { ok: false, output: `Unknown tool: ${name}` }
     }
   } catch (e) {
@@ -1460,8 +1472,26 @@ async function runMcpTool(input: Record<string, unknown>, cwd: string): Promise<
             'mcp add: provide a LOCAL server "command" (argv array, e.g. ["npx","-y","@modelcontextprotocol/server-filesystem","/dir"]) OR a REMOTE "url".'
         }
       }
-      repo.upsertMcpServer({ id, config, enabled: true })
-      const summary = await reconnectMcpServer({ id, config, enabled: true }, cwd)
+      // Check BEFORE persisting. Normally this is a no-op that returns "run it",
+      // but when it does interrupt - a known server id now pointing at a
+      // different command - a declined answer must leave NOTHING behind. Writing
+      // first would park the rejected config in the DB, where the next `enable`
+      // or `reconnect` would read it back and be blocked by the very swap the
+      // user just refused.
+      const record: McpServerRecord = { id, config, enabled: true, origin: 'agent' }
+      const candidate = { record, provenance: 'agent' as const, workspace: cwd || null }
+      const { allowed, disclose } = await ensureMcpTrusted(candidate)
+      if (!allowed) {
+        return {
+          ok: false,
+          output: `MCP server "${id}" was not added: the user declined to run it.`
+        }
+      }
+      repo.upsertMcpServer({ id, config, enabled: true, origin: 'agent' })
+      const summary = await reconnectMcpServer(record, cwd)
+      // Show the user what the agent just wired up: the tool list is the whole
+      // point of the notice, and it only exists once the server has connected.
+      if (disclose) discloseMcpConnected(candidate, summary.tools, summary.error)
       return summarizeMcpConnect('Added', id, summary)
     }
     case 'reconnect':
@@ -1526,11 +1556,40 @@ function mcpListServers(): ToolResult {
   return { ok: true, output: `MCP servers (${records.length}):\n${lines.join('\n')}` }
 }
 
+/**
+ * Consent check shared by the connect-causing actions (`add`, `reconnect`,
+ * `enable`). All three end in a spawned process, so all three are gated - a gate
+ * on `add` alone would be trivially bypassed by adding a server while the user
+ * declines, then calling `reconnect`.
+ */
+/**
+ * Trust check shared by the connect-causing actions (`add`, `reconnect`,
+ * `enable`). Normally a no-op that returns "run it"; it only interrupts when a
+ * trusted entry's command changed, or when the user opted into confirming.
+ */
+async function mcpTrustCheck(
+  rec: McpServerRecord,
+  cwd: string
+): Promise<{ allowed: boolean; disclose: boolean; candidate: McpCandidate }> {
+  const candidate: McpCandidate = {
+    record: rec,
+    provenance: rec.origin === 'agent' ? 'agent' : 'user',
+    workspace: cwd || null
+  }
+  const { allowed, disclose } = await ensureMcpTrusted(candidate)
+  return { allowed, disclose, candidate }
+}
+
 async function mcpReconnectServer(id: string, cwd: string): Promise<ToolResult> {
   const rec = repo.listMcpServers().find((r) => r.id === id)
   if (!rec)
     return { ok: false, output: `mcp reconnect: no server named "${id}". Run action:"list".` }
+  const { allowed, disclose, candidate } = await mcpTrustCheck(rec, cwd)
+  if (!allowed) {
+    return { ok: false, output: `MCP server "${id}" was not connected: the user declined it.` }
+  }
   const summary = await reconnectMcpServer(rec, cwd)
+  if (disclose) discloseMcpConnected(candidate, summary.tools, summary.error)
   return summarizeMcpConnect('Reconnected', id, summary)
 }
 
@@ -1542,12 +1601,20 @@ async function mcpSetServerEnabled(id: string, enabled: boolean, cwd: string): P
       output: `mcp ${enabled ? 'enable' : 'disable'}: no server named "${id}". Run action:"list".`
     }
   }
-  repo.setMcpServerEnabled(id, enabled)
+  // Disabling is always allowed: it only ever REMOVES a capability.
   if (!enabled) {
+    repo.setMcpServerEnabled(id, false)
     await disposeConnection(id)
     return { ok: true, output: `Disabled MCP server "${id}" and disconnected it.` }
   }
-  const summary = await reconnectMcpServer({ ...rec, enabled: true }, cwd)
+  const enabledRec = { ...rec, enabled: true }
+  const { allowed, disclose, candidate } = await mcpTrustCheck(enabledRec, cwd)
+  if (!allowed) {
+    return { ok: false, output: `MCP server "${id}" was not enabled: the user declined it.` }
+  }
+  repo.setMcpServerEnabled(id, true)
+  const summary = await reconnectMcpServer(enabledRec, cwd)
+  if (disclose) discloseMcpConnected(candidate, summary.tools, summary.error)
   return summarizeMcpConnect('Enabled', id, summary)
 }
 
diff --git a/src/main/index.ts b/src/main/index.ts
index 06d0ee2..8c1895f 100644
--- a/src/main/index.ts
+++ b/src/main/index.ts
@@ -14,6 +14,9 @@ import { cleanupToolOutputs } from './services/tool-output-store'
 import { cancelAllBackgroundJobs } from './services/background-tasks'
 import { shutdownAllLsp } from './services/lsp'
 import { shutdownAllMcp } from './services/mcp'
+import { cancelAllConsent } from './services/mcp-trust'
+import { registerSandboxScheme, serveSandbox } from './services/mcp-app-sandbox'
+import { closeAllMcpApps } from './services/mcp-apps'
 import { shutdownRemote } from './services/remote'
 import { shutdownCliProxy } from './services/cliproxy'
 import { initAutoUpdater } from './services/updater'
@@ -97,6 +100,11 @@ async function warmCatalogThenBackfill(): Promise<void> {
   backfillUsageFromHistory()
 }
 
+// Custom scheme for MCP App views. MUST be registered before the app is ready:
+// privileges are locked in at that moment, and a view loaded on a non-standard
+// origin would not get the same-origin isolation the sandbox depends on.
+registerSandboxScheme()
+
 app.whenReady().then(() => {
   electronApp.setAppUserModelId('com.roxy.app')
   // Give the agent's browser window the Roxy icon too (no asset import in the
@@ -133,6 +141,7 @@ app.whenReady().then(() => {
   // backfilled rows can be priced (else they'd all cost $0). Best-effort + async.
   void warmCatalogThenBackfill()
 
+  serveSandbox()
   const mainWindow = createWindow()
   initAutoUpdater(mainWindow)
 
@@ -162,6 +171,10 @@ app.on('will-quit', () => {
   cancelAllBackgroundJobs()
   closeAllBrowsers()
   shutdownAllLsp()
+  // Resolve any open consent prompt as a DENY before the window goes away, so
+  // an awaiting connect unwinds instead of hanging until its timeout.
+  closeAllMcpApps()
+  cancelAllConsent()
   void shutdownAllMcp()
   shutdownRemote()
   // The Codex sidecar holds the user's subscription tokens - never leave it
diff --git a/src/main/ipc/index.ts b/src/main/ipc/index.ts
index 244d0c7..f2e62ad 100644
--- a/src/main/ipc/index.ts
+++ b/src/main/ipc/index.ts
@@ -1,4 +1,5 @@
 import { app, BrowserWindow, dialog, ipcMain, shell } from 'electron'
+import { randomUUID } from 'node:crypto'
 import { CHANNELS } from '../../shared/ipc'
 import type { Language } from '../../shared/i18n'
 import type { SessionConfigPatch } from '../../shared/session-config'
@@ -70,7 +71,30 @@ import {
   cancelSubagentRunsFor
 } from '../services/subagent-stream'
 import { cancelToolCall, cancelToolCallsFor } from '../services/tool-runs'
-import { mcpServerSummaries, reconnectMcpServer, disposeConnection } from '../services/mcp'
+import {
+  mcpServerSummaries,
+  reconnectMcpServer,
+  disposeConnection,
+  signInMcpServer,
+  signOutMcpServer,
+  isMcpSignedIn
+} from '../services/mcp'
+import {
+  ensureTrusted as ensureMcpTrusted,
+  discloseConnected as discloseMcpConnected,
+  resolveConsent as resolveMcpConsent,
+  setConfirmBeforeRun as setMcpConfirmBeforeRun,
+  trustPolicy as mcpTrustPolicy
+} from '../services/mcp-trust'
+import type { McpConsentResponse, McpProvenance } from '../../shared/mcp-trust'
+import {
+  launchMcpApp,
+  handleMcpAppRequest,
+  closeMcpApp,
+  setMcpAppTheme,
+  setMcpAppApprover,
+  type BridgeRequest
+} from '../services/mcp-apps'
 import {
   listSkills,
   refreshSkills,
@@ -148,6 +172,46 @@ function abortSession(sessionId: string): void {
   for (const controller of sessionControllers.get(sessionId) ?? []) controller.abort()
 }
 
+// ---- MCP App tool-call approvals -----------------------------------------
+// A view is untrusted code, so it does not get to invoke tools silently just
+// because the model invoked one. The broker asks; this relays the question to
+// the renderer and the answer back.
+const appApprovals = new Map<string, (allowed: boolean) => void>()
+
+/** Answer one pending approval (from the renderer). */
+function resolveAppApproval(res: { requestId: string; allowed: boolean }): void {
+  const resolve = appApprovals.get(res.requestId)
+  if (!resolve) return
+  appApprovals.delete(res.requestId)
+  resolve(res.allowed)
+}
+
+/** Ask the user; denies when there is no window to ask, or after two minutes. */
+function requestAppApproval(req: {
+  sessionId: string
+  serverId: string
+  toolName: string
+  args: unknown
+}): Promise<boolean> {
+  const win = BrowserWindow.getAllWindows().find((w) => !w.isDestroyed())
+  if (!win) return Promise.resolve(false)
+  const requestId = randomUUID()
+  return new Promise<boolean>((resolve) => {
+    const timer = setTimeout(() => {
+      appApprovals.delete(requestId)
+      // Unanswered is denied: a prompt that expires into a yes is one an
+      // attacker wins by waiting.
+      resolve(false)
+    }, 120_000)
+    timer.unref?.()
+    appApprovals.set(requestId, (allowed) => {
+      clearTimeout(timer)
+      resolve(allowed)
+    })
+    win.webContents.send(CHANNELS.mcpAppApprovalRequest, { requestId, ...req })
+  })
+}
+
 /** Merge persisted MCP server rows with their live connection status for the UI. */
 function listMcpServersWithStatus(): McpServerView[] {
   const statusById = new Map(mcpServerSummaries().map((s) => [s.id, s]))
@@ -159,7 +223,10 @@ function listMcpServersWithStatus(): McpServerView[] {
       enabled: rec.enabled,
       status: live?.status ?? 'disabled',
       tools: live?.tools ?? [],
-      error: live?.error
+      error: live?.error,
+      era: live?.era,
+      // Only meaningful for remote servers; local ones do not authenticate.
+      signedIn: rec.config.type === 'remote' ? isMcpSignedIn(rec.id) : undefined
     }
   })
 }
@@ -354,7 +421,10 @@ export function registerIpc(): void {
   // ---- MCP servers (Phase 13) ----
   ipcMain.handle(CHANNELS.mcpList, () => listMcpServersWithStatus())
   ipcMain.handle(CHANNELS.mcpUpsert, (_e, input: UpsertMcpServerInput) => {
-    repo.upsertMcpServer(input)
+    // This channel is only reachable from Settings / the MCP page, i.e. a human
+    // typing a config. That IS the consent, so the row is marked 'user' and the
+    // gate will not re-ask for it.
+    repo.upsertMcpServer({ ...input, origin: 'user' })
     return listMcpServersWithStatus()
   })
   ipcMain.handle(CHANNELS.mcpRemove, async (_e, id: string) => {
@@ -371,10 +441,73 @@ export function registerIpc(): void {
   })
   ipcMain.handle(CHANNELS.mcpReconnect, async (_e, id: string) => {
     const rec = repo.listMcpServers().find((r) => r.id === id)
-    if (rec) await reconnectMcpServer(rec, app.getPath('home'))
+    if (rec) {
+      const candidate = {
+        record: rec,
+        provenance: (rec.origin === 'agent' ? 'agent' : 'user') as McpProvenance,
+        workspace: null
+      }
+      const { allowed, disclose } = await ensureMcpTrusted(candidate)
+      if (allowed) {
+        const summary = await reconnectMcpServer(rec, app.getPath('home'))
+        // Reconnecting a server the user has never been shown is still worth a
+        // receipt - it is the first time its tools become knowable.
+        if (disclose) discloseMcpConnected(candidate, summary.tools, summary.error)
+      }
+    }
     return listMcpServersWithStatus()
   })
 
+  ipcMain.handle(CHANNELS.mcpSignIn, async (_e, id: string) => {
+    const rec = repo.listMcpServers().find((r) => r.id === id)
+    if (rec) await signInMcpServer(rec, app.getPath('home'))
+    return listMcpServersWithStatus()
+  })
+  ipcMain.handle(CHANNELS.mcpSignOut, async (_e, id: string) => {
+    await signOutMcpServer(id)
+    return listMcpServersWithStatus()
+  })
+
+  // ---- MCP Apps (server-supplied UI in a sandboxed frame) ----
+  // The renderer is a courier: it relays JSON-RPC frames from a view and
+  // mounts what comes back. It never holds an MCP client, so a compromised
+  // view (or renderer) still cannot reach a server directly.
+  setMcpAppApprover(requestAppApproval)
+  ipcMain.handle(
+    CHANNELS.mcpAppLaunch,
+    (_e, input: { serverId: string; toolName: string; resourceUri: string }) =>
+      launchMcpApp(input.serverId, input.toolName, input.resourceUri)
+  )
+  ipcMain.handle(CHANNELS.mcpAppRequest, (_e, req: BridgeRequest) => handleMcpAppRequest(req))
+  ipcMain.handle(CHANNELS.mcpAppClose, (_e, sessionId: string) => closeMcpApp(sessionId))
+  ipcMain.on(CHANNELS.mcpAppTheme, (_e, theme: unknown) => setMcpAppTheme(theme))
+  ipcMain.on(CHANNELS.mcpAppApprovalRespond, (_e, res: { requestId: string; allowed: boolean }) =>
+    resolveAppApproval(res)
+  )
+
+  // ---- MCP trust (consent before Roxy spawns a server) ----
+  ipcMain.on(CHANNELS.mcpConsentRespond, (_e, response: McpConsentResponse) => {
+    resolveMcpConsent(response)
+  })
+  ipcMain.handle(CHANNELS.mcpTrustList, () => {
+    const store = repo.getMcpTrustStore()
+    return { entries: store.entries, workspaces: store.workspaces, policy: mcpTrustPolicy() }
+  })
+  ipcMain.handle(
+    CHANNELS.mcpTrustRevoke,
+    (_e, target: { kind: 'server'; id: string } | { kind: 'workspace'; path: string }) => {
+      if (target.kind === 'workspace') repo.untrustMcpWorkspace(target.path)
+      else repo.revokeMcpTrust(target.id)
+      const store = repo.getMcpTrustStore()
+      return { entries: store.entries, workspaces: store.workspaces, policy: mcpTrustPolicy() }
+    }
+  )
+  ipcMain.handle(CHANNELS.mcpTrustGetPolicy, () => mcpTrustPolicy())
+  ipcMain.handle(CHANNELS.mcpTrustSetPolicy, (_e, confirmBeforeRun: boolean) => {
+    setMcpConfirmBeforeRun(confirmBeforeRun)
+    return mcpTrustPolicy()
+  })
+
   // ---- skills (SKILL.md discovery) ----
   ipcMain.handle(CHANNELS.skillsList, (_e, cwd?: string) => discoverSkillViews(cwd))
   ipcMain.handle(CHANNELS.skillsRefresh, (_e, cwd?: string) => {
diff --git a/src/main/services/mcp-app-sandbox.ts b/src/main/services/mcp-app-sandbox.ts
new file mode 100644
index 0000000..14aaa39
--- /dev/null
+++ b/src/main/services/mcp-app-sandbox.ts
@@ -0,0 +1,267 @@
+/**
+ * The MCP Apps sandbox origin — where untrusted, server-supplied HTML runs.
+ *
+ * ## The problem
+ *
+ * An MCP App is arbitrary HTML+JS written by whoever wrote the MCP server. It
+ * has to execute for the feature to exist at all. The entire job of this module
+ * is making sure that when it executes, it is somewhere that can hurt nothing.
+ *
+ * Roxy's renderer runs with `contextIsolation: true` but `sandbox: false` and a
+ * preload that exposes `window.roxy` — the full IPC surface. An iframe on the
+ * app's own origin could reach that, plus `localStorage`, IndexedDB, and the
+ * session's cookie jar. So the view must not share Roxy's origin, and "must not"
+ * has to be enforced by the browser, not by our own care.
+ *
+ * ## The design
+ *
+ * A custom `roxy-mcp-app://` protocol, registered as a standard scheme, serves
+ * exactly one document: the sandbox proxy. Because it is a distinct scheme with
+ * its own dedicated origin, the same-origin policy does the enforcement for us —
+ * the proxy cannot touch Roxy's window, storage, or preload even if it tries.
+ *
+ * Inside it, the proxy writes the view's HTML into a NESTED iframe with the
+ * resource's CSP applied. That is the "double iframe" SEP-1865 requires:
+ *
+ *   Roxy renderer  -> <iframe src="roxy-mcp-app://..."> (separate origin)
+ *                         -> <iframe> + document.write    (CSP-restricted)
+ *
+ * The outer frame exists purely to be a different origin and to relay
+ * `postMessage`. The inner frame holds the untrusted document. Neither can see
+ * Roxy.
+ *
+ * The proxy source is inlined as a string rather than shipped as a file because
+ * it must be served by the protocol handler from memory: there is no directory
+ * this origin maps to, and pointing it at one would give the view a filesystem
+ * root to probe.
+ */
+import { app, protocol, session } from 'electron'
+import { SANDBOX_METHOD_PREFIX } from '../../shared/mcp-apps'
+
+/** Scheme owned by the sandbox. Nothing else in Roxy serves it. */
+export const SANDBOX_SCHEME = 'roxy-mcp-app'
+
+/** The single URL the scheme serves. */
+export const SANDBOX_URL = `${SANDBOX_SCHEME}://view/index.html`
+
+/**
+ * Build a sandbox URL carrying the app policy for the protocol handler.
+ *
+ * The official host serves one CSP header per app frame. A meta policy inside
+ * the nested document is not equivalent: it can only make the proxy's header
+ * stricter, never loosen `default-src 'none'` to permit declared Cesium/OSM
+ * domains. The query is internal to this custom scheme and never reaches a
+ * network server.
+ */
+export function sandboxUrlForCsp(csp: string): string {
+  const url = new URL(SANDBOX_URL)
+  url.searchParams.set('csp', csp)
+  return url.toString()
+}
+
+/**
+ * Register the scheme's privileges.
+ *
+ * MUST be called before `app.whenReady()`. `standard: true` gives it a real
+ * origin (so same-origin checks apply and `postMessage` has a meaningful
+ * `event.origin`); `secure: true` stops Chromium treating it as insecure
+ * content. Deliberately NOT `allowServiceWorkers` or `supportFetchAPI`: a view
+ * has no business persisting a worker or fetching from this origin, and the
+ * network it may reach is governed by CSP instead.
+ */
+export function registerSandboxScheme(): void {
+  protocol.registerSchemesAsPrivileged([
+    {
+      scheme: SANDBOX_SCHEME,
+      privileges: { standard: true, secure: true, supportFetchAPI: false }
+    }
+  ])
+}
+
+/** The tile host used by the official map MCP App. */
+export const OPENSTREETMAP_TILE_PATTERN = 'https://tile.openstreetmap.org/*'
+
+/**
+ * Identify Roxy to OSM when a native MCP App requests its standard tiles.
+ *
+ * A custom-scheme frame cannot send the HTTPS page referrer OSM expects from a
+ * web host. Chromium instead sends a generic Electron user agent and no
+ * referrer, which OSM answers with an "Access blocked" PNG (still status 200).
+ * Their native-client policy accepts a stable, contactable application user
+ * agent. This changes only the exact official tile host; every other app request
+ * remains untouched and still has to pass its resource-declared CSP.
+ */
+export function identifyOpenStreetMapRequest(
+  requestHeaders: Record<string, string>,
+  version: string
+): Record<string, string> {
+  const headers = { ...requestHeaders }
+  for (const key of Object.keys(headers)) {
+    if (key.toLowerCase() === 'user-agent') delete headers[key]
+  }
+  const safeVersion = /^[a-z0-9.+_-]+$/i.test(version) ? version : 'unknown'
+  headers['User-Agent'] = `Roxy/${safeVersion} (+https://roxy.gg)`
+  return headers
+}
+
+/** Serve the proxy document. Called once, after the app is ready. */
+export function serveSandbox(): void {
+  session.defaultSession.webRequest.onBeforeSendHeaders(
+    { urls: [OPENSTREETMAP_TILE_PATTERN] },
+    (details, callback) => {
+      callback({
+        requestHeaders: identifyOpenStreetMapRequest(details.requestHeaders, app.getVersion())
+      })
+    }
+  )
+
+  protocol.handle(SANDBOX_SCHEME, async (request) => {
+    const url = new URL(request.url)
+    // One document, one path. Anything else 404s rather than being treated as a
+    // path into something real.
+    if (url.pathname !== '/index.html') {
+      return new Response('Not found', { status: 404 })
+    }
+    const viewCsp = url.searchParams.get('csp')
+    return new Response(PROXY_HTML, {
+      status: 200,
+      headers: {
+        'content-type': 'text/html; charset=utf-8',
+        'cache-control': 'no-cache, no-store, must-revalidate',
+        // One tamper-proof policy per app frame, matching the official host.
+        // The proxy script itself is inline, so script-src must retain
+        // unsafe-inline even if a malformed internal URL arrives.
+        'content-security-policy':
+          viewCsp ||
+          "default-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-src 'self'"
+      }
+    })
+  })
+}
+
+/**
+ * The sandbox proxy document.
+ *
+ * Responsibilities, and nothing else:
+ *  1. Announce readiness to the host.
+ *  2. Receive the view's HTML + CSP, write it into a nested iframe.
+ *  3. Relay messages both ways, verbatim.
+ *
+ * It never synthesizes requests of its own (SEP-1865 §Sandbox proxy rule 7),
+ * because inventing request ids would break the id-correlation both sides rely
+ * on. It is a wire, not a participant.
+ */
+const PROXY_HTML = /* html */ `<!doctype html>
+<html>
+<head><meta charset="utf-8" />
+<style>
+  html,body{margin:0;padding:0;height:100%;background:transparent;color-scheme:inherit}
+  iframe{display:block;width:100%;height:100%;border:0;background:transparent}
+</style>
+</head>
+<body>
+<script>
+(function () {
+  'use strict'
+
+  // The proxy is only ever meaningful inside a frame. Loading it directly (a
+  // user pasting the URL) should do nothing at all.
+  if (window.self === window.top) return
+
+  var host = window.parent
+  var hostOrigin = null
+  var view = null
+  var SANDBOX_PREFIX = ${JSON.stringify(SANDBOX_METHOD_PREFIX)}
+
+  function toHost(msg) {
+    if (hostOrigin) host.postMessage(msg, hostOrigin)
+  }
+
+  window.addEventListener('message', function (event) {
+    var data = event.data
+
+    // ---- from the HOST ----------------------------------------------------
+    // The first message pins the host's origin; everything after must match it,
+    // so a nested frame cannot impersonate the host by posting upward.
+    if (event.source === host) {
+      if (hostOrigin === null) hostOrigin = event.origin
+      if (event.origin !== hostOrigin) return
+
+      if (data && data.method === SANDBOX_PREFIX + 'resource-ready') {
+        var p = data.params || {}
+        var frame = document.createElement('iframe')
+        // 'allow-same-origin' is present deliberately, and it is NOT a hole:
+        // the inner frame's origin is this PROXY's origin, which is already a
+        // throwaway custom scheme with no storage, no cookies and no access to
+        // Roxy's renderer. Same-origin here means "same as the sandbox", not
+        // "same as the app".
+        //
+        // Without it, real views simply do not run. An opaque document cannot
+        // use 'localStorage', 'indexedDB', 'SharedWorker', WebGL context
+        // creation in some engines, or 'document.cookie' - and libraries like
+        // CesiumJS touch several of those during startup, fail, and render a
+        // white box. That is the blank map.
+        //
+        // 'allow-forms' matches the reference host so ordinary form controls
+        // behave. Navigation is still withheld: no 'allow-top-navigation', no
+        // 'allow-popups', so a view that wants to go somewhere must ask via
+        // 'ui/open-link' where the host can vet the URL.
+        frame.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-forms')
+        if (p.allow) frame.setAttribute('allow', p.allow)
+        // Assign before document.write: inline app scripts can call app.connect()
+        // synchronously while write() is still running. If 'view' is null then,
+        // the proxy drops ui/initialize and the app waits forever.
+        view = frame
+        document.body.appendChild(frame)
+        // 'document.write', not 'srcdoc'. srcdoc documents are treated as
+        // opaque/inherited-origin in ways that break scripts which resolve URLs
+        // against 'document.baseURI' or construct workers - CesiumJS being the
+        // canonical example, which is why the reference host does the same.
+        // The frame must be in the DOM first for 'contentDocument' to exist.
+        var doc = frame.contentDocument || (frame.contentWindow && frame.contentWindow.document)
+        if (doc) {
+          doc.open()
+          // CSP is already a tamper-proof response header on this proxy and is
+          // inherited by the about:blank child. Adding a meta policy here would
+          // intersect with it and can only make the app stricter.
+          doc.write(String(p.html || ''))
+          doc.close()
+        } else {
+          // Only reachable if the frame was blocked from initialising at all.
+          frame.srcdoc = String(p.html || '')
+        }
+        return
+      }
+
+      // Anything else from the host is for the view. Never forward the reserved
+      // sandbox namespace onward.
+      if (data && typeof data.method === 'string' && data.method.indexOf(SANDBOX_PREFIX) === 0) {
+        return
+      }
+      if (view && view.contentWindow) view.contentWindow.postMessage(data, '*')
+      return
+    }
+
+    // ---- from the VIEW ----------------------------------------------------
+    // Only the frame we created may speak. Anything else posting into this
+    // window is not part of the conversation.
+    if (view && event.source === view.contentWindow) {
+      // Window identity survives a self-navigation. Check origin too, otherwise
+      // a view that navigated itself to an external page would keep the same
+      // contentWindow handle and that page could speak through this broker.
+      if (event.origin !== window.location.origin) return
+      if (data && typeof data.method === 'string' && data.method.indexOf(SANDBOX_PREFIX) === 0) {
+        return
+      }
+      toHost(data)
+    }
+  })
+
+  // Tell the host we can accept a resource. Sent with '*' because the host's
+  // origin is not yet known - this notification carries no data, and the host
+  // verifies the source frame on its side.
+  host.postMessage({ jsonrpc: '2.0', method: SANDBOX_PREFIX + 'proxy-ready', params: {} }, '*')
+})()
+</script>
+</body>
+</html>`
diff --git a/src/main/services/mcp-apps.ts b/src/main/services/mcp-apps.ts
new file mode 100644
index 0000000..5b09c40
--- /dev/null
+++ b/src/main/services/mcp-apps.ts
@@ -0,0 +1,399 @@
+/**
+ * The MCP Apps broker — the security boundary between a view and Roxy.
+ *
+ * The renderer never holds an MCP client. A view's request arrives over IPC as
+ * data, is validated here, and is executed against the ONE server that view
+ * belongs to. That indirection is the whole point: the authenticated connection,
+ * the OAuth tokens, and the ability to spawn processes all stay in main, and the
+ * renderer is reduced to a courier for JSON-RPC frames it cannot act on itself.
+ *
+ * ## What this file refuses
+ *
+ *  - **Cross-server calls.** A session is bound to its origin server at
+ *    creation. A view asking for `mcp__other__tool` gets an error, not a call.
+ *  - **Unapproved tool calls.** A view is untrusted code; it does not get to
+ *    invoke tools silently just because the model invoked one. Approval is
+ *    per (app, tool) and remembered for the session.
+ *  - **Unknown sessions.** Every request carries a session id minted here. A
+ *    renderer that guesses one gets nothing.
+ */
+import { randomUUID } from 'node:crypto'
+import { app, shell } from 'electron'
+import {
+  BRIDGE_ERROR,
+  isOpenableUrl,
+  routeBridgeMethod,
+  uiResourceMeta,
+  buildCsp,
+  buildAllow,
+  externalDomains,
+  negotiateDisplayMode,
+  APPS_PROTOCOL_VERSION,
+  SUPPORTED_DISPLAY_MODES,
+  UI_MIME,
+  sanitizeMcpAppHostTheme,
+  type McpAppHostTheme,
+  type McpUiInitializeResult
+} from '../../shared/mcp-apps'
+import {
+  callMcpTool,
+  readMcpResource,
+  listMcpResources,
+  mcpToolDefinition,
+  lastMcpCallResult
+} from './mcp'
+import { toMcpCallResult } from '../../shared/mcp-content'
+import { sandboxUrlForCsp } from './mcp-app-sandbox'
+import { qualifyToolName } from '../../shared/mcp'
+
+/** One live app view. Created when a UI-bearing tool call renders. */
+interface AppSession {
+  id: string
+  /** The server this view came from. Every request is pinned to it. */
+  serverId: string
+  /** The tool call that produced this view. */
+  toolName: string
+  /** `ui://` resource the view was loaded from. */
+  resourceUri: string
+  /** Tools the user has allowed this view to call, unqualified. */
+  approved: Set<string>
+  /** Model context the view has pushed, if any (last write wins, per spec). */
+  modelContext?: { content?: unknown; structuredContent?: unknown }
+  createdAt: number
+}
+
+const sessions = new Map<string, AppSession>()
+
+/**
+ * Cap on concurrent live views.
+ *
+ * Each holds a frame and its retained result. A long transcript can accumulate
+ * dozens of app cards, and every one of them is a running document; without a
+ * ceiling, scrolling back through a session with many UI tools would keep them
+ * all alive. Oldest is evicted first.
+ */
+const MAX_SESSIONS = 12
+
+/** What the renderer needs to mount a view. */
+export interface McpAppLaunch {
+  sessionId: string
+  /** The view's HTML, read from its `ui://` resource. */
+  html: string
+  /** Sandbox proxy URL carrying this app's response-header CSP. */
+  sandboxUrl: string
+  /** CSP applied to the sandbox response and inherited by the view. */
+  csp: string
+  /** Complete bounded MCP tool result delivered after initialization. */
+  toolResult?: unknown
+  /** `allow` attribute for declared device permissions. */
+  allow: string
+  /** External origins this view declared, for disclosure. */
+  externalDomains: string[]
+  /** Display modes both the view and this host support. */
+  displayModes: string[]
+}
+
+/**
+ * Prepare a view for a completed tool call.
+ *
+ * Returns `null` when the tool has no UI, when the resource is missing, or when
+ * it isn't actually an MCP App — every one of which is a normal outcome that
+ * should leave the tool card rendering its text result as usual.
+ */
+export async function launchMcpApp(
+  serverId: string,
+  qualifiedToolName: string,
+  resourceUri: string
+): Promise<McpAppLaunch | null> {
+  // Fetch the listing too: per the Apps spec, content-level metadata from
+  // resources/read wins, and resources/list is the fallback. The official map
+  // declares its Cesium/OpenStreetMap CSP on the content item; several servers
+  // put it only on the listing, so both paths are required for interop.
+  const [contents, resources] = await Promise.all([
+    readMcpResource(serverId, resourceUri),
+    listMcpResources(serverId)
+  ])
+  if ('error' in contents) return null
+  // Must be HTML declaring the MCP Apps profile. A server pointing `ui://` at a
+  // PNG or a JSON blob is not offering a view, and rendering whatever came back
+  // as a document would be exactly the confusion this check exists to stop.
+  if (!contents.mimeType?.startsWith('text/html')) return null
+  if (!contents.text || contents.truncated) return null
+
+  const listing = resources.find((r) => r.uri === resourceUri)
+  const meta = uiResourceMeta(contents._meta) ?? uiResourceMeta(listing?._meta)
+
+  evictOldest()
+  const session: AppSession = {
+    id: randomUUID(),
+    serverId,
+    toolName: qualifiedToolName,
+    resourceUri,
+    approved: new Set(),
+    createdAt: Date.now()
+  }
+  sessions.set(session.id, session)
+
+  const csp = buildCsp(meta?.csp)
+  return {
+    sessionId: session.id,
+    html: contents.text,
+    // The CSP must be on the proxy response, like the official host. Injecting a
+    // second policy as a meta tag cannot loosen the proxy's own `default-src
+    // 'none'`: browser CSPs intersect, so Cesium remains blocked even when the
+    // app declared its domains correctly.
+    sandboxUrl: sandboxUrlForCsp(csp),
+    csp,
+    toolResult: toMcpCallResult(lastMcpCallResult(qualifiedToolName)),
+    allow: buildAllow(meta?.permissions),
+    externalDomains: externalDomains(meta),
+    displayModes: (meta?.availableDisplayModes ?? SUPPORTED_DISPLAY_MODES).filter((m) =>
+      (SUPPORTED_DISPLAY_MODES as string[]).includes(m)
+    )
+  }
+}
+
+/** Drop the oldest session once the ceiling is reached. */
+function evictOldest(): void {
+  if (sessions.size < MAX_SESSIONS) return
+  let oldest: AppSession | undefined
+  for (const s of sessions.values()) {
+    if (!oldest || s.createdAt < oldest.createdAt) oldest = s
+  }
+  if (oldest) sessions.delete(oldest.id)
+}
+
+/** Tear down one view (its card unmounted, or the transcript moved on). */
+export function closeMcpApp(sessionId: string): void {
+  sessions.delete(sessionId)
+}
+
+/** Drop every view (window closing, workspace switch, tests). */
+export function closeAllMcpApps(): void {
+  sessions.clear()
+}
+
+/**
+ * The model context a view has pushed, for injection into the next turn.
+ *
+ * Per spec each update overwrites the previous one, and the host sends only the
+ * latest before the next user message.
+ */
+export function mcpAppModelContext(): { toolName: string; context: unknown }[] {
+  const out: { toolName: string; context: unknown }[] = []
+  for (const s of sessions.values()) {
+    if (s.modelContext) out.push({ toolName: s.toolName, context: s.modelContext })
+  }
+  return out
+}
+
+// ---------------------------------------------------------------------------
+// Request handling
+// ---------------------------------------------------------------------------
+
+/** A JSON-RPC frame from a view, as relayed by the renderer. */
+export interface BridgeRequest {
+  sessionId: string
+  id?: string | number | null
+  method?: unknown
+  params?: Record<string, unknown>
+}
+
+export interface BridgeReply {
+  result?: unknown
+  error?: { code: number; message: string }
+}
+
+/** Ask the user to approve a tool call, via the renderer. Injected to avoid a cycle. */
+type ApprovalFn = (req: {
+  sessionId: string
+  serverId: string
+  toolName: string
+  args: unknown
+}) => Promise<boolean>
+
+let askApproval: ApprovalFn = async () => false
+
+export function setMcpAppApprover(fn: ApprovalFn): void {
+  askApproval = fn
+}
+
+/** Host theme, supplied by the renderer at launch so the view can match it. */
+let currentTheme: McpAppHostTheme = { mode: 'dark', variables: {} }
+
+export function setMcpAppTheme(theme: unknown): void {
+  currentTheme = sanitizeMcpAppHostTheme(theme)
+}
+
+/**
+ * Handle one request from a view.
+ *
+ * Never throws: a malformed or hostile frame becomes a JSON-RPC error, because
+ * the alternative is an unhandled rejection in the IPC layer taking down
+ * something a view should not be able to reach.
+ */
+export async function handleMcpAppRequest(req: BridgeRequest): Promise<BridgeReply> {
+  const session = sessions.get(req.sessionId)
+  // An unknown session is either a stale frame after teardown or a renderer
+  // guessing ids. Neither gets served.
+  if (!session) {
+    return { error: { code: BRIDGE_ERROR.denied, message: 'No such app session.' } }
+  }
+
+  const route = routeBridgeMethod(req.method)
+  if (route.kind === 'reject') {
+    return { error: { code: BRIDGE_ERROR.methodNotFound, message: route.reason } }
+  }
+
+  try {
+    if (route.kind === 'host') return await handleHostMethod(session, route.method, req.params)
+    return await handleForwarded(session, route.method, req.params)
+  } catch (e) {
+    return {
+      error: { code: BRIDGE_ERROR.denied, message: (e as Error)?.message ?? 'Request failed' }
+    }
+  }
+}
+
+async function handleHostMethod(
+  session: AppSession,
+  method: string,
+  params: Record<string, unknown> | undefined
+): Promise<BridgeReply> {
+  switch (method) {
+    case 'ui/initialize': {
+      const result: McpUiInitializeResult = {
+        protocolVersion: APPS_PROTOCOL_VERSION,
+        hostInfo: { name: 'Roxy', version: app.getVersion() },
+        hostCapabilities: {
+          serverTools: {},
+          serverResources: {},
+          openLinks: {},
+          // Do not advertise `message`: Roxy does not yet feed ui/message into
+          // the composer, and claiming a no-op capability breaks feature
+          // detection in conforming apps.
+          updateModelContext: { text: {} }
+        },
+        hostContext: {
+          theme: currentTheme.mode,
+          styles: { variables: currentTheme.variables },
+          displayMode: 'inline',
+          availableDisplayModes: SUPPORTED_DISPLAY_MODES,
+          containerDimensions: { maxHeight: 1200 },
+          platform: 'desktop',
+          userAgent: `Roxy/${app.getVersion()}`
+        }
+      }
+      return { result }
+    }
+
+    case 'ui/notifications/initialized':
+      return { result: {} }
+
+    case 'ui/open-link': {
+      const url = params?.url
+      if (!isOpenableUrl(url)) {
+        // Rejecting non-http(s) is the point: a view must not be able to make
+        // the host launch `file://` or some other app's registered scheme.
+        return { error: { code: BRIDGE_ERROR.invalidParams, message: 'Invalid URL' } }
+      }
+      await shell.openExternal(url as string)
+      return { result: {} }
+    }
+
+    case 'ui/request-display-mode':
+      return { result: { mode: negotiateDisplayMode(params?.mode) } }
+
+    case 'ui/update-model-context':
+      // Last write wins, per spec. Stored, not injected: it reaches the model
+      // with the next user message.
+      session.modelContext = {
+        content: params?.content,
+        structuredContent: params?.structuredContent
+      }
+      return { result: {} }
+
+    case 'ui/message':
+      // Handled in the renderer (it owns the composer); reaching here means the
+      // renderer relayed it without intercepting.
+      return { result: {} }
+
+    default:
+      return { error: { code: BRIDGE_ERROR.methodNotFound, message: method } }
+  }
+}
+
+async function handleForwarded(
+  session: AppSession,
+  method: string,
+  params: Record<string, unknown> | undefined
+): Promise<BridgeReply> {
+  if (method === 'resources/read') {
+    const uri = params?.uri
+    if (typeof uri !== 'string') {
+      return { error: { code: BRIDGE_ERROR.invalidParams, message: 'Missing uri' } }
+    }
+    // Pinned to the view's own server: a view cannot read another server's
+    // resources by naming them.
+    const contents = await readMcpResource(session.serverId, uri)
+    if ('error' in contents) {
+      return { error: { code: BRIDGE_ERROR.denied, message: contents.error } }
+    }
+    return { result: { contents: [contents] } }
+  }
+
+  // tools/call
+  const name = params?.name
+  const args = (params?.arguments ?? {}) as Record<string, unknown>
+  if (typeof name !== 'string' || !name) {
+    return { error: { code: BRIDGE_ERROR.invalidParams, message: 'Missing tool name' } }
+  }
+
+  // The view names an UNQUALIFIED tool; we qualify it against the session's own
+  // server. This is what makes cross-server calls impossible rather than merely
+  // discouraged - there is no code path that reads a server id from the view.
+  const qualified = qualifyToolName(session.serverId, name)
+  if (!mcpToolDefinition(qualified)) {
+    return { error: { code: BRIDGE_ERROR.invalidParams, message: `Unknown tool: ${name}` } }
+  }
+
+  if (!session.approved.has(name)) {
+    const ok = await askApproval({
+      sessionId: session.id,
+      serverId: session.serverId,
+      toolName: name,
+      args
+    })
+    if (!ok) {
+      return { error: { code: BRIDGE_ERROR.denied, message: 'Tool call denied by user.' } }
+    }
+    // Remembered per session, not per call: a spreadsheet view that writes a
+    // cell on every keystroke would otherwise be unusable, and the user already
+    // answered the question "may this view call this tool".
+    session.approved.add(name)
+  }
+
+  const result = await callMcpTool(qualified, args)
+  // A view expects the standard CallToolResult, not Roxy's flattened card
+  // projection. Preserve structuredContent, all content blocks and result-level
+  // `_meta`; only fall back to text if a malformed server produced no retained
+  // result at all.
+  const full = toMcpCallResult(lastMcpCallResult(qualified))
+  return {
+    result:
+      full ??
+      ({
+        content: [{ type: 'text', text: result.output }],
+        ...(result.ok ? {} : { isError: true })
+      } as Record<string, unknown>)
+  }
+}
+
+/** Test seam: the MIME an App resource must declare. */
+export const APP_MIME = UI_MIME
+
+/** Test-only: reset broker state between smoke cases. */
+export function _resetMcpAppsForTests(): void {
+  sessions.clear()
+  askApproval = async () => false
+}
diff --git a/src/main/services/mcp-auth.ts b/src/main/services/mcp-auth.ts
new file mode 100644
index 0000000..f76862b
--- /dev/null
+++ b/src/main/services/mcp-auth.ts
@@ -0,0 +1,211 @@
+/**
+ * OAuth for remote MCP servers.
+ *
+ * A remote MCP server is an HTTP API, and the interesting ones are the ones that
+ * hold something worth protecting - your issues, your calendar, your database.
+ * The spec's answer is OAuth 2.1 with dynamic client registration and PKCE, and
+ * the SDK implements the whole dance provided the host supplies two things:
+ * somewhere to persist credentials, and a way to put a browser in front of the
+ * user for the one interactive step.
+ *
+ * This module is that host side.
+ *
+ * ## Why a bespoke store
+ *
+ * Tokens are persisted through `secure.ts` (OS keychain via Electron
+ * `safeStorage`, base64 fallback) rather than dropped in the settings table as
+ * plain JSON, for the same reason every other credential in Roxy is: a refresh
+ * token is a long-lived bearer credential for a third-party account, and a
+ * config file is not a place to keep one.
+ *
+ * Everything is keyed by SERVER ID rather than by issuer, because that is the
+ * identity the rest of the MCP subsystem uses. A server pointed at a new URL is
+ * a new authorization anyway - the stored client registration no longer matches
+ * the issuer, and the SDK re-registers.
+ *
+ * ## Why the callback is a loopback server
+ *
+ * The redirect has to land somewhere. A custom protocol handler (`roxy://`) is
+ * the other option, but it needs OS-level registration that only exists in a
+ * packaged build - so it would work in production and silently fail in dev,
+ * which is the worst possible split for an auth flow. An ephemeral loopback
+ * listener works identically everywhere and is what the spec recommends for
+ * native apps (RFC 8252).
+ */
+import { createServer, type Server } from 'node:http'
+import { shell } from 'electron'
+import type { OAuthClientProvider } from '@modelcontextprotocol/client'
+import * as repo from '../db/repo'
+
+/**
+ * How long the loopback listener waits for the browser to come back before it
+ * gives up and frees the port.
+ *
+ * Generous: this window covers a human signing in, possibly creating an account
+ * and clearing an MFA prompt on a phone. Too short and the flow fails at the
+ * exact moment the user finally finished.
+ */
+const CALLBACK_TIMEOUT = 5 * 60_000
+
+/** Loopback host for the redirect. Literal IP, not `localhost`. */
+const CALLBACK_HOST = '127.0.0.1'
+
+/** What the browser tab shows once the redirect has been captured. */
+const DONE_PAGE = `<!doctype html><html><head><meta charset="utf-8"><title>Signed in</title>
+<style>body{font:15px system-ui;margin:0;height:100vh;display:grid;place-items:center;background:#18181b;color:#e4e4e7}
+div{text-align:center}p{color:#a1a1aa;font-size:13px}</style></head>
+<body><div><h2>Signed in</h2><p>You can close this tab and return to Roxy.</p></div></body></html>`
+
+/**
+ * One pending authorization: the loopback listener and the promise the connect
+ * path is waiting on.
+ */
+interface PendingAuth {
+  server: Server
+  redirectUrl: string
+  /** Resolves with the full callback query once the browser hits the listener. */
+  code: Promise<URLSearchParams>
+}
+
+const pending = new Map<string, PendingAuth>()
+
+/**
+ * Start (or reuse) a loopback listener for one server's redirect.
+ *
+ * Port 0 lets the OS pick a free port; the chosen one becomes part of the
+ * redirect URI, so nothing is hardcoded and two servers authorizing at once
+ * cannot collide.
+ */
+async function listenForCallback(serverId: string): Promise<PendingAuth> {
+  const existing = pending.get(serverId)
+  if (existing) return existing
+
+  let resolveCode: (params: URLSearchParams) => void
+  let rejectCode: (err: Error) => void
+  const code = new Promise<URLSearchParams>((res, rej) => {
+    resolveCode = res
+    rejectCode = rej
+  })
+
+  const server = createServer((req, res) => {
+    const url = new URL(req.url ?? '/', `http://${CALLBACK_HOST}`)
+    res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' })
+    res.end(DONE_PAGE)
+    resolveCode(url.searchParams)
+  })
+
+  await new Promise<void>((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(0, CALLBACK_HOST, resolve)
+  })
+
+  const address = server.address()
+  const port = typeof address === 'object' && address ? address.port : 0
+  const entry: PendingAuth = {
+    server,
+    redirectUrl: `http://${CALLBACK_HOST}:${port}/callback`,
+    code
+  }
+  pending.set(serverId, entry)
+
+  const timer = setTimeout(() => {
+    rejectCode(new Error('Timed out waiting for the browser to complete sign-in.'))
+    closeCallback(serverId)
+  }, CALLBACK_TIMEOUT)
+  // Never hold the process open on this listener alone.
+  timer.unref?.()
+  void code.finally(() => clearTimeout(timer))
+
+  return entry
+}
+
+/** Tear down a server's loopback listener, if any. */
+export function closeCallback(serverId: string): void {
+  const entry = pending.get(serverId)
+  if (!entry) return
+  pending.delete(serverId)
+  try {
+    entry.server.close()
+  } catch {
+    /* already closed */
+  }
+}
+
+/**
+ * The `OAuthClientProvider` the SDK drives.
+ *
+ * The SDK owns the protocol (discovery, PKCE, registration, refresh); this
+ * supplies persistence and the one step a library cannot do for itself - putting
+ * the authorization URL in front of a human.
+ */
+export function mcpAuthProvider(serverId: string, redirectUrl: string): OAuthClientProvider {
+  return {
+    get redirectUrl() {
+      return redirectUrl
+    },
+    get clientMetadata() {
+      return {
+        client_name: 'Roxy',
+        redirect_uris: [redirectUrl],
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        token_endpoint_auth_method: 'none'
+      }
+    },
+    clientInformation() {
+      return repo.getMcpOAuthClient(serverId) ?? undefined
+    },
+    saveClientInformation(info) {
+      repo.saveMcpOAuthClient(serverId, info)
+    },
+    tokens() {
+      return repo.getMcpOAuthTokens(serverId) ?? undefined
+    },
+    saveTokens(tokens) {
+      repo.saveMcpOAuthTokens(serverId, tokens)
+    },
+    redirectToAuthorization(authorizationUrl) {
+      // The only genuinely interactive step. Opened in the user's real browser,
+      // not an embedded window: they may already have a session there, and an
+      // embedded view asking for third-party credentials is a phishing pattern
+      // even when it is legitimate.
+      void shell.openExternal(authorizationUrl.toString())
+    },
+    saveCodeVerifier(verifier) {
+      repo.saveMcpOAuthVerifier(serverId, verifier)
+    },
+    codeVerifier() {
+      const v = repo.getMcpOAuthVerifier(serverId)
+      if (!v) throw new Error('No PKCE code verifier is stored for this server.')
+      return v
+    }
+  }
+}
+
+/**
+ * Run one interactive authorization for a server.
+ *
+ * Returns the callback query so the caller can hand it to `finishAuth`, which
+ * validates `iss` (RFC 9207) and exchanges the code.
+ */
+export async function awaitAuthorization(serverId: string): Promise<URLSearchParams> {
+  const entry = pending.get(serverId)
+  if (!entry) throw new Error('No authorization is in progress for this server.')
+  try {
+    return await entry.code
+  } finally {
+    closeCallback(serverId)
+  }
+}
+
+/** Prepare a listener and return the redirect URI to register with the server. */
+export async function prepareAuthorization(serverId: string): Promise<string> {
+  const entry = await listenForCallback(serverId)
+  return entry.redirectUrl
+}
+
+/** Forget every stored credential for a server (used when it is removed). */
+export function clearMcpAuth(serverId: string): void {
+  closeCallback(serverId)
+  repo.clearMcpOAuth(serverId)
+}
diff --git a/src/main/services/mcp-trust.ts b/src/main/services/mcp-trust.ts
new file mode 100644
index 0000000..b924860
--- /dev/null
+++ b/src/main/services/mcp-trust.ts
@@ -0,0 +1,314 @@
+/**
+ * MCP trust service — decides whether a server starts, and makes sure the user
+ * finds out what it exposed.
+ *
+ * The rules live in `src/shared/mcp-trust.ts` (pure, unit-tested); this file
+ * owns the side effects: reading the store, sending the disclosure, asking the
+ * rare blocking question, remembering answers.
+ *
+ * The normal path does NOT prompt. `gateRecords` lets servers through and the
+ * caller reports what connected via `discloseConnected`, which is where the tool
+ * list comes from — tools are only knowable AFTER the handshake, which is
+ * exactly why disclosure-after beats permission-before here: the receipt can
+ * name the tools, a pre-flight dialog can only name the command.
+ *
+ * A prompt is raised in two cases only: a trusted entry whose command changed,
+ * and users who opted into confirming first.
+ */
+import { BrowserWindow, dialog } from 'electron'
+import { randomUUID } from 'node:crypto'
+import { CHANNELS } from '../../shared/ipc'
+import * as repo from '../db/repo'
+import {
+  decideTrust,
+  describeConfig,
+  fingerprintConfig,
+  summarizeConfig,
+  type McpConsentRequest,
+  type McpConsentResponse,
+  type McpInstallNotice,
+  type McpProvenance,
+  type McpTrustPolicy
+} from '../../shared/mcp-trust'
+import type { McpServerRecord } from '../../shared/mcp'
+
+/**
+ * How long an unanswered prompt stays open before it is treated as a denial.
+ * Only reachable on the two blocking paths, so it can afford to be patient
+ * without ever wedging an ordinary turn.
+ */
+const CONSENT_TIMEOUT_MS = 120_000
+
+/**
+ * Escape hatch for automation: `ROXY_MCP_CONFIRM=1` forces the opt-in
+ * confirm-first posture. Deliberately an env var and not a config-file key, so
+ * a repo you cloned cannot change your posture in either direction.
+ */
+function envConfirm(): boolean {
+  return process.env.ROXY_MCP_CONFIRM === '1'
+}
+
+/** A record paired with where it came from, which is what drives disclosure. */
+export interface McpCandidate {
+  record: McpServerRecord
+  provenance: McpProvenance
+  /** Workspace the record is scoped to (workspace-file records); null otherwise. */
+  workspace: string | null
+}
+
+/** Current policy: the persisted toggle, OR-ed with the env override. */
+export function trustPolicy(): McpTrustPolicy {
+  return { confirmBeforeRun: envConfirm() || repo.getMcpConfirmBeforeRun() }
+}
+
+export function setConfirmBeforeRun(enabled: boolean): void {
+  repo.setMcpConfirmBeforeRun(enabled)
+}
+
+// ---------------------------------------------------------------------------
+// Prompting (the exceptional path)
+// ---------------------------------------------------------------------------
+
+interface PendingPrompt {
+  resolve: (r: McpConsentResponse) => void
+  timer: NodeJS.Timeout
+}
+
+const pending = new Map<string, PendingPrompt>()
+/** Dedupe key → in-flight prompt, so concurrent turns share one dialog. */
+const inFlight = new Map<string, Promise<McpConsentResponse>>()
+
+/** Called by the IPC handler when the renderer answers. */
+export function resolveConsent(response: McpConsentResponse): void {
+  const entry = pending.get(response.requestId)
+  if (!entry) return // already timed out, or a stale/duplicate answer
+  clearTimeout(entry.timer)
+  pending.delete(response.requestId)
+  entry.resolve(response)
+}
+
+/** Drop every pending prompt (window closing / app quit): unanswered = denied. */
+export function cancelAllConsent(): void {
+  for (const [requestId, entry] of pending) {
+    clearTimeout(entry.timer)
+    entry.resolve({ requestId, decision: 'deny', scope: 'once' })
+  }
+  pending.clear()
+}
+
+/** The window that should host UI, or null when running headless. */
+function hostWindow(): BrowserWindow | null {
+  const focused = BrowserWindow.getFocusedWindow()
+  if (focused && !focused.isDestroyed()) return focused
+  return BrowserWindow.getAllWindows().find((w) => !w.isDestroyed()) ?? null
+}
+
+/**
+ * Native fallback for when there is no renderer to ask. Only reached on the two
+ * blocking paths, and both of them mean "something is off", so the fallback
+ * denies rather than guessing on the user's behalf.
+ */
+async function askNatively(request: McpConsentRequest): Promise<McpConsentResponse> {
+  const win = hostWindow()
+  if (!win) return { requestId: request.requestId, decision: 'deny', scope: 'once' }
+  const { response } = await dialog.showMessageBox(win, {
+    type: 'warning',
+    buttons: ['Cancel', 'Run it'],
+    defaultId: 0,
+    cancelId: 0,
+    title: 'MCP server changed',
+    message: `"${request.id}" is not what it was.`,
+    detail: `Now runs: ${summarizeConfig(request.config)}${
+      request.previousSummary ? `\nPreviously: ${request.previousSummary}` : ''
+    }\n\nOnly continue if you made this change.`
+  })
+  return {
+    requestId: request.requestId,
+    decision: response === 1 ? 'allow' : 'deny',
+    scope: response === 1 ? 'server' : 'once'
+  }
+}
+
+/** Ask the user about one server, deduping concurrent asks for the same thing. */
+function prompt(request: McpConsentRequest, key: string): Promise<McpConsentResponse> {
+  const existing = inFlight.get(key)
+  if (existing) return existing
+
+  const win = hostWindow()
+  const p: Promise<McpConsentResponse> = (async () => {
+    if (!win) return askNatively(request)
+    return new Promise<McpConsentResponse>((resolve) => {
+      const timer = setTimeout(() => {
+        pending.delete(request.requestId)
+        // Unanswered is DENIED. This path only triggers when a command changed
+        // under a trusted name; letting that expire into a yes would be the
+        // wrong way to resolve the one question worth asking.
+        resolve({ requestId: request.requestId, decision: 'deny', scope: 'once' })
+      }, CONSENT_TIMEOUT_MS)
+      pending.set(request.requestId, { resolve, timer })
+      win.webContents.send(CHANNELS.mcpConsentRequest, request)
+    })
+  })()
+
+  inFlight.set(key, p)
+  return p.finally(() => inFlight.delete(key))
+}
+
+// ---------------------------------------------------------------------------
+// Disclosure (the normal path)
+// ---------------------------------------------------------------------------
+
+/** Candidates allowed to run, paired with whether the user should be told. */
+export interface GateResult {
+  records: McpServerRecord[]
+  /** Servers to disclose once connected, keyed by id. */
+  disclose: Map<string, McpCandidate>
+}
+
+/**
+ * Tell the user what a server turned out to be, now that it has connected and
+ * its tools are known. Also records the allow, so this is a one-time notice
+ * rather than a recurring one.
+ */
+export function discloseConnected(candidate: McpCandidate, tools: string[], error?: string): void {
+  const { record, provenance, workspace } = candidate
+  try {
+    // Remember it even when it failed: a server that is broken today should not
+    // re-announce itself on every single turn until it is fixed.
+    repo.recordMcpTrust({
+      id: record.id,
+      fingerprint: fingerprintConfig(record.config),
+      provenance,
+      scope: workspace,
+      decision: 'allow',
+      decidedAt: Date.now()
+    })
+    const win = hostWindow()
+    if (!win) return
+    const notice: McpInstallNotice = {
+      id: record.id,
+      provenance,
+      workspace,
+      disclosure: describeConfig(record.config),
+      tools,
+      error
+    }
+    win.webContents.send(CHANNELS.mcpInstallNotice, notice)
+  } catch {
+    /* disclosure is best-effort; never break a turn over a notification */
+  }
+}
+
+// ---------------------------------------------------------------------------
+// The gate
+// ---------------------------------------------------------------------------
+
+/** Stable dedupe key for one candidate. */
+function candidateKey(id: string, fingerprint: string, workspace: string | null): string {
+  return `${id}\u0000${fingerprint}\u0000${workspace ?? ''}`
+}
+
+/**
+ * Decide whether ONE server may start.
+ *
+ * Returns `disclose: true` when it may run but the user should be told about it
+ * afterwards (call `discloseConnected` once the tools are known). Never throws.
+ */
+export async function ensureTrusted(
+  candidate: McpCandidate
+): Promise<{ allowed: boolean; disclose: boolean }> {
+  const { record, provenance, workspace } = candidate
+  try {
+    const decision = decideTrust({
+      id: record.id,
+      config: record.config,
+      provenance,
+      workspace,
+      store: repo.getMcpTrustStore(),
+      policy: trustPolicy()
+    })
+    if (!decision.needsPrompt) {
+      return { allowed: decision.allowed, disclose: decision.needsDisclosure }
+    }
+
+    const fingerprint = fingerprintConfig(record.config)
+    const request: McpConsentRequest = {
+      requestId: randomUUID(),
+      id: record.id,
+      config: record.config,
+      provenance,
+      workspace,
+      disclosure: describeConfig(record.config),
+      reason: decision.reason === 'changed' ? 'changed' : 'confirm-first-run',
+      previousSummary: decision.previousFingerprint
+        ? previousSummaryFor(decision.previousFingerprint)
+        : undefined
+    }
+
+    const answer = await prompt(request, candidateKey(record.id, fingerprint, workspace))
+
+    if (answer.scope === 'workspace' && answer.decision === 'allow' && workspace) {
+      repo.trustMcpWorkspace(workspace)
+      return { allowed: true, disclose: false }
+    }
+    if (answer.scope === 'server' || answer.decision === 'deny') {
+      repo.recordMcpTrust({
+        id: record.id,
+        fingerprint,
+        provenance,
+        scope: workspace,
+        decision: answer.decision,
+        decidedAt: Date.now()
+      })
+    }
+    return { allowed: answer.decision === 'allow', disclose: false }
+  } catch {
+    // A failure in the trust path must not silently swallow a server the user
+    // expects to work; the default posture is to run it and disclose.
+    return { allowed: true, disclose: true }
+  }
+}
+
+/**
+ * A human-readable rendering of the config previously approved under this id,
+ * for the "this changed" prompt.
+ *
+ * Derived from the fingerprint rather than looked up, because the store keeps
+ * IDENTITY and not a copy of the old config. The fingerprint's argv answers the
+ * only question being asked: "is this the command you had before?"
+ */
+function previousSummaryFor(previousFingerprint: string): string {
+  const [kind, detail] = previousFingerprint.split('\u0001')
+  if (kind === 'local' && detail) return detail.split('\u0000').join(' ')
+  if (kind === 'remote' && detail) return detail
+  return previousFingerprint
+}
+
+/**
+ * Filter a turn's records down to the ones allowed to run, and report which of
+ * them the user should be told about once they connect.
+ *
+ * Sequential because the rare prompt path must not stack dialogs; the common
+ * path does no I/O beyond a single store read per candidate.
+ */
+export async function gateRecords(candidates: McpCandidate[]): Promise<GateResult> {
+  const records: McpServerRecord[] = []
+  const disclose = new Map<string, McpCandidate>()
+  for (const candidate of candidates) {
+    const { allowed, disclose: tell } = await ensureTrusted(candidate)
+    if (!allowed) continue
+    records.push(candidate.record)
+    if (tell) disclose.set(candidate.record.id, candidate)
+  }
+  return { records, disclose }
+}
+
+// ---------------------------------------------------------------------------
+// Test-only helpers
+// ---------------------------------------------------------------------------
+
+/** Clear in-memory prompt state between smoke cases (does not touch the DB). */
+export function _resetTrustForTests(): void {
+  cancelAllConsent()
+  inFlight.clear()
+}
diff --git a/src/main/services/mcp.ts b/src/main/services/mcp.ts
index 882895c..3625056 100644
--- a/src/main/services/mcp.ts
+++ b/src/main/services/mcp.ts
@@ -1,28 +1,48 @@
 /**
- * MCP (Model Context Protocol) client service — connects external tool servers
- * and exposes their tools to the agent loop. Built on the official
- * `@modelcontextprotocol/sdk`, which handles the transports (stdio + Streamable
- * HTTP, with an SSE fallback) and protocol negotiation for us.
+ * MCP (Model Context Protocol) client service - connects external tool servers
+ * and exposes their tools to the agent loop. Built on the official v2 SDK
+ * (`@modelcontextprotocol/client`), which owns the transports and the protocol
+ * handshake for us.
+ *
+ * ## Two protocol eras, one client
+ *
+ * MCP split into two behavior families. The `legacy` era (`2024-10-07` through
+ * `2025-11-25`) opens with an `initialize` handshake; the `modern` era
+ * (`2026-07-28`+) has no handshake at all - it advertises via `server/discover`
+ * and carries a `_meta` envelope on every request.
+ *
+ * Roxy connects with `versionNegotiation: { mode: 'auto' }`, so each server is
+ * probed once and lands on whichever era it actually speaks. That is what makes
+ * this a *client* rather than a client for one vintage of the spec: a 2026
+ * server gets the modern wire, and a server pinned to 2025 keeps working
+ * untouched. `conn.era` records where each one landed, for the UI and for
+ * anything that has to reason about era-specific capabilities later.
+ *
+ * The probe costs one round trip per connect. Roxy pools connections warmly, so
+ * that is once per server per session - not per tool call. On stdio the SDK runs
+ * the probe on a disposable sibling process (some servers exit on any
+ * pre-`initialize` request), and a silent server is simply read as legacy.
+ *
+ * ## Design (mirrors the LSP service's warm-pool + graceful-degradation shape)
  *
- * Design (mirrors the LSP service's warm-pool + graceful-degradation shape):
  *  - A process-wide pool keyed by server id. Connections are lazy (established on
  *    first `ensureMcpConnected`) and warm (reused across turns).
  *  - Nothing here ever throws into the agent loop: a server that fails to spawn,
- *    times out, or returns garbage degrades to "no tools" / an error ToolResult —
+ *    times out, or returns garbage degrades to "no tools" / an error ToolResult -
  *    it never breaks a turn. A `ROXY_MCP=0` env var disables the whole subsystem.
  *  - The pure protocol-independent logic (naming, schema conversion, result
  *    rendering, prompt blurb) lives in `src/shared/mcp.ts` and is unit-tested in
  *    smoke:shared; this file is exercised end-to-end against a mock server in
  *    smoke:app.
  */
-import { Client } from '@modelcontextprotocol/sdk/client/index.js'
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio'
 import {
-  StdioClientTransport,
-  getDefaultEnvironment
-} from '@modelcontextprotocol/sdk/client/stdio.js'
-import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
-import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js'
-import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js'
+  Client,
+  StreamableHTTPClientTransport,
+  SSEClientTransport,
+  type Transport
+} from '@modelcontextprotocol/client'
+import type { OAuthClientProvider } from '@modelcontextprotocol/client'
 import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import type { ToolResult } from '../../shared/types'
@@ -34,19 +54,113 @@ import {
   mcpToolToSchema,
   normalizeServerRecords,
   qualifyToolName,
-  renderMcpContent,
   type McpLocalConfig,
+  type McpProtocolEra,
   type McpRemoteConfig,
   type McpServerRecord,
   type McpServerSummary,
+  type McpToolDefinition,
   type RoxyToolSchema
 } from '../../shared/mcp'
+import * as repo from '../db/repo'
+import { mcpAuthProvider, prepareAuthorization, awaitAuthorization, clearMcpAuth } from './mcp-auth'
+import {
+  parseCallResult,
+  parseResourceContents,
+  toToolResult,
+  type McpCallResult,
+  type McpResourceContents,
+  type McpResourceInfo
+} from '../../shared/mcp-content'
+import { isAppOnlyTool } from '../../shared/mcp-apps'
 
-const CLIENT_INFO = { name: 'roxy', version: '0.0.13' }
+/**
+ * Identity Roxy presents to servers.
+ *
+ * Read from Electron rather than hardcoded: this used to be a hand-maintained
+ * `0.0.13` that had drifted ~80 releases behind the app, which makes any
+ * server-side telemetry or version-gating keyed on it actively misleading.
+ *
+ * Resolved lazily and defensively because this module is also imported by the
+ * plain-Node smoke run, where `electron.app` is not available. A version string
+ * is not worth an import-time crash.
+ */
+function clientInfo(): { name: string; version: string } {
+  let version = '0.0.0'
+  try {
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    version = (require('electron') as typeof import('electron')).app.getVersion()
+  } catch {
+    /* not running under Electron (smoke); the name is what identifies us */
+  }
+  return { name: 'roxy', version }
+}
 /** ms to establish + initialize a server before giving up (per-server override wins). */
 const DEFAULT_STARTUP_TIMEOUT = 15_000
 /** ms budget for a single `tools/call` (tool work can be genuinely slow). */
 const DEFAULT_REQUEST_TIMEOUT = 120_000
+/**
+ * Budget for the `server/discover` probe that decides a connection's era.
+ *
+ * Deliberately short and separate from the startup timeout. On stdio a silent
+ * server IS the legacy answer, so this is the delay every 2025-era server pays
+ * before falling back to `initialize` - it must stay small enough that adding
+ * era negotiation never feels like a regression on servers that already worked.
+ */
+const PROBE_TIMEOUT = 3_000
+
+/**
+ * Client options shared by every connection.
+ *
+ * `mode: 'auto'` is the whole point of the v2 migration: probe with
+ * `server/discover`, fall back to the 2025 `initialize` handshake when the
+ * server doesn't answer it. One client, both eras, no per-server configuration.
+ *
+ * The SDK's warning about `'auto'` (it can stall a spawn-per-invocation CLI for
+ * the probe timeout) does not bite here: Roxy holds a warm pool, so the probe is
+ * paid once per server per session, and `PROBE_TIMEOUT` bounds it either way.
+ */
+function clientOptions(serverId: string): ConstructorParameters<typeof Client>[1] {
+  return {
+    capabilities: {},
+    versionNegotiation: { mode: 'auto', probe: { timeoutMs: PROBE_TIMEOUT } },
+    // Cache results from servers that send no freshness hint of their own.
+    // Servers that DO send one always win: the SDK honours `ttlMs`/`cacheScope`
+    // per result, and this is only the floor for those that say nothing.
+    defaultCacheTtlMs: DEFAULT_CACHE_TTL,
+    // Let the SDK own the `subscriptions/listen` stream where the server
+    // supports it. Hand-rolling this would mean re-implementing the filter
+    // negotiation, the era split (2026 `listen` vs 2025 unsolicited
+    // notifications), and the close/re-listen policy - all of which the SDK
+    // already does, and all of which it also wires to cache eviction.
+    //
+    // A `list_changed` here means the warm pool is holding a stale tool list, so
+    // the refresh has to write back into `toolIndex`, not just log.
+    listChanged: {
+      tools: {
+        onChanged: (error, tools) => {
+          if (error || !tools) return
+          onToolsChanged(serverId, tools as McpToolDefinition[])
+        }
+      }
+    }
+  }
+}
+
+/**
+ * TTL applied to cacheable results from servers that send no hint of their own.
+ *
+ * Caching is two halves: a 2026-era server marks a result with `ttlMs` and the
+ * SDK's per-client cache honours it. A server that sends nothing gets `ttlMs: 0`
+ * and is never cached - which is every 2025-era server, i.e. most of them today.
+ *
+ * A short opt-in default covers the case this actually matters for: `listTools`
+ * is re-read on every turn to rebuild the model's tool list, and re-listing an
+ * unchanged server each time is pure latency. Deliberately seconds, not minutes,
+ * because a legacy server has no way to tell us it changed - and `listChanged`
+ * eviction (below) only exists where the server supports it.
+ */
+const DEFAULT_CACHE_TTL = 10_000
 
 /** Kill switch: set ROXY_MCP=0 to disable all MCP connections. */
 function mcpDisabled(): boolean {
@@ -64,6 +178,17 @@ interface McpToolInfo {
   toolName: string
   serverId: string
   schema: RoxyToolSchema
+  /**
+   * The server's own tool definition, verbatim - including `_meta`,
+   * `outputSchema`, `title`, `icons` and annotations.
+   *
+   * Kept because the model-facing `schema` above is a lossy projection, and
+   * everything the modern spec adds lives in the parts it drops. MCP Apps finds
+   * its UI resource at `_meta['io.modelcontextprotocol/ui'].resourceUri`, and
+   * app-only tools are marked in that same `_meta`. Re-listing a server to
+   * recover fields we already received would be the wrong trade.
+   */
+  definition: McpToolDefinition
 }
 
 interface McpConnection {
@@ -72,9 +197,40 @@ interface McpConnection {
   status: 'connected' | 'error'
   error?: string
   tools: McpToolInfo[]
+  /**
+   * Which protocol era this connection actually landed on: `'modern'` for
+   * 2026-07-28+ (negotiated via `server/discover`), `'legacy'` for the 2025
+   * `initialize` handshake. Recorded rather than assumed, because era decides
+   * which capabilities are even expressible on this connection.
+   */
+  era?: McpProtocolEra
+  /**
+   * This server's own request budget, resolved once at connect.
+   *
+   * Held on the connection because calls arrive by TOOL name, not by record:
+   * `callMcpTool` has no config in hand, and without this every call fell back
+   * to the global default - so a server configured with `timeout: 5000` still
+   * hung a turn for two minutes.
+   */
+  requestTimeout: number
+  /** Whether the server advertised `resources`, so we don't ask servers that can't. */
+  hasResources: boolean
 }
 
 /** Warm pool: server id → connection (connected or errored/cached). */
+/**
+ * The full, unflattened result of the most recent call to each MCP tool.
+ *
+ * Pool state, declared here with the rest of it: `forgetServer` clears entries
+ * on disconnect, so the two must stay visibly coupled.
+ *
+ * Bounded two ways: the parse caps every field (see `MCP_LIMITS`), and only the
+ * latest result per tool is held - an agent turn can call one tool hundreds of
+ * times, and keeping a history in a warm, long-lived pool would be a slow leak.
+ * This is a handoff buffer for the consumer that needs structure right after a
+ * call, not a transcript.
+ */
+const lastResults = new Map<string, McpCallResult>()
 const connections = new Map<string, McpConnection>()
 /** In-flight connects, so concurrent `ensureMcpConnected` calls don't double-spawn. */
 const connecting = new Map<string, Promise<McpConnection>>()
@@ -102,15 +258,30 @@ function makeStdioTransport(cfg: McpLocalConfig, workspaceCwd: string): Transpor
   })
 }
 
-/** Ordered transport attempts for a record (remote tries Streamable HTTP, then SSE). */
-function transportFactories(rec: McpServerRecord, workspaceCwd: string): Array<() => Transport> {
+/**
+ * Ordered transport attempts for a record (remote tries Streamable HTTP, then SSE).
+ *
+ * Remote transports carry an `authProvider` when the server has stored OAuth
+ * credentials, or when the user has explicitly started a sign-in. It is NOT
+ * attached unconditionally: passing one makes the SDK treat a 401 as "begin an
+ * authorization flow", which would pop a browser window at any server that
+ * happens to be down or misconfigured. Auth is something the user opts into.
+ */
+function transportFactories(
+  rec: McpServerRecord,
+  workspaceCwd: string,
+  auth?: OAuthClientProvider
+): Array<() => Transport> {
   if (rec.config.type === 'local') {
     const cfg = rec.config
     return [() => makeStdioTransport(cfg, workspaceCwd)]
   }
   const cfg = rec.config as McpRemoteConfig
   const url = new URL(cfg.url)
-  const init = cfg.headers ? { requestInit: { headers: cfg.headers } } : undefined
+  const init = {
+    ...(cfg.headers ? { requestInit: { headers: cfg.headers } } : {}),
+    ...(auth ? { authProvider: auth } : {})
+  }
   return [
     () => new StreamableHTTPClientTransport(url, init),
     () => new SSEClientTransport(url, init)
@@ -129,11 +300,15 @@ function requestTimeout(rec: McpServerRecord): number {
 // ---------------------------------------------------------------------------
 
 /** Connect a single server and discover its tools. Never throws → errored connection. */
-async function connectOne(rec: McpServerRecord, workspaceCwd: string): Promise<McpConnection> {
-  const attempts = transportFactories(rec, workspaceCwd)
+async function connectOne(
+  rec: McpServerRecord,
+  workspaceCwd: string,
+  auth?: OAuthClientProvider
+): Promise<McpConnection> {
+  const attempts = transportFactories(rec, workspaceCwd, auth)
   let lastErr: unknown
   for (const make of attempts) {
-    const client = new Client(CLIENT_INFO, { capabilities: {} })
+    const client = new Client(clientInfo(), clientOptions(rec.id))
     try {
       const transport = make()
       await client.connect(transport, { timeout: startupTimeout(rec) })
@@ -141,7 +316,15 @@ async function connectOne(rec: McpServerRecord, workspaceCwd: string): Promise<M
       // No global side effects here: `getConnection` commits (indexes tools + wires
       // onclose) only if this connection isn't disposed/superseded while in flight,
       // so a mid-connect dispose can't leave orphaned toolIndex entries.
-      return { id: rec.id, client, status: 'connected', tools }
+      return {
+        id: rec.id,
+        client,
+        status: 'connected',
+        tools,
+        era: client.getProtocolEra(),
+        requestTimeout: requestTimeout(rec),
+        hasResources: !!client.getServerCapabilities()?.resources
+      }
     } catch (e) {
       lastErr = e
       try {
@@ -151,31 +334,70 @@ async function connectOne(rec: McpServerRecord, workspaceCwd: string): Promise<M
       }
     }
   }
-  return { id: rec.id, client: null, status: 'error', error: errMsg(lastErr), tools: [] }
+  return {
+    id: rec.id,
+    client: null,
+    status: 'error',
+    error: errMsg(lastErr),
+    tools: [],
+    requestTimeout: requestTimeout(rec),
+    hasResources: false
+  }
 }
 
-/** List a server's tools (following `nextCursor` pagination), namespaced + deduped. */
+/**
+ * List a server's tools, namespaced + deduped.
+ *
+ * No manual cursor loop: the v2 SDK walks `nextCursor` itself and returns one
+ * aggregated list (bounded by `listMaxPages`, default 64). Passing a cursor is
+ * what asks for a single raw page - so the old hand-rolled `do/while` would now
+ * fetch page one, then re-request page two *without* aggregation. Deleting it is
+ * a behavior fix, not just tidying.
+ *
+ * The full tool definition is kept on each `McpToolInfo`. Roxy only feeds
+ * name/description/inputSchema to the model today, but `_meta`, `outputSchema`,
+ * `title`, `icons` and annotations are exactly what the rest of the modern spec
+ * is built on - MCP Apps keys its UI resource off `_meta['io.modelcontextprotocol/ui']`,
+ * and tool visibility hides app-only tools from the model. Discarding them at
+ * discovery, as the v1 code did, is what made those features unimplementable
+ * without re-listing every server.
+ */
 async function discoverTools(client: Client, rec: McpServerRecord): Promise<McpToolInfo[]> {
+  const res = await client.listTools(undefined, { timeout: requestTimeout(rec) })
+  return buildToolInfos(rec.id, (res.tools ?? []) as McpToolDefinition[])
+}
+
+/**
+ * A server told us its tool list changed and the SDK re-fetched it.
+ *
+ * The pool is warm and the model's tool list is rebuilt from `toolIndex` each
+ * turn, so a stale entry means the agent is offered a tool the server no longer
+ * has - it would fail at call time with a confusing error. Rebuilding here is
+ * what makes `listChanged` worth subscribing to at all.
+ */
+function onToolsChanged(serverId: string, tools: McpToolDefinition[]): void {
+  const conn = connections.get(serverId)
+  if (!conn || conn.status !== 'connected') return
+  conn.tools = buildToolInfos(serverId, tools)
+  indexTools(conn)
+}
+
+/** Namespace + dedupe a server's raw tool definitions into routable entries. */
+function buildToolInfos(serverId: string, tools: McpToolDefinition[]): McpToolInfo[] {
   const infos: McpToolInfo[] = []
   const seen = new Set<string>()
-  let cursor: string | undefined
-  do {
-    const res = await client.listTools(cursor ? { cursor } : undefined, {
-      timeout: requestTimeout(rec)
+  for (const t of tools) {
+    if (!t || typeof t.name !== 'string' || !t.name) continue
+    const qualified = uniqueName(qualifyToolName(serverId, t.name), seen)
+    seen.add(qualified)
+    infos.push({
+      qualifiedName: qualified,
+      toolName: t.name,
+      serverId,
+      schema: mcpToolToSchema(qualified, t.description, t.inputSchema),
+      definition: t
     })
-    for (const t of res.tools ?? []) {
-      if (!t || typeof t.name !== 'string' || !t.name) continue
-      const qualified = uniqueName(qualifyToolName(rec.id, t.name), seen)
-      seen.add(qualified)
-      infos.push({
-        qualifiedName: qualified,
-        toolName: t.name,
-        serverId: rec.id,
-        schema: mcpToolToSchema(qualified, t.description, t.inputSchema)
-      })
-    }
-    cursor = res.nextCursor
-  } while (cursor)
+  }
   return infos
 }
 
@@ -189,9 +411,26 @@ function uniqueName(name: string, seen: Set<string>): string {
   }
 }
 
+/**
+ * Drop everything keyed to one server: its tool index entries and any cached
+ * call results.
+ *
+ * Both must go together. A cached result is keyed by qualified tool name, so
+ * leaving one behind after a disconnect would let a later consumer read stale
+ * structure for a tool that no longer exists - and, in a warm pool, hold its
+ * payload for the rest of the session.
+ */
+function forgetServer(id: string): void {
+  for (const [key, info] of toolIndex) {
+    if (info.serverId !== id) continue
+    toolIndex.delete(key)
+    lastResults.delete(key)
+  }
+}
+
 function indexTools(conn: McpConnection): void {
   // Drop any stale tools this server previously registered, then re-index.
-  for (const [key, info] of toolIndex) if (info.serverId === conn.id) toolIndex.delete(key)
+  forgetServer(conn.id)
   for (const t of conn.tools) toolIndex.set(t.qualifiedName, t)
 }
 
@@ -199,7 +438,7 @@ function indexTools(conn: McpConnection): void {
 function onTransportClosed(id: string, client: Client): void {
   const conn = connections.get(id)
   if (!conn || conn.client !== client) return // superseded by a newer connection
-  for (const [key, info] of toolIndex) if (info.serverId === id) toolIndex.delete(key)
+  forgetServer(id)
   conn.status = 'error'
   conn.error = conn.error ?? 'The MCP server disconnected.'
   conn.client = null
@@ -212,7 +451,15 @@ function getConnection(rec: McpServerRecord, workspaceCwd: string): Promise<McpC
   if (cached) return Promise.resolve(cached) // connected or cached-errored (no per-turn retry storm)
   const inflight = connecting.get(rec.id)
   if (inflight) return inflight
-  const p: Promise<McpConnection> = connectOne(rec, workspaceCwd).then((conn) => {
+  // Attach OAuth only when this server already has credentials. Passing an
+  // auth provider makes the SDK treat a 401 as "start an authorization flow",
+  // which would pop a browser at any server that is merely down. Signing in is
+  // something the user does deliberately (`signInMcpServer`).
+  const auth =
+    rec.config.type === 'remote' && repo.hasMcpOAuth(rec.id)
+      ? mcpAuthProvider(rec.id, REDIRECT_PLACEHOLDER)
+      : undefined
+  const p: Promise<McpConnection> = connectOne(rec, workspaceCwd, auth).then((conn) => {
     // If we were disposed or superseded by a newer connect while this one was in
     // flight, don't resurrect the pool entry — just release this child process.
     // Whoever superseded us already owns `connections`/`toolIndex`; leave them be.
@@ -271,15 +518,39 @@ export function mcpToolSchemas(ids?: Set<string>): RoxyToolSchema[] {
   for (const conn of connections.values()) {
     if (conn.status !== 'connected') continue
     if (ids && !ids.has(conn.id)) continue
-    for (const t of conn.tools) out.push(t.schema)
+    for (const t of conn.tools) {
+      // App-only tools are omitted from the MODEL's list.
+      //
+      // `visibility: ['app']` is how a server exposes fine-grained operations to
+      // its own view (`set_cell`, `select_row`) without filling the model's tool
+      // list with dozens of them. SEP-1865 makes this a MUST NOT for hosts, and
+      // it is a correctness issue as much as a spec one: offering the model a
+      // tool the server said was not for it invites calls the server never
+      // meant to serve.
+      //
+      // They stay in `toolIndex`, so the view can still call them through the
+      // broker - hidden from the model is not the same as unavailable.
+      if (isAppOnlyTool(t.definition._meta)) continue
+      out.push(t.schema)
+    }
   }
   return out
 }
 
-/** Route + run an MCP tool call, rendering the result. Never throws. */
+/**
+ * Route + run an MCP tool call, rendering the result. Never throws.
+ *
+ * `signal` is the turn's abort signal. Passing it through matters because MCP
+ * tool calls are the slowest thing an agent does and the most likely to be
+ * running when a user hits stop: without it the SDK keeps waiting on the wire,
+ * the server keeps working, and the child process stays busy long after the turn
+ * that wanted the answer has gone. The SDK also emits `notifications/cancelled`,
+ * so a well-behaved server can stop its own work rather than finish into a void.
+ */
 export async function callMcpTool(
   name: string,
-  args: Record<string, unknown>
+  args: Record<string, unknown>,
+  signal?: AbortSignal
 ): Promise<ToolResult> {
   const info = toolIndex.get(name)
   if (!info) return { ok: false, output: `Unknown MCP tool: ${name}` }
@@ -288,17 +559,114 @@ export async function callMcpTool(
     return { ok: false, output: `MCP server "${info.serverId}" is not connected.` }
   }
   try {
+    // v2 dropped the result-schema argument: `callTool(params, options)`.
     const res = await conn.client.callTool(
       { name: info.toolName, arguments: args ?? {} },
-      undefined,
-      { timeout: DEFAULT_REQUEST_TIMEOUT }
+      // The server's own budget, not the global default (see `requestTimeout`).
+      { timeout: conn.requestTimeout, signal }
     )
-    return renderMcpContent(res.content, res.isError === true)
+    // Parse ONCE into the lossless model, cache it, and hand the caller the flat
+    // projection. Everything the flat form cannot express - resource URIs, extra
+    // images, result `_meta`, unrecognised block types - stays reachable via
+    // `lastMcpCallResult` instead of being destroyed on arrival.
+    const parsed = parseCallResult(res)
+    lastResults.set(name, parsed)
+    return toToolResult(parsed)
   } catch (e) {
+    // A cancelled call is not a failure to report to the model as a tool error -
+    // the turn it belonged to is already gone. Name it plainly so a retry
+    // doesn't read it as "the server is broken".
+    if (signal?.aborted) return { ok: false, output: `MCP tool "${name}" was cancelled.` }
     return { ok: false, output: `MCP tool "${name}" failed: ${errMsg(e)}` }
   }
 }
 
+// ---------------------------------------------------------------------------
+// Resources
+// ---------------------------------------------------------------------------
+
+/**
+ * List a server's resources, or `[]` when it exposes none.
+ *
+ * Resources are the half of MCP that isn't tools: files, configs, database rows
+ * a server is willing to hand over as context. Roxy needs them for MCP Apps in
+ * particular, where the UI itself arrives as a `ui://` resource read over this
+ * same path.
+ *
+ * Reads are cached by the SDK per the server's own `ttlMs`, so calling this on a
+ * warm connection is cheap.
+ */
+export async function listMcpResources(serverId: string): Promise<McpResourceInfo[]> {
+  const conn = connections.get(serverId)
+  if (!conn || conn.status !== 'connected' || !conn.client || !conn.hasResources) return []
+  try {
+    const res = await conn.client.listResources(undefined, { timeout: conn.requestTimeout })
+    return (res.resources ?? []).map((r) => {
+      const raw = r as typeof r & { meta?: Record<string, unknown> }
+      return {
+        uri: r.uri,
+        name: r.name,
+        title: r.title,
+        description: r.description,
+        mimeType: r.mimeType,
+        // Listing-level metadata is the spec fallback when resources/read omits
+        // it. `_meta` is canonical; `meta` is emitted by some Python SDKs and is
+        // accepted by the official reference host too.
+        _meta: r._meta ?? raw.meta
+      }
+    })
+  } catch {
+    return []
+  }
+}
+
+/**
+ * Read one resource by URI. Returns its contents, or an error string.
+ *
+ * Never throws, mirroring `callMcpTool`: a resource read happens inside an agent
+ * turn, and a server that 404s a URI must not take the turn with it.
+ */
+export async function readMcpResource(
+  serverId: string,
+  uri: string,
+  signal?: AbortSignal
+): Promise<McpResourceContents | { error: string }> {
+  const conn = connections.get(serverId)
+  if (!conn || conn.status !== 'connected' || !conn.client) {
+    return { error: `MCP server "${serverId}" is not connected.` }
+  }
+  try {
+    const res = await conn.client.readResource({ uri }, { timeout: conn.requestTimeout, signal })
+    return parseResourceContents(uri, res.contents)
+  } catch (e) {
+    if (signal?.aborted) return { error: `Reading ${uri} was cancelled.` }
+    return { error: `Could not read ${uri}: ${errMsg(e)}` }
+  }
+}
+
+/**
+ * The lossless result of the last call to `qualifiedName`, if any.
+ *
+ * The seam MCP Apps reads: a UI-bearing tool's result carries the data its view
+ * renders, and the flat `ToolResult` is a lossy projection of exactly that.
+ */
+export function lastMcpCallResult(qualifiedName: string): McpCallResult | undefined {
+  return lastResults.get(qualifiedName)
+}
+
+/**
+ * The server's own definition of one namespaced tool, or undefined if unknown.
+ *
+ * The seam MCP Apps builds on: a UI-bearing tool declares its view at
+ * `_meta['io.modelcontextprotocol/ui'].resourceUri`, and app-only tools are
+ * flagged in the same `_meta`. Exposed as a lookup rather than folded into
+ * `mcpToolSchemas` because the schema list is the MODEL's view, and these fields
+ * are deliberately not part of it.
+ */
+export function mcpToolDefinition(name: string): McpToolDefinition | undefined {
+  return toolIndex.get(name)?.definition
+}
+
 /** Whether a tool name should be dispatched to the MCP pool (re-exported for tools.ts). */
 export const isMcpTool = isMcpToolName
 
@@ -320,7 +688,8 @@ export function mcpServerSummaries(ids?: Set<string>): McpServerSummary[] {
       id: conn.id,
       status: conn.status,
       tools: conn.tools.map((t) => t.toolName),
-      error: conn.error
+      error: conn.error,
+      era: conn.era
     })
   }
   return out
@@ -345,16 +714,82 @@ export async function reconnectMcpServer(
     id: conn.id,
     status: conn.status,
     tools: conn.tools.map((t) => t.toolName),
-    error: conn.error
+    error: conn.error,
+    era: conn.era
   }
 }
 
+/**
+ * Redirect URI used when refreshing an already-authorized connection.
+ *
+ * A refresh never redirects anywhere - the SDK exchanges the stored refresh
+ * token directly - but `clientMetadata` still has to name the URI the client was
+ * registered with, or the authorization server rejects the request. The
+ * interactive path (`signInMcpServer`) allocates a real port and overrides this.
+ */
+const REDIRECT_PLACEHOLDER = 'http://127.0.0.1/callback'
+
+/**
+ * Sign in to a remote MCP server, then connect it.
+ *
+ * The one genuinely interactive MCP flow: allocate a loopback listener, let the
+ * SDK send the user to the authorization server, capture the redirect, exchange
+ * the code, and reconnect with the tokens in place.
+ *
+ * Never throws - a failed sign-in reports as an errored summary, exactly like a
+ * server that wouldn't start.
+ */
+export async function signInMcpServer(
+  rec: McpServerRecord,
+  workspaceCwd: string
+): Promise<McpServerSummary> {
+  if (rec.config.type !== 'remote') {
+    return { id: rec.id, status: 'error', tools: [], error: 'Only remote servers use OAuth.' }
+  }
+  await disposeConnection(rec.id)
+  try {
+    const redirectUrl = await prepareAuthorization(rec.id)
+    const auth = mcpAuthProvider(rec.id, redirectUrl)
+    const client = new Client(clientInfo(), clientOptions(rec.id))
+    const [make] = transportFactories(rec, workspaceCwd, auth)
+    const transport = make()
+    try {
+      // Expected to reject with UnauthorizedError after opening the browser:
+      // that IS the handshake, not a failure.
+      await client.connect(transport, { timeout: startupTimeout(rec) })
+    } catch {
+      const params = await awaitAuthorization(rec.id)
+      // `finishAuth` validates `iss` (RFC 9207) and exchanges the code. The
+      // transport is single-use once it has failed, so reconnect on a fresh one:
+      // OAuth state lives on the provider, not the transport.
+      await (transport as { finishAuth?: (p: URLSearchParams) => Promise<void> }).finishAuth?.(
+        params
+      )
+    }
+    await client.close().catch(() => {})
+    return await reconnectMcpServer(rec, workspaceCwd)
+  } catch (e) {
+    return { id: rec.id, status: 'error', tools: [], error: errMsg(e) }
+  }
+}
+
+/** Forget a remote server's OAuth credentials and drop its connection. */
+export async function signOutMcpServer(id: string): Promise<void> {
+  clearMcpAuth(id)
+  await disposeConnection(id)
+}
+
+/** Whether a server has stored OAuth credentials (drives the "signed in" badge). */
+export function isMcpSignedIn(id: string): boolean {
+  return repo.hasMcpOAuth(id)
+}
+
 /** Close + forget one server's connection (e.g. it was deleted or disabled). */
 export async function disposeConnection(id: string): Promise<void> {
   connecting.delete(id)
   const conn = connections.get(id)
   connections.delete(id)
-  for (const [key, info] of toolIndex) if (info.serverId === id) toolIndex.delete(key)
+  forgetServer(id)
   if (conn?.client) {
     conn.client.onclose = undefined
     try {
@@ -415,4 +850,5 @@ export async function _resetMcpForTests(): Promise<void> {
   connections.clear()
   connecting.clear()
   toolIndex.clear()
+  lastResults.clear()
 }
diff --git a/src/main/services/portable.ts b/src/main/services/portable.ts
index 84f08dc..2fc34f3 100644
--- a/src/main/services/portable.ts
+++ b/src/main/services/portable.ts
@@ -77,7 +77,11 @@ export async function applyImport(text: string): Promise<ImportResult> {
   const existingIds = new Set(repo.listMcpServers().map((r) => r.id))
   for (const s of bundle.mcpServers) {
     try {
-      repo.upsertMcpServer({ id: s.id, config: s.config, enabled: s.enabled })
+      // Imported, not authored: the user consented to reading a FILE, which is
+      // not the same as approving each command inside it (a bundle is a
+      // share-a-link vector). Left as agent-origin so the consent gate still
+      // discloses each server before it is ever spawned.
+      repo.upsertMcpServer({ id: s.id, config: s.config, enabled: s.enabled, origin: 'agent' })
       mcpServers.push({ id: s.id, replaced: existingIds.has(s.id) })
     } catch (e) {
       skillRes.skipped.push({ name: s.id, reason: (e as Error).message })
diff --git a/src/preload/index.ts b/src/preload/index.ts
index caf7390..6eae2ad 100644
--- a/src/preload/index.ts
+++ b/src/preload/index.ts
@@ -14,6 +14,8 @@ import type {
   UpdateState
 } from '../shared/api'
 import type { CliProxyState } from '../shared/cliproxy'
+import type { McpConsentRequest, McpInstallNotice } from '../shared/mcp-trust'
+import type { McpAppApprovalRequest } from '../shared/api'
 import type { ResolvedTheme } from '../shared/theme'
 
 /**
@@ -74,7 +76,44 @@ const roxy: RoxyApi = {
     upsert: (input) => ipcRenderer.invoke(CHANNELS.mcpUpsert, input),
     remove: (id) => ipcRenderer.invoke(CHANNELS.mcpRemove, id),
     setEnabled: (id, enabled) => ipcRenderer.invoke(CHANNELS.mcpSetEnabled, id, enabled),
-    reconnect: (id) => ipcRenderer.invoke(CHANNELS.mcpReconnect, id)
+    reconnect: (id) => ipcRenderer.invoke(CHANNELS.mcpReconnect, id),
+    signIn: (id) => ipcRenderer.invoke(CHANNELS.mcpSignIn, id),
+    signOut: (id) => ipcRenderer.invoke(CHANNELS.mcpSignOut, id),
+    app: {
+      launch: (input) => ipcRenderer.invoke(CHANNELS.mcpAppLaunch, input),
+      request: (req) => ipcRenderer.invoke(CHANNELS.mcpAppRequest, req),
+      close: (sessionId) => ipcRenderer.invoke(CHANNELS.mcpAppClose, sessionId),
+      setTheme: (theme) => ipcRenderer.send(CHANNELS.mcpAppTheme, theme),
+      onApprovalRequest: (callback) => {
+        const handler = (_e: Electron.IpcRendererEvent, r: McpAppApprovalRequest): void =>
+          callback(r)
+        ipcRenderer.on(CHANNELS.mcpAppApprovalRequest, handler)
+        return () => ipcRenderer.removeListener(CHANNELS.mcpAppApprovalRequest, handler)
+      },
+      respondApproval: (res) => ipcRenderer.send(CHANNELS.mcpAppApprovalRespond, res)
+    },
+    trust: {
+      list: () => ipcRenderer.invoke(CHANNELS.mcpTrustList),
+      revoke: (target) => ipcRenderer.invoke(CHANNELS.mcpTrustRevoke, target),
+      getPolicy: () => ipcRenderer.invoke(CHANNELS.mcpTrustGetPolicy),
+      setPolicy: (confirmBeforeRun) =>
+        ipcRenderer.invoke(CHANNELS.mcpTrustSetPolicy, confirmBeforeRun),
+      onInstall: (callback) => {
+        const handler = (_e: Electron.IpcRendererEvent, notice: McpInstallNotice): void =>
+          callback(notice)
+        ipcRenderer.on(CHANNELS.mcpInstallNotice, handler)
+        return () => ipcRenderer.removeListener(CHANNELS.mcpInstallNotice, handler)
+      },
+      onRequest: (callback) => {
+        const handler = (_e: Electron.IpcRendererEvent, request: McpConsentRequest): void =>
+          callback(request)
+        ipcRenderer.on(CHANNELS.mcpConsentRequest, handler)
+        return () => ipcRenderer.removeListener(CHANNELS.mcpConsentRequest, handler)
+      },
+      // `send`, not `invoke`: the answer resolves a promise the main process is
+      // already awaiting, and the renderer has nothing to wait for in return.
+      respond: (response) => ipcRenderer.send(CHANNELS.mcpConsentRespond, response)
+    }
   },
   skills: {
     list: (cwd) => ipcRenderer.invoke(CHANNELS.skillsList, cwd),
diff --git a/src/renderer/src/App.tsx b/src/renderer/src/App.tsx
index def79a8..258542d 100644
--- a/src/renderer/src/App.tsx
+++ b/src/renderer/src/App.tsx
@@ -9,6 +9,9 @@ import Skills from './routes/Skills'
 import Mcp from './routes/Mcp'
 import Themes from './routes/Themes'
 import Settings from './routes/Settings'
+import { McpConsentDialog } from './components/McpConsentDialog'
+import { McpInstallSheet } from './components/McpInstallSheet'
+import { McpAppApprovalDialog } from './components/McpAppApprovalDialog'
 
 function Splash(): JSX.Element {
   return (
@@ -47,6 +50,12 @@ export default function App(): JSX.Element {
         <Route path="/settings" element={<Settings />} />
         <Route path="*" element={<Navigate to="/" replace />} />
       </Routes>
+      {/* Outside <Routes>: a turn can hit an unapproved MCP server from any
+          screen, and the prompt blocks a process from spawning - it must not
+          depend on which route happens to be mounted. */}
+      <McpInstallSheet />
+      <McpConsentDialog />
+      <McpAppApprovalDialog />
     </HashRouter>
   )
 }
diff --git a/src/renderer/src/components/McpAppApprovalDialog.tsx b/src/renderer/src/components/McpAppApprovalDialog.tsx
new file mode 100644
index 0000000..6884818
--- /dev/null
+++ b/src/renderer/src/components/McpAppApprovalDialog.tsx
@@ -0,0 +1,106 @@
+import { useEffect, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { ShieldAlert, Wrench } from 'lucide-react'
+import type { McpAppApprovalRequest } from '@shared/api'
+import { api } from '../lib/api'
+import { Button } from './ui'
+
+/**
+ * Approval for a tool call a VIEW wants to make.
+ *
+ * The model calling a tool is the agent doing its job. A server-supplied UI
+ * calling one is different: it is untrusted third-party code, running because a
+ * tool result happened to carry a view, asking to take an action nobody typed.
+ * So it asks — once per (view, tool), then remembers for that view's lifetime.
+ *
+ * The per-view memory matters as much as the prompt: a spreadsheet app that
+ * writes a cell on every keystroke would be unusable if it asked each time, and
+ * a dialog people dismiss reflexively protects nothing.
+ */
+export function McpAppApprovalDialog(): JSX.Element | null {
+  const { t } = useTranslation()
+  const [queue, setQueue] = useState<McpAppApprovalRequest[]>([])
+
+  useEffect(() => {
+    return api.mcp.app.onApprovalRequest((req) => {
+      setQueue((q) => (q.some((r) => r.requestId === req.requestId) ? q : [...q, req]))
+    })
+  }, [])
+
+  const current = queue[0]
+
+  const answer = (allowed: boolean): void => {
+    if (!current) return
+    api.mcp.app.respondApproval({ requestId: current.requestId, allowed })
+    setQueue((q) => q.slice(1))
+  }
+
+  useEffect(() => {
+    if (!current) return
+    const onKey = (e: KeyboardEvent): void => {
+      if (e.key === 'Escape') answer(false)
+    }
+    window.addEventListener('keydown', onKey)
+    return () => window.removeEventListener('keydown', onKey)
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [current])
+
+  if (!current) return null
+
+  const args = JSON.stringify(current.args ?? {}, null, 2)
+
+  return (
+    <div
+      className="animate-scrim-in fixed inset-0 z-[80] flex items-center justify-center bg-black/60 p-6"
+      onClick={() => answer(false)}
+    >
+      <div
+        role="dialog"
+        aria-modal="true"
+        className="animate-modal-in flex max-h-[80vh] w-full max-w-md flex-col overflow-hidden sq sq-2xl sq-ring rounded-2xl border border-border bg-surface"
+        onClick={(e) => e.stopPropagation()}
+      >
+        <div className="flex items-start gap-3 border-b border-border px-5 py-4">
+          <div className="flex h-9 w-9 shrink-0 items-center justify-center sq sq-xl rounded-xl bg-warning/15 text-warning">
+            <ShieldAlert className="h-5 w-5" />
+          </div>
+          <div className="min-w-0 flex-1">
+            <h2 className="text-base font-semibold">{t('mcpApp.approveTitle')}</h2>
+            <p className="mt-0.5 text-xs text-text-muted">
+              {t('mcpApp.approveSubtitle', { server: current.serverId })}
+            </p>
+          </div>
+        </div>
+
+        <div className="min-h-0 flex-1 overflow-auto px-5 py-4">
+          <div className="flex flex-col gap-1 sq sq-lg sq-ring rounded-lg border border-border bg-surface-2 px-3 py-2">
+            <div className="flex items-center gap-1.5 text-[11px] font-medium uppercase tracking-wide text-text-subtle">
+              <Wrench className="h-3.5 w-3.5" />
+              {t('mcpApp.tool')}
+            </div>
+            <code className="break-all font-mono text-xs text-text">{current.toolName}</code>
+          </div>
+          {args !== '{}' && (
+            <pre className="mt-2 max-h-48 overflow-auto sq sq-lg rounded-lg border border-border bg-surface-2 px-3 py-2 font-mono text-[11px] leading-relaxed text-text-muted">
+              {args}
+            </pre>
+          )}
+          <p className="mt-3 text-[11px] leading-relaxed text-text-muted">
+            {t('mcpApp.approveNote')}
+          </p>
+        </div>
+
+        <div className="flex items-center gap-2 border-t border-border px-5 py-3">
+          {/* Deny focused: the safe answer is the one a reflexive Enter lands on. */}
+          <Button variant="secondary" autoFocus onClick={() => answer(false)}>
+            {t('mcpApp.deny')}
+          </Button>
+          <Button variant="primary" onClick={() => answer(true)}>
+            {t('mcpApp.allow')}
+          </Button>
+          <span className="ml-auto text-[11px] text-text-subtle">{t('mcpApp.rememberNote')}</span>
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/McpAppView.tsx b/src/renderer/src/components/McpAppView.tsx
new file mode 100644
index 0000000..3ed6bca
--- /dev/null
+++ b/src/renderer/src/components/McpAppView.tsx
@@ -0,0 +1,288 @@
+import { useEffect, useRef, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { Globe, Maximize2, Minimize2, ShieldAlert, X } from 'lucide-react'
+import type { McpAppLaunch } from '@shared/api'
+import { APP_HEIGHT, clampAppHeight, SANDBOX_POST_TARGET } from '@shared/mcp-apps'
+import { api } from '../lib/api'
+import { cn } from '../lib/cn'
+
+/** Publish Roxy's live palette using the protocol's closed style-token schema. */
+function publishMcpAppTheme(): void {
+  const root = document.documentElement
+  const styles = getComputedStyle(root)
+  const read = (name: string): string => styles.getPropertyValue(name).trim()
+  api.mcp.app.setTheme({
+    mode: root.dataset.appearance === 'light' ? 'light' : 'dark',
+    variables: {
+      '--color-background-primary': read('--color-surface'),
+      '--color-background-secondary': read('--color-surface-2'),
+      '--color-background-tertiary': read('--color-elevated'),
+      '--color-text-primary': read('--color-text'),
+      '--color-text-secondary': read('--color-text-muted'),
+      '--color-text-tertiary': read('--color-text-subtle'),
+      '--color-border-primary': read('--color-border'),
+      '--color-border-secondary': read('--color-border-strong'),
+      '--color-ring-primary': read('--color-accent'),
+      '--font-sans': read('--font-sans') || 'system-ui, sans-serif',
+      '--font-mono': read('--font-mono') || 'ui-monospace, monospace'
+    }
+  })
+}
+
+/**
+ * Renders one MCP App — a server-supplied UI — inside a tool card.
+ *
+ * ## What this component is careful about
+ *
+ * The HTML being mounted is untrusted third-party code. This component never
+ * touches it: it hands the markup to a sandbox frame on a DIFFERENT ORIGIN and
+ * relays JSON-RPC frames. There is no `dangerouslySetInnerHTML` anywhere, and no
+ * path by which the view's script reaches React state, the preload bridge, or
+ * another server.
+ *
+ * The message plumbing is deliberately paranoid in three specific ways:
+ *
+ *  1. **Source-checked, not origin-checked-only.** Every inbound message is
+ *     compared against `frame.contentWindow`. Origin alone is not enough: every
+ *     app view shares the one sandbox origin, so two cards in the same
+ *     transcript would otherwise be able to answer each other's requests.
+ *  2. **Targeted replies.** Responses go to the frame's window with an explicit
+ *     origin, never `'*'` — a wildcard reply is readable by whatever happens to
+ *     be listening if the frame navigates.
+ *  3. **Nothing before `initialized`.** The host sends no notification until the
+ *     view says it is ready, per SEP-1865; sending early loses the message and
+ *     leaves the view waiting for data it will never get again.
+ */
+export function McpAppView({
+  serverId,
+  toolName,
+  resourceUri,
+  toolInput,
+  toolResult
+}: {
+  serverId: string
+  /** Qualified tool name (`mcp__server__tool`) whose call produced this view. */
+  toolName: string
+  /** The `ui://` resource holding the view. */
+  resourceUri: string
+  /** Arguments the model passed, forwarded to the view once it initializes. */
+  toolInput?: unknown
+  /** The tool's own result, forwarded the same way. */
+  toolResult?: unknown
+}): JSX.Element | null {
+  const { t } = useTranslation()
+  const frameRef = useRef<HTMLIFrameElement>(null)
+  const [launch, setLaunch] = useState<McpAppLaunch | null>(null)
+  const [failed, setFailed] = useState(false)
+  const [height, setHeight] = useState<number>(APP_HEIGHT.initial)
+  const [fullscreen, setFullscreen] = useState(false)
+
+  // Load the view's HTML once per tool call. Publish the theme first: an app can
+  // send ui/initialize as soon as its inline script runs, so a later effect can
+  // race and leave it with main's stale/default snapshot.
+  useEffect(() => {
+    let alive = true
+    publishMcpAppTheme()
+    void api.mcp.app
+      .launch({ serverId, toolName, resourceUri })
+      .then((res) => {
+        if (!alive) return
+        if (res) setLaunch(res)
+        else setFailed(true)
+      })
+      .catch(() => alive && setFailed(true))
+    return () => {
+      alive = false
+    }
+  }, [serverId, toolName, resourceUri])
+
+  // Tear the session down when the card unmounts. Without this, scrolling a long
+  // transcript would leave a broker session (and its retained result) alive for
+  // every app card ever rendered.
+  useEffect(() => {
+    const id = launch?.sessionId
+    if (!id) return
+    return () => {
+      void api.mcp.app.close(id)
+    }
+  }, [launch?.sessionId])
+
+  // The bridge. One listener per mounted view, filtered to its own frame.
+  useEffect(() => {
+    const sessionId = launch?.sessionId
+    const frame = frameRef.current
+    if (!sessionId || !frame) return
+
+    let proxyReady = false
+    let viewReady = false
+
+    const post = (msg: unknown): void => {
+      // Explicit target origin, never '*'.
+      frame.contentWindow?.postMessage(msg, SANDBOX_POST_TARGET)
+    }
+
+    /** Hand the view its tool input + result, once it says it is listening. */
+    const sendOpeningData = (): void => {
+      if (!viewReady) return
+      if (toolInput !== undefined) {
+        // The official App SDK validates this envelope. Sending the arguments
+        // object directly (the old behavior) makes `ontoolinput` receive no
+        // arguments, so the map ignores the requested bounds and stays at its
+        // default location.
+        post({
+          jsonrpc: '2.0',
+          method: 'ui/notifications/tool-input',
+          params: { arguments: toolInput }
+        })
+      }
+      const result = launch.toolResult ?? toolResult
+      if (result !== undefined) {
+        // Standard MCP CallToolResult, including result-level `_meta` such as
+        // the map server's viewUUID. Never send the card's flattened string
+        // when the bounded structured result is available.
+        post({ jsonrpc: '2.0', method: 'ui/notifications/tool-result', params: result })
+      }
+    }
+
+    const onMessage = async (event: MessageEvent): Promise<void> => {
+      // Identity check first: this frame, not merely this origin. Every view
+      // shares the sandbox origin, so origin alone would let one card's view
+      // answer another card's requests.
+      if (event.source !== frame.contentWindow) return
+
+      const data = event.data as {
+        jsonrpc?: string
+        id?: string | number | null
+        method?: string
+        params?: Record<string, unknown>
+      }
+      if (!data || data.jsonrpc !== '2.0') return
+
+      // The proxy announcing itself: hand over the HTML + its policy.
+      if (data.method === 'ui/notifications/sandbox-proxy-ready') {
+        proxyReady = true
+        post({
+          jsonrpc: '2.0',
+          method: 'ui/notifications/sandbox-resource-ready',
+          params: { html: launch.html, csp: launch.csp, allow: launch.allow }
+        })
+        return
+      }
+      if (!proxyReady) return
+
+      // The view finished its handshake; only now may the host speak to it.
+      if (data.method === 'ui/notifications/initialized') {
+        viewReady = true
+        sendOpeningData()
+        return
+      }
+
+      // Height reports resize the card. Clamped in shared code so a view cannot
+      // claim 900,000px and push the rest of the transcript out of reach.
+      if (data.method === 'ui/notifications/size-changed') {
+        setHeight(clampAppHeight((data.params as { height?: number })?.height))
+        return
+      }
+
+      // Everything else goes to the broker in main, which decides whether it is
+      // allowed and executes it against this view's own server.
+      const reply = await api.mcp.app.request({
+        sessionId,
+        id: data.id,
+        method: data.method,
+        params: data.params
+      })
+
+      // Notifications carry no id and get no response.
+      if (data.id === undefined || data.id === null) return
+      post(
+        reply.error
+          ? { jsonrpc: '2.0', id: data.id, error: reply.error }
+          : { jsonrpc: '2.0', id: data.id, result: reply.result ?? {} }
+      )
+    }
+
+    const listener = (e: MessageEvent): void => void onMessage(e)
+    window.addEventListener('message', listener)
+    return () => window.removeEventListener('message', listener)
+  }, [launch, toolInput, toolResult])
+
+  if (failed) return null
+  if (!launch) {
+    return (
+      <div className="border-t border-border bg-surface px-3 py-2 text-xs text-text-subtle">
+        {t('mcpApp.loading')}
+      </div>
+    )
+  }
+
+  const canFullscreen = launch.displayModes.includes('fullscreen')
+
+  return (
+    <div
+      className={cn(
+        'flex flex-col border-t border-border bg-surface',
+        fullscreen && 'fixed inset-0 z-[70] border-0 bg-black/70 p-6'
+      )}
+    >
+      <div
+        className={cn(
+          'flex flex-col overflow-hidden',
+          fullscreen && 'h-full rounded-2xl border border-border bg-surface'
+        )}
+      >
+        {/* The boundary marker. A sandboxed view can draw anything it likes,
+            including a convincing copy of Roxy's own chrome, so the user needs a
+            piece of UI outside the frame telling them where the app ends. */}
+        <div className="flex items-center gap-2 border-b border-border/60 bg-surface-2 px-2.5 py-1">
+          <ShieldAlert className="h-3 w-3 shrink-0 text-text-subtle" />
+          <span className="truncate text-[10px] uppercase tracking-wide text-text-subtle">
+            {t('mcpApp.boundary', { server: serverId })}
+          </span>
+          {launch.externalDomains.length > 0 && (
+            <span
+              className="flex shrink-0 items-center gap-1 text-[10px] text-warning"
+              title={launch.externalDomains.join(', ')}
+            >
+              <Globe className="h-3 w-3" />
+              {t('mcpApp.external', { count: launch.externalDomains.length })}
+            </span>
+          )}
+          {canFullscreen && (
+            <button
+              onClick={() => setFullscreen((f) => !f)}
+              aria-label={fullscreen ? t('mcpApp.exitFullscreen') : t('mcpApp.fullscreen')}
+              className="press-scale ml-auto rounded p-0.5 text-text-subtle hover:text-text"
+            >
+              {fullscreen ? <Minimize2 className="h-3 w-3" /> : <Maximize2 className="h-3 w-3" />}
+            </button>
+          )}
+          {fullscreen && (
+            <button
+              onClick={() => setFullscreen(false)}
+              aria-label={t('common.close')}
+              className="press-scale rounded p-0.5 text-text-subtle hover:text-text"
+            >
+              <X className="h-3 w-3" />
+            </button>
+          )}
+        </div>
+        <iframe
+          ref={frameRef}
+          // Per-app URL: the custom-scheme handler serves the CSP declared by
+          // this resource as a response header. A static URL always gets the
+          // fallback policy and blocks Cesium's CDN/OSM tiles.
+          src={launch.sandboxUrl}
+          title={t('mcpApp.frameTitle', { server: serverId })}
+          // Matches the official host. `allow-same-origin` means same as the
+          // dedicated roxy-mcp-app:// sandbox, never same as Roxy's renderer;
+          // popups and top-level navigation remain withheld.
+          sandbox="allow-scripts allow-same-origin allow-forms"
+          allow={launch.allow || undefined}
+          style={{ height: fullscreen ? '100%' : `${height}px` }}
+          className="w-full border-0 bg-transparent"
+        />
+      </div>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/McpConsentDialog.tsx b/src/renderer/src/components/McpConsentDialog.tsx
new file mode 100644
index 0000000..a658275
--- /dev/null
+++ b/src/renderer/src/components/McpConsentDialog.tsx
@@ -0,0 +1,225 @@
+import { useEffect, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import {
+  AlertTriangle,
+  FolderGit2,
+  Globe,
+  KeyRound,
+  ShieldAlert,
+  TerminalSquare
+} from 'lucide-react'
+import type { McpConsentRequest, McpConsentResponse } from '@shared/mcp-trust'
+import { api } from '../lib/api'
+import { Button } from './ui'
+
+/**
+ * The MCP consent prompt — the rare blocking question.
+ *
+ * This is NOT the normal path. Installing an MCP server is the user's own
+ * decision, so it runs and reports what it exposed (see McpInstallSheet). This
+ * dialog appears in exactly two cases:
+ *
+ *  - **`changed`** — a server the user already trusted now runs a DIFFERENT
+ *    command. Approving `npx server-github` is not approving whatever replaced
+ *    it, and this substitution is the one thing the user did not do themselves.
+ *  - **`confirm-first-run`** — the user opted into confirming new servers.
+ *
+ * Keeping the interruption this rare is what makes it mean something: a dialog
+ * people see twice a year gets read, a dialog they see daily gets dismissed.
+ *
+ * Rules: the command is stated verbatim, deny is focused, Escape and the
+ * backdrop both deny, and env/header VALUES are never rendered.
+ */
+export function McpConsentDialog(): JSX.Element | null {
+  const { t } = useTranslation()
+  const [queue, setQueue] = useState<McpConsentRequest[]>([])
+
+  // Requests are queued, never dropped: two turns can each hit an unapproved
+  // server, and silently discarding the second would leave the main process
+  // waiting on an answer that can no longer be given (until it times out and
+  // denies - correct, but confusing to a user who never saw a prompt).
+  useEffect(() => {
+    return api.mcp.trust.onRequest((request) => {
+      setQueue((q) => (q.some((r) => r.requestId === request.requestId) ? q : [...q, request]))
+    })
+  }, [])
+
+  const current = queue[0]
+
+  const answer = (decision: 'allow' | 'deny', scope: McpConsentResponse['scope']): void => {
+    if (!current) return
+    api.mcp.trust.respond({ requestId: current.requestId, decision, scope })
+    setQueue((q) => q.slice(1))
+  }
+
+  // Escape denies. A dialog you can dismiss into an approval is not a gate.
+  useEffect(() => {
+    if (!current) return
+    const onKey = (e: KeyboardEvent): void => {
+      if (e.key === 'Escape') answer('deny', 'once')
+    }
+    window.addEventListener('keydown', onKey)
+    return () => window.removeEventListener('keydown', onKey)
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [current])
+
+  if (!current) return null
+
+  const { disclosure: d } = current
+  const isLocal = d.transport === 'local'
+  const changed = current.reason === 'changed'
+
+  return (
+    <div
+      className="animate-scrim-in fixed inset-0 z-[60] flex items-center justify-center bg-black/60 p-6"
+      onClick={() => answer('deny', 'once')}
+    >
+      <div
+        role="dialog"
+        aria-modal="true"
+        aria-labelledby="mcp-consent-title"
+        className="animate-modal-in flex max-h-[88vh] w-full max-w-lg flex-col overflow-hidden sq sq-2xl sq-ring rounded-2xl border border-border bg-surface"
+        onClick={(e) => e.stopPropagation()}
+      >
+        <div className="flex items-start gap-3 border-b border-border px-5 py-4">
+          <div
+            className={`flex h-9 w-9 shrink-0 items-center justify-center sq sq-xl rounded-xl ${
+              changed ? 'bg-danger/15 text-danger' : 'bg-warning/15 text-warning'
+            }`}
+          >
+            {changed ? <AlertTriangle className="h-5 w-5" /> : <ShieldAlert className="h-5 w-5" />}
+          </div>
+          <div className="min-w-0 flex-1">
+            <h2 id="mcp-consent-title" className="text-base font-semibold">
+              {changed ? t('mcpTrust.changedTitle') : t('mcpTrust.title')}
+            </h2>
+            <p className="mt-0.5 text-xs text-text-muted">
+              {t(`mcpTrust.origin.${current.provenance}`, {
+                name: current.id,
+                defaultValue: t('mcpTrust.origin.workspace', { name: current.id })
+              })}
+            </p>
+          </div>
+        </div>
+
+        <div className="min-h-0 flex-1 overflow-auto px-5 py-4">
+          {changed && (
+            <p className="mb-3 sq sq-lg rounded-lg border border-danger/30 bg-danger/10 px-3 py-2 text-xs leading-relaxed text-danger">
+              {t('mcpTrust.changedWarning')}
+              {current.previousSummary && (
+                <span className="mt-1 block font-mono text-[11px] opacity-80">
+                  {t('mcpTrust.previously')} {current.previousSummary}
+                </span>
+              )}
+            </p>
+          )}
+
+          <p className="mb-3 text-xs leading-relaxed text-text-muted">
+            {isLocal ? t('mcpTrust.explainLocal') : t('mcpTrust.explainRemote')}
+          </p>
+
+          <dl className="flex flex-col gap-2.5">
+            {isLocal ? (
+              <>
+                <Row
+                  icon={<TerminalSquare className="h-3.5 w-3.5" />}
+                  label={t('mcpTrust.command')}
+                >
+                  <code className="block break-all font-mono text-xs text-text">
+                    {[d.executable, ...(d.args ?? [])].filter(Boolean).join(' ')}
+                  </code>
+                </Row>
+                <Row icon={<FolderGit2 className="h-3.5 w-3.5" />} label={t('mcpTrust.workingDir')}>
+                  <code className="block break-all font-mono text-xs text-text-muted">
+                    {d.cwd || current.workspace || t('mcpTrust.workspaceRoot')}
+                  </code>
+                </Row>
+              </>
+            ) : (
+              <Row icon={<Globe className="h-3.5 w-3.5" />} label={t('mcpTrust.url')}>
+                <code className="block break-all font-mono text-xs text-text">{d.url}</code>
+              </Row>
+            )}
+
+            {/* Names only, never values: a modal is a screenshot waiting to happen. */}
+            {!!(isLocal ? d.envNames : d.headerNames)?.length && (
+              <Row
+                icon={<KeyRound className="h-3.5 w-3.5" />}
+                label={isLocal ? t('mcpTrust.envVars') : t('mcpTrust.headers')}
+              >
+                <div className="flex flex-wrap gap-1">
+                  {(isLocal ? d.envNames : d.headerNames)!.map((name) => (
+                    <span
+                      key={name}
+                      className="sq sq-md rounded-md border border-border bg-surface-2 px-1.5 py-0.5 font-mono text-[11px] text-text-muted"
+                    >
+                      {name}
+                    </span>
+                  ))}
+                </div>
+                {d.injectsSecrets && (
+                  <p className="mt-1 text-[11px] text-warning">{t('mcpTrust.secretsNote')}</p>
+                )}
+              </Row>
+            )}
+
+            {current.workspace && (
+              <Row icon={<FolderGit2 className="h-3.5 w-3.5" />} label={t('mcpTrust.project')}>
+                <code className="block break-all font-mono text-xs text-text-muted">
+                  {current.workspace}
+                </code>
+              </Row>
+            )}
+          </dl>
+        </div>
+
+        <div className="flex flex-col gap-2 border-t border-border px-5 py-3">
+          <div className="flex items-center gap-2">
+            {/* Deny is first and autofocused: the safe answer should be the one
+                a reflexive Enter or click lands on. */}
+            <Button variant="secondary" autoFocus onClick={() => answer('deny', 'server')}>
+              {t('mcpTrust.deny')}
+            </Button>
+            <Button variant="primary" onClick={() => answer('allow', 'server')}>
+              {t('mcpTrust.allow')}
+            </Button>
+            <span className="ml-auto text-[11px] text-text-subtle">
+              {t('mcpTrust.rememberNote')}
+            </span>
+          </div>
+          {/* Trusting the whole project is offered only for workspace-declared
+              servers - it is scoped to a folder, so it is meaningless (and
+              would be dangerously broad) for anything else. */}
+          {current.provenance === 'workspace' && current.workspace && (
+            <button
+              onClick={() => answer('allow', 'workspace')}
+              className="press-scale self-start text-[11px] text-text-muted underline-offset-2 hover:text-text hover:underline"
+            >
+              {t('mcpTrust.trustWorkspace')}
+            </button>
+          )}
+        </div>
+      </div>
+    </div>
+  )
+}
+
+function Row({
+  icon,
+  label,
+  children
+}: {
+  icon: JSX.Element
+  label: string
+  children: React.ReactNode
+}): JSX.Element {
+  return (
+    <div className="flex flex-col gap-1 sq sq-lg sq-ring rounded-lg border border-border bg-surface-2 px-3 py-2">
+      <dt className="flex items-center gap-1.5 text-[11px] font-medium uppercase tracking-wide text-text-subtle">
+        {icon}
+        {label}
+      </dt>
+      <dd className="min-w-0">{children}</dd>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/McpInstallSheet.tsx b/src/renderer/src/components/McpInstallSheet.tsx
new file mode 100644
index 0000000..7701fc9
--- /dev/null
+++ b/src/renderer/src/components/McpInstallSheet.tsx
@@ -0,0 +1,217 @@
+import { useEffect, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import {
+  Boxes,
+  CircleAlert,
+  FolderGit2,
+  Globe,
+  KeyRound,
+  Package,
+  ShieldAlert,
+  TerminalSquare,
+  Wrench,
+  X
+} from 'lucide-react'
+import type { McpInstallNotice } from '@shared/mcp-trust'
+import { api } from '../lib/api'
+import { Button } from './ui'
+
+/**
+ * "Here's what you just installed" — shown AFTER an MCP server connects, once.
+ *
+ * This is the disclosure that replaces an approval dialog. Installing a server
+ * is the user's decision; asking them to re-confirm it teaches nothing and
+ * trains the click-through reflex. What they genuinely can't know in advance is
+ * WHAT THE SERVER GAVE THEM — and that only exists after the handshake.
+ *
+ * So the hierarchy is:
+ *   1. The tools it added, by name. The reason you installed it.
+ *   2. The source it came from. The thing actually worth trusting.
+ *   3. The command/URL, for anyone who wants to check.
+ *   4. One honest line: an MCP server runs with your access — trust the source.
+ *
+ * Dismissable, non-blocking, and never shown twice for the same server.
+ */
+export function McpInstallSheet(): JSX.Element | null {
+  const { t } = useTranslation()
+  const [queue, setQueue] = useState<McpInstallNotice[]>([])
+
+  useEffect(() => {
+    return api.mcp.trust.onInstall((notice) => {
+      setQueue((q) => (q.some((n) => n.id === notice.id) ? q : [...q, notice]))
+    })
+  }, [])
+
+  const current = queue[0]
+  const dismiss = (): void => setQueue((q) => q.slice(1))
+
+  useEffect(() => {
+    if (!current) return
+    const onKey = (e: KeyboardEvent): void => {
+      if (e.key === 'Escape') dismiss()
+    }
+    window.addEventListener('keydown', onKey)
+    return () => window.removeEventListener('keydown', onKey)
+  }, [current])
+
+  if (!current) return null
+
+  const { disclosure: d, tools, error } = current
+  const isLocal = d.transport === 'local'
+  const credentialNames = (isLocal ? d.envNames : d.headerNames) ?? []
+
+  return (
+    <div
+      className="animate-scrim-in fixed inset-0 z-[60] flex items-center justify-center bg-black/60 p-6"
+      onClick={dismiss}
+    >
+      <div
+        role="dialog"
+        aria-modal="true"
+        aria-labelledby="mcp-install-title"
+        className="animate-modal-in flex max-h-[88vh] w-full max-w-lg flex-col overflow-hidden sq sq-2xl sq-ring rounded-2xl border border-border bg-surface"
+        onClick={(e) => e.stopPropagation()}
+      >
+        <div className="flex items-start gap-3 border-b border-border px-5 py-4">
+          <div
+            className={`flex h-9 w-9 shrink-0 items-center justify-center sq sq-xl rounded-xl ${
+              error ? 'bg-danger/15 text-danger' : 'bg-success/15 text-success'
+            }`}
+          >
+            {error ? <CircleAlert className="h-5 w-5" /> : <Boxes className="h-5 w-5" />}
+          </div>
+          <div className="min-w-0 flex-1">
+            <h2 id="mcp-install-title" className="text-base font-semibold">
+              {error
+                ? t('mcpInstall.failedTitle', { name: current.id })
+                : t('mcpInstall.title', { name: current.id })}
+            </h2>
+            <p className="mt-0.5 truncate text-xs text-text-muted" title={d.source}>
+              {t('mcpInstall.from')} <span className="font-mono">{d.source}</span>
+            </p>
+          </div>
+          <button
+            onClick={dismiss}
+            aria-label={t('common.close')}
+            className="press-scale -mr-1 -mt-1 rounded-md p-1 text-text-subtle hover:text-text"
+          >
+            <X className="h-4 w-4" />
+          </button>
+        </div>
+
+        <div className="min-h-0 flex-1 overflow-auto px-5 py-4">
+          {error ? (
+            <p className="sq sq-lg rounded-lg border border-danger/30 bg-danger/10 px-3 py-2 font-mono text-xs leading-relaxed text-danger">
+              {error}
+            </p>
+          ) : (
+            <>
+              {/* The tools ARE the headline: this is what the user gained. */}
+              <p className="mb-2 text-xs font-medium uppercase tracking-wide text-text-subtle">
+                {tools.length
+                  ? t('mcpInstall.toolsAdded', { count: tools.length })
+                  : t('mcpInstall.noTools')}
+              </p>
+              {tools.length > 0 && (
+                <div className="mb-4 flex flex-wrap gap-1.5">
+                  {tools.map((name) => (
+                    <span
+                      key={name}
+                      className="flex items-center gap-1 sq sq-md rounded-md border border-border bg-surface-2 px-2 py-1 font-mono text-[11px] text-text"
+                    >
+                      <Wrench className="h-3 w-3 text-text-subtle" />
+                      {name}
+                    </span>
+                  ))}
+                </div>
+              )}
+            </>
+          )}
+
+          <dl className="flex flex-col gap-2.5">
+            <Row
+              icon={
+                isLocal ? <Package className="h-3.5 w-3.5" /> : <Globe className="h-3.5 w-3.5" />
+              }
+              label={t('mcpInstall.source')}
+            >
+              <code className="block break-all font-mono text-xs text-text">{d.source}</code>
+            </Row>
+            <Row
+              icon={<TerminalSquare className="h-3.5 w-3.5" />}
+              label={isLocal ? t('mcpInstall.command') : t('mcpInstall.url')}
+            >
+              <code className="block break-all font-mono text-xs text-text-muted">
+                {isLocal ? [d.executable, ...(d.args ?? [])].filter(Boolean).join(' ') : d.url}
+              </code>
+            </Row>
+            {credentialNames.length > 0 && (
+              <Row
+                icon={<KeyRound className="h-3.5 w-3.5" />}
+                label={isLocal ? t('mcpInstall.envVars') : t('mcpInstall.headers')}
+              >
+                <div className="flex flex-wrap gap-1">
+                  {credentialNames.map((name) => (
+                    <span
+                      key={name}
+                      className="sq sq-md rounded-md border border-border bg-surface-2 px-1.5 py-0.5 font-mono text-[11px] text-text-muted"
+                    >
+                      {name}
+                    </span>
+                  ))}
+                </div>
+                {d.injectsSecrets && (
+                  <p className="mt-1 text-[11px] text-warning">{t('mcpInstall.secretsNote')}</p>
+                )}
+              </Row>
+            )}
+            {current.workspace && (
+              <Row icon={<FolderGit2 className="h-3.5 w-3.5" />} label={t('mcpInstall.project')}>
+                <code className="block break-all font-mono text-xs text-text-muted">
+                  {current.workspace}
+                </code>
+              </Row>
+            )}
+          </dl>
+
+          {/* The one honest warning. Not "are you sure?" - the user already
+              decided - but the fact that makes the decision theirs to own. */}
+          <div className="mt-4 flex items-start gap-2 sq sq-lg rounded-lg border border-warning/30 bg-warning/10 px-3 py-2">
+            <ShieldAlert className="mt-0.5 h-3.5 w-3.5 shrink-0 text-warning" />
+            <p className="text-[11px] leading-relaxed text-text">
+              <span className="font-medium">{t('mcpInstall.trustSourceTitle')}</span>{' '}
+              {isLocal ? t('mcpInstall.trustSourceLocal') : t('mcpInstall.trustSourceRemote')}
+            </p>
+          </div>
+        </div>
+
+        <div className="flex items-center gap-2 border-t border-border px-5 py-3">
+          <Button variant="primary" autoFocus onClick={dismiss}>
+            {t('mcpInstall.done')}
+          </Button>
+          <span className="ml-auto text-[11px] text-text-subtle">{t('mcpInstall.manageNote')}</span>
+        </div>
+      </div>
+    </div>
+  )
+}
+
+function Row({
+  icon,
+  label,
+  children
+}: {
+  icon: JSX.Element
+  label: string
+  children: React.ReactNode
+}): JSX.Element {
+  return (
+    <div className="flex flex-col gap-1 sq sq-lg sq-ring rounded-lg border border-border bg-surface-2 px-3 py-2">
+      <dt className="flex items-center gap-1.5 text-[11px] font-medium uppercase tracking-wide text-text-subtle">
+        {icon}
+        {label}
+      </dt>
+      <dd className="min-w-0">{children}</dd>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/McpServers.tsx b/src/renderer/src/components/McpServers.tsx
index 9dbc79a..b165692 100644
--- a/src/renderer/src/components/McpServers.tsx
+++ b/src/renderer/src/components/McpServers.tsx
@@ -209,6 +209,17 @@ export function McpServers({ showBackup = false }: { showBackup?: boolean } = {}
                         ? t('mcp.statusError')
                         : t('mcp.statusDisabled')}
                   </Badge>
+                  {/* Which protocol era this server negotiated. Shown only for
+                      `modern`: legacy is the overwhelming majority today, so
+                      badging it would be noise on every row - the interesting
+                      signal is a server that speaks the 2026 revision. */}
+                  {s.era === 'modern' && (
+                    <span title={t('mcp.eraModernHelp')} className="inline-flex">
+                      <Badge className="border-info/30 bg-info/10 text-info">
+                        {t('mcp.eraModern')}
+                      </Badge>
+                    </span>
+                  )}
                 </div>
                 <p
                   className="mt-0.5 truncate text-xs text-text-subtle"
diff --git a/src/renderer/src/components/McpTrustPanel.tsx b/src/renderer/src/components/McpTrustPanel.tsx
new file mode 100644
index 0000000..ffa54bb
--- /dev/null
+++ b/src/renderer/src/components/McpTrustPanel.tsx
@@ -0,0 +1,174 @@
+import { useEffect, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { FolderGit2, Plug, ShieldCheck, Trash2 } from 'lucide-react'
+import type { McpTrustView } from '@shared/api'
+import { api } from '../lib/api'
+import { Button, Switch } from './ui'
+
+/**
+ * The MCP trust panel — the servers Roxy has run, and the posture it runs them
+ * under.
+ *
+ * Roxy's default is to run a server you installed and then tell you what it
+ * exposed, so this list is mostly a RECORD rather than a set of permissions:
+ * what has connected, what you blocked, which projects you trusted wholesale.
+ * Everything here is revocable, which is what keeps the default honest — a
+ * permissive default is only defensible if the consequences stay visible and
+ * reversible.
+ *
+ * The one switch flips the posture to ask-first, for shared machines and repos
+ * you don't control.
+ */
+export function McpTrustPanel(): JSX.Element {
+  const { t } = useTranslation()
+  const [view, setView] = useState<McpTrustView | null>(null)
+  const [busy, setBusy] = useState(false)
+
+  useEffect(() => {
+    void api.mcp.trust.list().then(setView)
+  }, [])
+
+  const revoke = async (
+    target: { kind: 'server'; id: string } | { kind: 'workspace'; path: string }
+  ): Promise<void> => {
+    setBusy(true)
+    try {
+      setView(await api.mcp.trust.revoke(target))
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  const setConfirm = async (confirmBeforeRun: boolean): Promise<void> => {
+    setBusy(true)
+    try {
+      const policy = await api.mcp.trust.setPolicy(confirmBeforeRun)
+      setView((v) => (v ? { ...v, policy } : v))
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  if (!view) return <p className="text-xs text-text-subtle">{t('common.loading')}</p>
+
+  const allowed = view.entries.filter((e) => e.decision === 'allow')
+  const denied = view.entries.filter((e) => e.decision === 'deny')
+
+  return (
+    <div className="flex flex-col gap-3">
+      <p className="text-xs leading-relaxed text-text-muted">{t('mcpTrust.panelIntro')}</p>
+
+      {view.workspaces.length > 0 && (
+        <Section title={t('mcpTrust.trustedProjects')}>
+          {view.workspaces.map((w) => (
+            <Row
+              key={w.path}
+              icon={<FolderGit2 className="h-3.5 w-3.5 text-text-muted" />}
+              title={w.path}
+              subtitle={t('mcpTrust.trustedProjectSub')}
+              busy={busy}
+              onRevoke={() => void revoke({ kind: 'workspace', path: w.path })}
+            />
+          ))}
+        </Section>
+      )}
+
+      {allowed.length > 0 && (
+        <Section title={t('mcpTrust.knownServers')}>
+          {allowed.map((e) => (
+            <Row
+              key={`${e.id}:${e.fingerprint}:${e.scope ?? ''}`}
+              icon={<ShieldCheck className="h-3.5 w-3.5 text-success" />}
+              title={e.id}
+              subtitle={e.scope ?? t('mcpTrust.scopeAnywhere')}
+              busy={busy}
+              onRevoke={() => void revoke({ kind: 'server', id: e.id })}
+            />
+          ))}
+        </Section>
+      )}
+
+      {denied.length > 0 && (
+        <Section title={t('mcpTrust.blockedServers')}>
+          {denied.map((e) => (
+            <Row
+              key={`${e.id}:${e.fingerprint}:${e.scope ?? ''}`}
+              icon={<Plug className="h-3.5 w-3.5 text-danger" />}
+              title={e.id}
+              subtitle={e.scope ?? t('mcpTrust.scopeAnywhere')}
+              busy={busy}
+              onRevoke={() => void revoke({ kind: 'server', id: e.id })}
+            />
+          ))}
+        </Section>
+      )}
+
+      {!view.workspaces.length && !view.entries.length && (
+        <p className="text-xs text-text-subtle">{t('mcpTrust.noneYet')}</p>
+      )}
+
+      {/* The stricter posture, for people who want it. Off by default: choosing
+          to install a server is already the decision. */}
+      <div className="mt-1 flex items-start gap-3 border-t border-border pt-3">
+        <div className="min-w-0 flex-1">
+          <p className="text-sm font-medium text-text">{t('mcpTrust.confirmLabel')}</p>
+          <p className="mt-0.5 text-xs leading-relaxed text-text-muted">
+            {t('mcpTrust.confirmHelp')}
+          </p>
+        </div>
+        <Switch
+          checked={view.policy.confirmBeforeRun}
+          disabled={busy}
+          onChange={(v) => void setConfirm(v)}
+        />
+      </div>
+    </div>
+  )
+}
+
+function Section({ title, children }: { title: string; children: React.ReactNode }): JSX.Element {
+  return (
+    <div className="flex flex-col gap-1.5">
+      <p className="text-[11px] font-medium uppercase tracking-wide text-text-subtle">{title}</p>
+      <div className="flex flex-col gap-1.5">{children}</div>
+    </div>
+  )
+}
+
+function Row({
+  icon,
+  title,
+  subtitle,
+  busy,
+  onRevoke
+}: {
+  icon: JSX.Element
+  title: string
+  subtitle: string
+  busy: boolean
+  onRevoke: () => void
+}): JSX.Element {
+  const { t } = useTranslation()
+  return (
+    <div className="flex items-center gap-2.5 sq sq-lg sq-ring rounded-lg border border-border bg-surface px-3 py-2">
+      {icon}
+      <div className="min-w-0 flex-1">
+        <p className="truncate text-xs font-medium text-text" title={title}>
+          {title}
+        </p>
+        <p className="truncate text-[11px] text-text-subtle" title={subtitle}>
+          {subtitle}
+        </p>
+      </div>
+      <Button
+        size="sm"
+        variant="ghost"
+        disabled={busy}
+        onClick={onRevoke}
+        title={t('mcpTrust.revoke')}
+      >
+        <Trash2 className="h-3.5 w-3.5" />
+      </Button>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/MessageParts.tsx b/src/renderer/src/components/MessageParts.tsx
index e75a461..47587af 100644
--- a/src/renderer/src/components/MessageParts.tsx
+++ b/src/renderer/src/components/MessageParts.tsx
@@ -120,6 +120,19 @@ export function MessageParts({
               output={part.output}
               image={part.image}
               diff={part.diff}
+              // A server-supplied UI for this result, when the tool declared
+              // one. Absent for every non-MCP tool, so the card renders as
+              // usual.
+              app={
+                part.mcpApp
+                  ? {
+                      serverId: part.mcpApp.serverId,
+                      resourceUri: part.mcpApp.resourceUri,
+                      toolInput: part.input,
+                      toolResult: part.output
+                    }
+                  : undefined
+              }
               onCancel={cancel}
               nested={part.children}
               // A subagent's transcript renders through this same component, so a
diff --git a/src/renderer/src/components/ToolCall.tsx b/src/renderer/src/components/ToolCall.tsx
index 2ab640a..b021ce5 100644
--- a/src/renderer/src/components/ToolCall.tsx
+++ b/src/renderer/src/components/ToolCall.tsx
@@ -24,6 +24,9 @@ import { cn } from '../lib/cn'
 import { TerminalOutput } from './TerminalOutput'
 import { BrailleSpinner } from './ThinkingIndicator'
 
+// Lazy: the app view pulls in the bridge and is only needed by the small
+// minority of tool calls that actually carry a UI.
+const McpAppView = lazy(() => import('./McpAppView').then((m) => ({ default: m.McpAppView })))
 const FileDiffView = lazy(() => import('./FileDiffView'))
 const FileView = lazy(() => import('./FileView'))
 
@@ -174,7 +177,8 @@ export const ToolCall = memo(function ToolCall({
   diff,
   nested: nestedParts,
   renderNested,
-  onCancel
+  onCancel,
+  app
 }: {
   tool: string
   state: 'running' | 'done' | 'error'
@@ -198,6 +202,16 @@ export const ToolCall = memo(function ToolCall({
    * change identity on every delta and defeat this component's memo).
    */
   renderNested?: (parts: MessagePart[], live: boolean) => ReactNode
+  /**
+   * The MCP App this tool declared, if any. Present only for MCP tools whose
+   * `_meta` names a `ui://` resource; every other card ignores it.
+   */
+  app?: {
+    serverId: string
+    resourceUri: string
+    toolInput?: unknown
+    toolResult?: unknown
+  }
 }): JSX.Element {
   const [open, setOpen] = useState(false)
   const Icon = TOOL_ICON[tool] ?? Wrench
@@ -361,6 +375,22 @@ export const ToolCall = memo(function ToolCall({
           {body || (state === 'running' ? 'Running…' : '(no output)')}
         </pre>
       ) : null}
+      {/* A server-supplied UI for this result. Rendered only once the call
+          is done: the view is handed the tool result at initialize, and
+          mounting it mid-flight would show it an answer that does not exist
+          yet. It sits BELOW the text output, which stays as the fallback for
+          anything the view cannot express. */}
+      {app && state === 'done' && (
+        <Suspense fallback={null}>
+          <McpAppView
+            serverId={app.serverId}
+            toolName={tool}
+            resourceUri={app.resourceUri}
+            toolInput={app.toolInput}
+            toolResult={app.toolResult}
+          />
+        </Suspense>
+      )}
       {image && (
         <div className="border-t border-border bg-surface p-2">
           <img
diff --git a/src/renderer/src/locales/ar.json b/src/renderer/src/locales/ar.json
index adbaba3..f6230ec 100644
--- a/src/renderer/src/locales/ar.json
+++ b/src/renderer/src/locales/ar.json
@@ -179,6 +179,8 @@
     "connecting": "جارٍ الاتصال…",
     "editRawJson": "تعديل JSON الخام",
     "emptyState": "لم يتم تكوين أي خوادم MCP. قم بتوصيل خوادم الأدوات الخارجية (نظام الملفات، GitHub، قواعد البيانات، ...) لتوسيع ما يمكن للوكيل القيام به. يتم أيضًا قراءة الخوادم من مساحة عمل <code>.roxy/mcp.json</code>.",
+    "eraModern": "MCP 2026",
+    "eraModernHelp": "This server speaks the 2026-07-28 protocol revision. Older servers connect over the 2025 handshake automatically.",
     "errAddFailed": "فشل في إضافة الخادم.",
     "errCommandRequired": "أدخل أمرًا",
     "errDuplicateName": "يوجد خادم بهذا الاسم بالفعل",
@@ -207,10 +209,85 @@
     "toolCount_other": "{{count}} أدوات",
     "toolsLabel": "الأدوات:"
   },
+  "mcpApp": {
+    "allow": "Allow",
+    "approveNote": "This was requested by the app’s own interface, not by you or the agent. Allowing it lets this app run this tool for as long as it stays open.",
+    "approveSubtitle": "The app from {{server}} wants to run one of that server’s tools.",
+    "approveTitle": "Let this app run a tool?",
+    "boundary": "App from {{server}}",
+    "deny": "Don’t allow",
+    "exitFullscreen": "Exit full screen",
+    "external_one": "Connects to {{count}} external site",
+    "external_other": "Connects to {{count}} external sites",
+    "frameTitle": "Interactive app from {{server}}",
+    "fullscreen": "Expand",
+    "loading": "Loading app…",
+    "rememberNote": "Remembered while this app is open.",
+    "tool": "Tool"
+  },
+  "mcpInstall": {
+    "command": "Command",
+    "done": "Got it",
+    "envVars": "Environment variables",
+    "failedTitle": "{{name}} couldn’t start",
+    "from": "from",
+    "headers": "Headers",
+    "manageNote": "Manage in Settings → MCP",
+    "noTools": "This server didn’t expose any tools.",
+    "project": "Project",
+    "secretsNote": "This server is given a credential. Values are hidden here.",
+    "source": "Source",
+    "title": "{{name}} is connected",
+    "toolsAdded__one": "Added {{count}} tool",
+    "toolsAdded__other": "Added {{count}} tools",
+    "toolsAdded_one": "Added {{count}} tool",
+    "toolsAdded_other": "Added {{count}} tools",
+    "trustSourceLocal": "This is third-party code running on your machine with your access — your files, keys and tokens. Roxy can’t vouch for what it does.",
+    "trustSourceRemote": "Anything you send through these tools goes to a third-party server. Roxy can’t vouch for what it does with it.",
+    "trustSourceTitle": "Trust your source.",
+    "url": "URL"
+  },
   "mcpPage": {
     "subtitle": "قم بتوصيل خوادم أدوات بروتوكول سياق النموذج (MCP) الخارجية (نظام الملفات، GitHub، قواعد البيانات، المتصفحات، ...) لتوسيع ما يمكن لـ Roxy فعله. قم بتحرير JSON الخام لأي خادم باستخدام زر { } لتصحيحه. تُقرأ الخوادم أيضًا من مساحة عمل .roxy/mcp.json، ويمكن للوكيل إضافتها بنفسه باستخدام أداة mcp.",
     "title": "خوادم MCP"
   },
+  "mcpTrust": {
+    "allow": "Allow",
+    "blockedServers": "Blocked servers",
+    "changedTitle": "This MCP server changed",
+    "changedWarning": "This server was approved before, but what it runs has changed. Only continue if you made this change yourself.",
+    "command": "Command",
+    "confirmHelp": "Off by default — installing a server is your decision, so Roxy runs it and tells you what it added. Turn this on to confirm each new server first, which is worth it on a shared machine or in repos you don’t control.",
+    "confirmLabel": "Ask before running a new server",
+    "deny": "Don’t allow",
+    "envVars": "Environment variables",
+    "explainLocal": "This runs a program on your computer with your account’s access — your files, keys and tokens. Only allow it if you recognise the command below.",
+    "explainRemote": "Roxy will connect to this server and expose its tools to the agent. Only allow it if you trust this host.",
+    "headers": "Headers",
+    "knownServers": "Known servers",
+    "noneYet": "Nothing approved yet.",
+    "origin": {
+      "agent": "“{{name}}” was added by the agent, not by you.",
+      "import": "“{{name}}” came from a config file you imported.",
+      "user": "“{{name}}” is configured in your settings.",
+      "workspace": "“{{name}}” is defined by a file in this project."
+    },
+    "panelIntro": "MCP servers can run programs on your machine, so ones that don’t come from your own settings are confirmed with you first. Everything you’ve answered is listed here and can be undone.",
+    "panelTitle": "Approved servers",
+    "previously": "Previously:",
+    "project": "Project",
+    "rememberNote": "Your answer is remembered.",
+    "revoke": "Forget this decision",
+    "scopeAnywhere": "Anywhere",
+    "secretsNote": "This server is given a credential. Values are hidden here.",
+    "title": "Run this MCP server?",
+    "trustWorkspace": "Trust every MCP server in this project",
+    "trustedProjectSub": "Every MCP server in this project runs without asking",
+    "trustedProjects": "Trusted projects",
+    "url": "URL",
+    "workingDir": "Working directory",
+    "workspaceRoot": "(project folder)"
+  },
   "models": {
     "loadFailed": "تعذر تحميل النماذج من models.dev — لا يزال بإمكانك الإرسال بالنموذج الحالي.",
     "loading": "جارٍ تحميل النماذج…",
diff --git a/src/renderer/src/locales/de.json b/src/renderer/src/locales/de.json
index 984979a..33550ed 100644
--- a/src/renderer/src/locales/de.json
+++ b/src/renderer/src/locales/de.json
@@ -179,6 +179,8 @@
     "connecting": "Verbinden…",
     "editRawJson": "Rohes JSON bearbeiten",
     "emptyState": "Keine MCP-Server konfiguriert. Verbinden Sie externe Tool-Server (Dateisystem, GitHub, Datenbanken, …), um die Möglichkeiten des Agenten zu erweitern. Server werden auch aus einer Workspace-Datei <code>.roxy/mcp.json</code> gelesen.",
+    "eraModern": "MCP 2026",
+    "eraModernHelp": "This server speaks the 2026-07-28 protocol revision. Older servers connect over the 2025 handshake automatically.",
     "errAddFailed": "Fehler beim Hinzufügen des Servers.",
     "errCommandRequired": "Befehl eingeben",
     "errDuplicateName": "Ein Server mit diesem Namen existiert bereits",
@@ -207,10 +209,85 @@
     "toolCount_other": "{{count}} Tools",
     "toolsLabel": "Tools:"
   },
+  "mcpApp": {
+    "allow": "Allow",
+    "approveNote": "This was requested by the app’s own interface, not by you or the agent. Allowing it lets this app run this tool for as long as it stays open.",
+    "approveSubtitle": "The app from {{server}} wants to run one of that server’s tools.",
+    "approveTitle": "Let this app run a tool?",
+    "boundary": "App from {{server}}",
+    "deny": "Don’t allow",
+    "exitFullscreen": "Exit full screen",
+    "external_one": "Connects to {{count}} external site",
+    "external_other": "Connects to {{count}} external sites",
+    "frameTitle": "Interactive app from {{server}}",
+    "fullscreen": "Expand",
+    "loading": "Loading app…",
+    "rememberNote": "Remembered while this app is open.",
+    "tool": "Tool"
+  },
+  "mcpInstall": {
+    "command": "Command",
+    "done": "Got it",
+    "envVars": "Environment variables",
+    "failedTitle": "{{name}} couldn’t start",
+    "from": "from",
+    "headers": "Headers",
+    "manageNote": "Manage in Settings → MCP",
+    "noTools": "This server didn’t expose any tools.",
+    "project": "Project",
+    "secretsNote": "This server is given a credential. Values are hidden here.",
+    "source": "Source",
+    "title": "{{name}} is connected",
+    "toolsAdded__one": "Added {{count}} tool",
+    "toolsAdded__other": "Added {{count}} tools",
+    "toolsAdded_one": "Added {{count}} tool",
+    "toolsAdded_other": "Added {{count}} tools",
+    "trustSourceLocal": "This is third-party code running on your machine with your access — your files, keys and tokens. Roxy can’t vouch for what it does.",
+    "trustSourceRemote": "Anything you send through these tools goes to a third-party server. Roxy can’t vouch for what it does with it.",
+    "trustSourceTitle": "Trust your source.",
+    "url": "URL"
+  },
   "mcpPage": {
     "subtitle": "Verbinden Sie externe Model Context Protocol Tool-Server (Dateisystem, GitHub, Datenbanken, Browser, …), um die Funktionen von Roxy zu erweitern. Bearbeiten Sie die rohe JSON-Konfiguration eines Servers mit der Schaltfläche { }, um ihn zu debuggen. Server werden auch aus einer .roxy/mcp.json im Arbeitsbereich gelesen, und der Agent kann sie selbst mit dem mcp-Tool hinzufügen.",
     "title": "MCP-Server"
   },
+  "mcpTrust": {
+    "allow": "Allow",
+    "blockedServers": "Blocked servers",
+    "changedTitle": "This MCP server changed",
+    "changedWarning": "This server was approved before, but what it runs has changed. Only continue if you made this change yourself.",
+    "command": "Command",
+    "confirmHelp": "Off by default — installing a server is your decision, so Roxy runs it and tells you what it added. Turn this on to confirm each new server first, which is worth it on a shared machine or in repos you don’t control.",
+    "confirmLabel": "Ask before running a new server",
+    "deny": "Don’t allow",
+    "envVars": "Environment variables",
+    "explainLocal": "This runs a program on your computer with your account’s access — your files, keys and tokens. Only allow it if you recognise the command below.",
+    "explainRemote": "Roxy will connect to this server and expose its tools to the agent. Only allow it if you trust this host.",
+    "headers": "Headers",
+    "knownServers": "Known servers",
+    "noneYet": "Nothing approved yet.",
+    "origin": {
+      "agent": "“{{name}}” was added by the agent, not by you.",
+      "import": "“{{name}}” came from a config file you imported.",
+      "user": "“{{name}}” is configured in your settings.",
+      "workspace": "“{{name}}” is defined by a file in this project."
+    },
+    "panelIntro": "MCP servers can run programs on your machine, so ones that don’t come from your own settings are confirmed with you first. Everything you’ve answered is listed here and can be undone.",
+    "panelTitle": "Approved servers",
+    "previously": "Previously:",
+    "project": "Project",
+    "rememberNote": "Your answer is remembered.",
+    "revoke": "Forget this decision",
+    "scopeAnywhere": "Anywhere",
+    "secretsNote": "This server is given a credential. Values are hidden here.",
+    "title": "Run this MCP server?",
+    "trustWorkspace": "Trust every MCP server in this project",
+    "trustedProjectSub": "Every MCP server in this project runs without asking",
+    "trustedProjects": "Trusted projects",
+    "url": "URL",
+    "workingDir": "Working directory",
+    "workspaceRoot": "(project folder)"
+  },
   "models": {
     "loadFailed": "Modelle konnten nicht von models.dev geladen werden – Sie können weiterhin mit dem aktuellen Modell senden.",
     "loading": "Modelle werden geladen…",
diff --git a/src/renderer/src/locales/default.json b/src/renderer/src/locales/default.json
index a71a5d8..a214c35 100644
--- a/src/renderer/src/locales/default.json
+++ b/src/renderer/src/locales/default.json
@@ -205,12 +205,89 @@
     "noToolsExposed": "(none exposed)",
     "saving": "Saving…",
     "saveAndReconnect": "Save & reconnect",
-    "reset": "Reset"
+    "reset": "Reset",
+    "eraModern": "MCP 2026",
+    "eraModernHelp": "This server speaks the 2026-07-28 protocol revision. Older servers connect over the 2025 handshake automatically."
+  },
+  "mcpApp": {
+    "loading": "Loading app…",
+    "boundary": "App from {{server}}",
+    "external_one": "Connects to {{count}} external site",
+    "external_other": "Connects to {{count}} external sites",
+    "fullscreen": "Expand",
+    "exitFullscreen": "Exit full screen",
+    "frameTitle": "Interactive app from {{server}}",
+    "approveTitle": "Let this app run a tool?",
+    "approveSubtitle": "The app from {{server}} wants to run one of that server’s tools.",
+    "tool": "Tool",
+    "approveNote": "This was requested by the app’s own interface, not by you or the agent. Allowing it lets this app run this tool for as long as it stays open.",
+    "allow": "Allow",
+    "deny": "Don’t allow",
+    "rememberNote": "Remembered while this app is open."
+  },
+  "mcpInstall": {
+    "title": "{{name}} is connected",
+    "failedTitle": "{{name}} couldn’t start",
+    "from": "from",
+    "toolsAdded__one": "Added {{count}} tool",
+    "toolsAdded__other": "Added {{count}} tools",
+    "noTools": "This server didn’t expose any tools.",
+    "source": "Source",
+    "command": "Command",
+    "url": "URL",
+    "envVars": "Environment variables",
+    "headers": "Headers",
+    "secretsNote": "This server is given a credential. Values are hidden here.",
+    "project": "Project",
+    "trustSourceTitle": "Trust your source.",
+    "trustSourceLocal": "This is third-party code running on your machine with your access — your files, keys and tokens. Roxy can’t vouch for what it does.",
+    "trustSourceRemote": "Anything you send through these tools goes to a third-party server. Roxy can’t vouch for what it does with it.",
+    "done": "Got it",
+    "manageNote": "Manage in Settings → MCP",
+    "toolsAdded_one": "Added {{count}} tool",
+    "toolsAdded_other": "Added {{count}} tools"
   },
   "mcpPage": {
     "title": "MCP Servers",
     "subtitle": "Connect external Model Context Protocol tool servers (filesystem, GitHub, databases, browsers, …) to expand what Roxy can do. Edit any server’s raw JSON with the { } button to debug it. Servers are also read from a workspace .roxy/mcp.json, and the agent can add them itself with the mcp tool."
   },
+  "mcpTrust": {
+    "title": "Run this MCP server?",
+    "changedTitle": "This MCP server changed",
+    "origin": {
+      "workspace": "“{{name}}” is defined by a file in this project.",
+      "agent": "“{{name}}” was added by the agent.",
+      "import": "“{{name}}” came from a config file you imported.",
+      "user": "“{{name}}” is configured in your settings."
+    },
+    "changedWarning": "This server used to run something else. Only continue if you made this change yourself.",
+    "previously": "Previously:",
+    "explainLocal": "This runs a program on your computer with your account’s access — your files, keys and tokens.",
+    "explainRemote": "Roxy will connect to this server and expose its tools to the agent. Anything you send through them leaves your machine.",
+    "command": "Command",
+    "workingDir": "Working directory",
+    "workspaceRoot": "(project folder)",
+    "url": "URL",
+    "envVars": "Environment variables",
+    "headers": "Headers",
+    "secretsNote": "This server is given a credential. Values are hidden here.",
+    "project": "Project",
+    "allow": "Run it",
+    "deny": "Don’t run it",
+    "rememberNote": "Your answer is remembered.",
+    "trustWorkspace": "Trust every MCP server in this project",
+    "panelTitle": "Servers Roxy has run",
+    "panelIntro": "MCP servers you install run when you use them, and Roxy shows you what tools each one added. This is the record — remove anything here and Roxy will treat it as new next time.",
+    "trustedProjects": "Trusted projects",
+    "trustedProjectSub": "Every MCP server in this project runs without a notice",
+    "knownServers": "Known servers",
+    "blockedServers": "Blocked servers",
+    "scopeAnywhere": "Anywhere",
+    "noneYet": "No MCP servers have run yet.",
+    "revoke": "Forget this server",
+    "confirmLabel": "Ask before running a new server",
+    "confirmHelp": "Off by default — installing a server is your decision, so Roxy runs it and tells you what it added. Turn this on to confirm each new server first, which is worth it on a shared machine or in repos you don’t control."
+  },
   "models": {
     "selectModel": "Select a model",
     "noProvider": "No provider connected",
diff --git a/src/renderer/src/locales/es.json b/src/renderer/src/locales/es.json
index 5679f29..f5176ec 100644
--- a/src/renderer/src/locales/es.json
+++ b/src/renderer/src/locales/es.json
@@ -179,6 +179,8 @@
     "connecting": "Conectando…",
     "editRawJson": "Editar el JSON directamente",
     "emptyState": "No hay ningún servidor MCP configurado. Conecta servidores de herramientas externos (sistema de archivos, GitHub, bases de datos, …) para ampliar lo que puede hacer el agente. También se leen los servidores del archivo <code>.roxy/mcp.json</code> del espacio de trabajo.",
+    "eraModern": "MCP 2026",
+    "eraModernHelp": "This server speaks the 2026-07-28 protocol revision. Older servers connect over the 2025 handshake automatically.",
     "errAddFailed": "No se pudo añadir el servidor.",
     "errCommandRequired": "Escribe un comando",
     "errDuplicateName": "Ya existe un servidor con ese nombre",
@@ -207,10 +209,85 @@
     "toolCount_other": "{{count}} herramientas",
     "toolsLabel": "Herramientas:"
   },
+  "mcpApp": {
+    "allow": "Allow",
+    "approveNote": "This was requested by the app’s own interface, not by you or the agent. Allowing it lets this app run this tool for as long as it stays open.",
+    "approveSubtitle": "The app from {{server}} wants to run one of that server’s tools.",
+    "approveTitle": "Let this app run a tool?",
+    "boundary": "App from {{server}}",
+    "deny": "Don’t allow",
+    "exitFullscreen": "Exit full screen",
+    "external_one": "Connects to {{count}} external site",
+    "external_other": "Connects to {{count}} external sites",
+    "frameTitle": "Interactive app from {{server}}",
+    "fullscreen": "Expand",
+    "loading": "Loading app…",
+    "rememberNote": "Remembered while this app is open.",
+    "tool": "Tool"
+  },
+  "mcpInstall": {
+    "command": "Command",
+    "done": "Got it",
+    "envVars": "Environment variables",
+    "failedTitle": "{{name}} couldn’t start",
+    "from": "from",
+    "headers": "Headers",
+    "manageNote": "Manage in Settings → MCP",
+    "noTools": "This server didn’t expose any tools.",
+    "project": "Project",
+    "secretsNote": "This server is given a credential. Values are hidden here.",
+    "source": "Source",
+    "title": "{{name}} is connected",
+    "toolsAdded__one": "Added {{count}} tool",
+    "toolsAdded__other": "Added {{count}} tools",
+    "toolsAdded_one": "Added {{count}} tool",
+    "toolsAdded_other": "Added {{count}} tools",
+    "trustSourceLocal": "This is third-party code running on your machine with your access — your files, keys and tokens. Roxy can’t vouch for what it does.",
+    "trustSourceRemote": "Anything you send through these tools goes to a third-party server. Roxy can’t vouch for what it does with it.",
+    "trustSourceTitle": "Trust your source.",
+    "url": "URL"
+  },
   "mcpPage": {
     "subtitle": "Conecta servidores de herramientas externos con Model Context Protocol (sistema de archivos, GitHub, bases de datos, navegadores…) para ampliar lo que Roxy puede hacer. Edita el JSON de cualquier servidor con el botón { } para depurarlo. Los servidores también se leen del archivo .roxy/mcp.json del espacio de trabajo, y el agente puede añadirlos él mismo con la herramienta mcp.",
     "title": "Servidores MCP"
   },
+  "mcpTrust": {
+    "allow": "Allow",
+    "blockedServers": "Blocked servers",
+    "changedTitle": "This MCP server changed",
+    "changedWarning": "This server was approved before, but what it runs has changed. Only continue if you made this change yourself.",
+    "command": "Command",
+    "confirmHelp": "Off by default — installing a server is your decision, so Roxy runs it and tells you what it added. Turn this on to confirm each new server first, which is worth it on a shared machine or in repos you don’t control.",
+    "confirmLabel": "Ask before running a new server",
+    "deny": "Don’t allow",
+    "envVars": "Environment variables",
+    "explainLocal": "This runs a program on your computer with your account’s access — your files, keys and tokens. Only allow it if you recognise the command below.",
+    "explainRemote": "Roxy will connect to this server and expose its tools to the agent. Only allow it if you trust this host.",
+    "headers": "Headers",
+    "knownServers": "Known servers",
+    "noneYet": "Nothing approved yet.",
+    "origin": {
+      "agent": "“{{name}}” was added by the agent, not by you.",
+      "import": "“{{name}}” came from a config file you imported.",
+      "user": "“{{name}}” is configured in your settings.",
+      "workspace": "“{{name}}” is defined by a file in this project."
+    },
+    "panelIntro": "MCP servers can run programs on your machine, so ones that don’t come from your own settings are confirmed with you first. Everything you’ve answered is listed here and can be undone.",
+    "panelTitle": "Approved servers",
+    "previously": "Previously:",
+    "project": "Project",
+    "rememberNote": "Your answer is remembered.",
+    "revoke": "Forget this decision",
+    "scopeAnywhere": "Anywhere",
+    "secretsNote": "This server is given a credential. Values are hidden here.",
+    "title": "Run this MCP server?",
+    "trustWorkspace": "Trust every MCP server in this project",
+    "trustedProjectSub": "Every MCP server in this project runs without asking",
+    "trustedProjects": "Trusted projects",
+    "url": "URL",
+    "workingDir": "Working directory",
+    "workspaceRoot": "(project folder)"
+  },
   "models": {
     "loadFailed": "No se pudieron cargar los modelos de models.dev; aún puedes enviar con el modelo actual.",
     "loading": "Cargando los modelos…",
diff --git a/src/renderer/src/locales/fr.json b/src/renderer/src/locales/fr.json
index 62466da..9df855d 100644
--- a/src/renderer/src/locales/fr.json
+++ b/src/renderer/src/locales/fr.json
@@ -179,6 +179,8 @@
     "connecting": "Connexion…",
     "editRawJson": "Modifier le JSON brut",
     "emptyState": "Aucun serveur MCP configuré. Connectez des serveurs d'outils externes (système de fichiers, GitHub, bases de données, …) pour étendre les capacités de l'agent. Les serveurs sont également lus depuis un espace de travail <code>.roxy/mcp.json</code>.",
+    "eraModern": "MCP 2026",
+    "eraModernHelp": "This server speaks the 2026-07-28 protocol revision. Older servers connect over the 2025 handshake automatically.",
     "errAddFailed": "Échec de l'ajout du serveur.",
     "errCommandRequired": "Saisissez une commande",
     "errDuplicateName": "Un serveur avec ce nom existe déjà",
@@ -207,10 +209,85 @@
     "toolCount_other": "{{count}} outils",
     "toolsLabel": "Outils :"
   },
+  "mcpApp": {
+    "allow": "Allow",
+    "approveNote": "This was requested by the app’s own interface, not by you or the agent. Allowing it lets this app run this tool for as long as it stays open.",
+    "approveSubtitle": "The app from {{server}} wants to run one of that server’s tools.",
+    "approveTitle": "Let this app run a tool?",
+    "boundary": "App from {{server}}",
+    "deny": "Don’t allow",
+    "exitFullscreen": "Exit full screen",
+    "external_one": "Connects to {{count}} external site",
+    "external_other": "Connects to {{count}} external sites",
+    "frameTitle": "Interactive app from {{server}}",
+    "fullscreen": "Expand",
+    "loading": "Loading app…",
+    "rememberNote": "Remembered while this app is open.",
+    "tool": "Tool"
+  },
+  "mcpInstall": {
+    "command": "Command",
+    "done": "Got it",
+    "envVars": "Environment variables",
+    "failedTitle": "{{name}} couldn’t start",
+    "from": "from",
+    "headers": "Headers",
+    "manageNote": "Manage in Settings → MCP",
+    "noTools": "This server didn’t expose any tools.",
+    "project": "Project",
+    "secretsNote": "This server is given a credential. Values are hidden here.",
+    "source": "Source",
+    "title": "{{name}} is connected",
+    "toolsAdded__one": "Added {{count}} tool",
+    "toolsAdded__other": "Added {{count}} tools",
+    "toolsAdded_one": "Added {{count}} tool",
+    "toolsAdded_other": "Added {{count}} tools",
+    "trustSourceLocal": "This is third-party code running on your machine with your access — your files, keys and tokens. Roxy can’t vouch for what it does.",
+    "trustSourceRemote": "Anything you send through these tools goes to a third-party server. Roxy can’t vouch for what it does with it.",
+    "trustSourceTitle": "Trust your source.",
+    "url": "URL"
+  },
   "mcpPage": {
     "subtitle": "Connectez des serveurs d'outils externes Model Context Protocol (système de fichiers, GitHub, bases de données, navigateurs, …) pour étendre les capacités de Roxy. Modifiez le JSON brut de n'importe quel serveur avec le bouton { } pour le déboguer. Les serveurs sont également lus à partir d'un fichier .roxy/mcp.json de l'espace de travail, et l'agent peut les ajouter lui-même avec l'outil mcp.",
     "title": "Serveurs MCP"
   },
+  "mcpTrust": {
+    "allow": "Allow",
+    "blockedServers": "Blocked servers",
+    "changedTitle": "This MCP server changed",
+    "changedWarning": "This server was approved before, but what it runs has changed. Only continue if you made this change yourself.",
+    "command": "Command",
+    "confirmHelp": "Off by default — installing a server is your decision, so Roxy runs it and tells you what it added. Turn this on to confirm each new server first, which is worth it on a shared machine or in repos you don’t control.",
+    "confirmLabel": "Ask before running a new server",
+    "deny": "Don’t allow",
+    "envVars": "Environment variables",
+    "explainLocal": "This runs a program on your computer with your account’s access — your files, keys and tokens. Only allow it if you recognise the command below.",
+    "explainRemote": "Roxy will connect to this server and expose its tools to the agent. Only allow it if you trust this host.",
+    "headers": "Headers",
+    "knownServers": "Known servers",
+    "noneYet": "Nothing approved yet.",
+    "origin": {
+      "agent": "“{{name}}” was added by the agent, not by you.",
+      "import": "“{{name}}” came from a config file you imported.",
+      "user": "“{{name}}” is configured in your settings.",
+      "workspace": "“{{name}}” is defined by a file in this project."
+    },
+    "panelIntro": "MCP servers can run programs on your machine, so ones that don’t come from your own settings are confirmed with you first. Everything you’ve answered is listed here and can be undone.",
+    "panelTitle": "Approved servers",
+    "previously": "Previously:",
+    "project": "Project",
+    "rememberNote": "Your answer is remembered.",
+    "revoke": "Forget this decision",
+    "scopeAnywhere": "Anywhere",
+    "secretsNote": "This server is given a credential. Values are hidden here.",
+    "title": "Run this MCP server?",
+    "trustWorkspace": "Trust every MCP server in this project",
+    "trustedProjectSub": "Every MCP server in this project runs without asking",
+    "trustedProjects": "Trusted projects",
+    "url": "URL",
+    "workingDir": "Working directory",
+    "workspaceRoot": "(project folder)"
+  },
   "models": {
     "loadFailed": "Impossible de charger les modèles depuis models.dev — vous pouvez toujours envoyer avec le modèle actuel.",
     "loading": "Chargement des modèles…",
diff --git a/src/renderer/src/locales/hi.json b/src/renderer/src/locales/hi.json
index 0cdd665..ec2aff3 100644
--- a/src/renderer/src/locales/hi.json
+++ b/src/renderer/src/locales/hi.json
@@ -179,6 +179,8 @@
     "connecting": "कनेक्ट हो रहा है…",
     "editRawJson": "कच्चा JSON संपादित करें",
     "emptyState": "कोई MCP सर्वर कॉन्फ़िगर नहीं किया गया है। एजेंट क्या कर सकता है, इसका विस्तार करने के लिए बाहरी टूल सर्वर (फ़ाइल सिस्टम, GitHub, डेटाबेस, ...) कनेक्ट करें। सर्वर एक कार्यक्षेत्र <code>.roxy/mcp.json</code> से भी पढ़े जाते हैं।",
+    "eraModern": "MCP 2026",
+    "eraModernHelp": "This server speaks the 2026-07-28 protocol revision. Older servers connect over the 2025 handshake automatically.",
     "errAddFailed": "सर्वर जोड़ने में विफल रहा।",
     "errCommandRequired": "एक कमांड दर्ज करें",
     "errDuplicateName": "उस नाम का एक सर्वर पहले से मौजूद है",
@@ -207,10 +209,85 @@
     "toolCount_other": "{{count}} टूल",
     "toolsLabel": "उपकरण:"
   },
+  "mcpApp": {
+    "allow": "Allow",
+    "approveNote": "This was requested by the app’s own interface, not by you or the agent. Allowing it lets this app run this tool for as long as it stays open.",
+    "approveSubtitle": "The app from {{server}} wants to run one of that server’s tools.",
+    "approveTitle": "Let this app run a tool?",
+    "boundary": "App from {{server}}",
+    "deny": "Don’t allow",
+    "exitFullscreen": "Exit full screen",
+    "external_one": "Connects to {{count}} external site",
+    "external_other": "Connects to {{count}} external sites",
+    "frameTitle": "Interactive app from {{server}}",
+    "fullscreen": "Expand",
+    "loading": "Loading app…",
+    "rememberNote": "Remembered while this app is open.",
+    "tool": "Tool"
+  },
+  "mcpInstall": {
+    "command": "Command",
+    "done": "Got it",
+    "envVars": "Environment variables",
+    "failedTitle": "{{name}} couldn’t start",
+    "from": "from",
+    "headers": "Headers",
+    "manageNote": "Manage in Settings → MCP",
+    "noTools": "This server didn’t expose any tools.",
+    "project": "Project",
+    "secretsNote": "This server is given a credential. Values are hidden here.",
+    "source": "Source",
+    "title": "{{name}} is connected",
+    "toolsAdded__one": "Added {{count}} tool",
+    "toolsAdded__other": "Added {{count}} tools",
+    "toolsAdded_one": "Added {{count}} tool",
+    "toolsAdded_other": "Added {{count}} tools",
+    "trustSourceLocal": "This is third-party code running on your machine with your access — your files, keys and tokens. Roxy can’t vouch for what it does.",
+    "trustSourceRemote": "Anything you send through these tools goes to a third-party server. Roxy can’t vouch for what it does with it.",
+    "trustSourceTitle": "Trust your source.",
+    "url": "URL"
+  },
   "mcpPage": {
     "subtitle": "Roxy क्या कर सकती है, इसका विस्तार करने के लिए बाहरी मॉडल कॉन्टेक्स्ट प्रोटोकॉल टूल सर्वर (फाइलसिस्टम, GitHub, डेटाबेस, ब्राउज़र, …) कनेक्ट करें। किसी भी सर्वर के रॉ JSON को { } बटन से डीबग करने के लिए संपादित करें। सर्वर एक वर्कस्पेस .roxy/mcp.json से भी पढ़े जाते हैं, और एजेंट उन्हें mcp टूल के साथ स्वयं जोड़ सकता है।",
     "title": "MCP सर्वर"
   },
+  "mcpTrust": {
+    "allow": "Allow",
+    "blockedServers": "Blocked servers",
+    "changedTitle": "This MCP server changed",
+    "changedWarning": "This server was approved before, but what it runs has changed. Only continue if you made this change yourself.",
+    "command": "Command",
+    "confirmHelp": "Off by default — installing a server is your decision, so Roxy runs it and tells you what it added. Turn this on to confirm each new server first, which is worth it on a shared machine or in repos you don’t control.",
+    "confirmLabel": "Ask before running a new server",
+    "deny": "Don’t allow",
+    "envVars": "Environment variables",
+    "explainLocal": "This runs a program on your computer with your account’s access — your files, keys and tokens. Only allow it if you recognise the command below.",
+    "explainRemote": "Roxy will connect to this server and expose its tools to the agent. Only allow it if you trust this host.",
+    "headers": "Headers",
+    "knownServers": "Known servers",
+    "noneYet": "Nothing approved yet.",
+    "origin": {
+      "agent": "“{{name}}” was added by the agent, not by you.",
+      "import": "“{{name}}” came from a config file you imported.",
+      "user": "“{{name}}” is configured in your settings.",
+      "workspace": "“{{name}}” is defined by a file in this project."
+    },
+    "panelIntro": "MCP servers can run programs on your machine, so ones that don’t come from your own settings are confirmed with you first. Everything you’ve answered is listed here and can be undone.",
+    "panelTitle": "Approved servers",
+    "previously": "Previously:",
+    "project": "Project",
+    "rememberNote": "Your answer is remembered.",
+    "revoke": "Forget this decision",
+    "scopeAnywhere": "Anywhere",
+    "secretsNote": "This server is given a credential. Values are hidden here.",
+    "title": "Run this MCP server?",
+    "trustWorkspace": "Trust every MCP server in this project",
+    "trustedProjectSub": "Every MCP server in this project runs without asking",
+    "trustedProjects": "Trusted projects",
+    "url": "URL",
+    "workingDir": "Working directory",
+    "workspaceRoot": "(project folder)"
+  },
   "models": {
     "loadFailed": "models.dev से मॉडल लोड नहीं हो सके — आप अभी भी वर्तमान मॉडल के साथ भेज सकते हैं।",
     "loading": "मॉडल लोड हो रहे हैं…",
diff --git a/src/renderer/src/locales/ja.json b/src/renderer/src/locales/ja.json
index 61e0db0..929c1f5 100644
--- a/src/renderer/src/locales/ja.json
+++ b/src/renderer/src/locales/ja.json
@@ -179,6 +179,8 @@
     "connecting": "接続中…",
     "editRawJson": "生のJSONを編集",
     "emptyState": "MCPサーバーが設定されていません。エージェントができることを拡張するために、外部ツールサーバー（ファイルシステム、GitHub、データベースなど）を接続してください。サーバーはワークスペースの<code>.roxy/mcp.json</code>からも読み込まれます。",
+    "eraModern": "MCP 2026",
+    "eraModernHelp": "This server speaks the 2026-07-28 protocol revision. Older servers connect over the 2025 handshake automatically.",
     "errAddFailed": "サーバーの追加に失敗しました。",
     "errCommandRequired": "コマンドを入力してください",
     "errDuplicateName": "その名前のサーバーはすでに存在します",
@@ -207,10 +209,85 @@
     "toolCount_other": "{{count}} ツール",
     "toolsLabel": "ツール:"
   },
+  "mcpApp": {
+    "allow": "Allow",
+    "approveNote": "This was requested by the app’s own interface, not by you or the agent. Allowing it lets this app run this tool for as long as it stays open.",
+    "approveSubtitle": "The app from {{server}} wants to run one of that server’s tools.",
+    "approveTitle": "Let this app run a tool?",
+    "boundary": "App from {{server}}",
+    "deny": "Don’t allow",
+    "exitFullscreen": "Exit full screen",
+    "external_one": "Connects to {{count}} external site",
+    "external_other": "Connects to {{count}} external sites",
+    "frameTitle": "Interactive app from {{server}}",
+    "fullscreen": "Expand",
+    "loading": "Loading app…",
+    "rememberNote": "Remembered while this app is open.",
+    "tool": "Tool"
+  },
+  "mcpInstall": {
+    "command": "Command",
+    "done": "Got it",
+    "envVars": "Environment variables",
+    "failedTitle": "{{name}} couldn’t start",
+    "from": "from",
+    "headers": "Headers",
+    "manageNote": "Manage in Settings → MCP",
+    "noTools": "This server didn’t expose any tools.",
+    "project": "Project",
+    "secretsNote": "This server is given a credential. Values are hidden here.",
+    "source": "Source",
+    "title": "{{name}} is connected",
+    "toolsAdded__one": "Added {{count}} tool",
+    "toolsAdded__other": "Added {{count}} tools",
+    "toolsAdded_one": "Added {{count}} tool",
+    "toolsAdded_other": "Added {{count}} tools",
+    "trustSourceLocal": "This is third-party code running on your machine with your access — your files, keys and tokens. Roxy can’t vouch for what it does.",
+    "trustSourceRemote": "Anything you send through these tools goes to a third-party server. Roxy can’t vouch for what it does with it.",
+    "trustSourceTitle": "Trust your source.",
+    "url": "URL"
+  },
   "mcpPage": {
     "subtitle": "外部のモデルコンテキストプロトコルツールサーバー (ファイルシステム、GitHub、データベース、ブラウザなど) を接続して、Roxy の機能を拡張します。{ } ボタンで各サーバーの生の JSON を編集してデバッグできます。サーバーはワークスペースの .roxy/mcp.json からも読み込まれ、エージェントは mcp ツールを使用してそれらを自身で追加できます。",
     "title": "MCP サーバー"
   },
+  "mcpTrust": {
+    "allow": "Allow",
+    "blockedServers": "Blocked servers",
+    "changedTitle": "This MCP server changed",
+    "changedWarning": "This server was approved before, but what it runs has changed. Only continue if you made this change yourself.",
+    "command": "Command",
+    "confirmHelp": "Off by default — installing a server is your decision, so Roxy runs it and tells you what it added. Turn this on to confirm each new server first, which is worth it on a shared machine or in repos you don’t control.",
+    "confirmLabel": "Ask before running a new server",
+    "deny": "Don’t allow",
+    "envVars": "Environment variables",
+    "explainLocal": "This runs a program on your computer with your account’s access — your files, keys and tokens. Only allow it if you recognise the command below.",
+    "explainRemote": "Roxy will connect to this server and expose its tools to the agent. Only allow it if you trust this host.",
+    "headers": "Headers",
+    "knownServers": "Known servers",
+    "noneYet": "Nothing approved yet.",
+    "origin": {
+      "agent": "“{{name}}” was added by the agent, not by you.",
+      "import": "“{{name}}” came from a config file you imported.",
+      "user": "“{{name}}” is configured in your settings.",
+      "workspace": "“{{name}}” is defined by a file in this project."
+    },
+    "panelIntro": "MCP servers can run programs on your machine, so ones that don’t come from your own settings are confirmed with you first. Everything you’ve answered is listed here and can be undone.",
+    "panelTitle": "Approved servers",
+    "previously": "Previously:",
+    "project": "Project",
+    "rememberNote": "Your answer is remembered.",
+    "revoke": "Forget this decision",
+    "scopeAnywhere": "Anywhere",
+    "secretsNote": "This server is given a credential. Values are hidden here.",
+    "title": "Run this MCP server?",
+    "trustWorkspace": "Trust every MCP server in this project",
+    "trustedProjectSub": "Every MCP server in this project runs without asking",
+    "trustedProjects": "Trusted projects",
+    "url": "URL",
+    "workingDir": "Working directory",
+    "workspaceRoot": "(project folder)"
+  },
   "models": {
     "loadFailed": "models.dev からモデルを読み込めませんでした — 現在のモデルで送信することはできます。",
     "loading": "モデルを読み込み中…",
diff --git a/src/renderer/src/locales/pt.json b/src/renderer/src/locales/pt.json
index e52c77d..fe3dac0 100644
--- a/src/renderer/src/locales/pt.json
+++ b/src/renderer/src/locales/pt.json
@@ -179,6 +179,8 @@
     "connecting": "Conectando…",
     "editRawJson": "Editar JSON bruto",
     "emptyState": "Nenhum servidor MCP configurado. Conecte servidores de ferramentas externas (sistema de arquivos, GitHub, bancos de dados, …) para expandir o que o agente pode fazer. Os servidores também são lidos de um workspace <code>.roxy/mcp.json</code>.",
+    "eraModern": "MCP 2026",
+    "eraModernHelp": "This server speaks the 2026-07-28 protocol revision. Older servers connect over the 2025 handshake automatically.",
     "errAddFailed": "Falha ao adicionar o servidor.",
     "errCommandRequired": "Insira um comando",
     "errDuplicateName": "Já existe um servidor com esse nome",
@@ -207,10 +209,85 @@
     "toolCount_other": "{{count}} ferramentas",
     "toolsLabel": "Ferramentas:"
   },
+  "mcpApp": {
+    "allow": "Allow",
+    "approveNote": "This was requested by the app’s own interface, not by you or the agent. Allowing it lets this app run this tool for as long as it stays open.",
+    "approveSubtitle": "The app from {{server}} wants to run one of that server’s tools.",
+    "approveTitle": "Let this app run a tool?",
+    "boundary": "App from {{server}}",
+    "deny": "Don’t allow",
+    "exitFullscreen": "Exit full screen",
+    "external_one": "Connects to {{count}} external site",
+    "external_other": "Connects to {{count}} external sites",
+    "frameTitle": "Interactive app from {{server}}",
+    "fullscreen": "Expand",
+    "loading": "Loading app…",
+    "rememberNote": "Remembered while this app is open.",
+    "tool": "Tool"
+  },
+  "mcpInstall": {
+    "command": "Command",
+    "done": "Got it",
+    "envVars": "Environment variables",
+    "failedTitle": "{{name}} couldn’t start",
+    "from": "from",
+    "headers": "Headers",
+    "manageNote": "Manage in Settings → MCP",
+    "noTools": "This server didn’t expose any tools.",
+    "project": "Project",
+    "secretsNote": "This server is given a credential. Values are hidden here.",
+    "source": "Source",
+    "title": "{{name}} is connected",
+    "toolsAdded__one": "Added {{count}} tool",
+    "toolsAdded__other": "Added {{count}} tools",
+    "toolsAdded_one": "Added {{count}} tool",
+    "toolsAdded_other": "Added {{count}} tools",
+    "trustSourceLocal": "This is third-party code running on your machine with your access — your files, keys and tokens. Roxy can’t vouch for what it does.",
+    "trustSourceRemote": "Anything you send through these tools goes to a third-party server. Roxy can’t vouch for what it does with it.",
+    "trustSourceTitle": "Trust your source.",
+    "url": "URL"
+  },
   "mcpPage": {
     "subtitle": "Conecte servidores de ferramentas externas do Protocolo de Contexto de Modelo (MCP) (sistema de arquivos, GitHub, bancos de dados, navegadores, …) para expandir o que Roxy pode fazer. Edite o JSON bruto de qualquer servidor com o botão { } para depurá-lo. Os servidores também são lidos de um workspace .roxy/mcp.json, e o agente pode adicioná-los ele mesmo com a ferramenta mcp.",
     "title": "Servidores MCP"
   },
+  "mcpTrust": {
+    "allow": "Allow",
+    "blockedServers": "Blocked servers",
+    "changedTitle": "This MCP server changed",
+    "changedWarning": "This server was approved before, but what it runs has changed. Only continue if you made this change yourself.",
+    "command": "Command",
+    "confirmHelp": "Off by default — installing a server is your decision, so Roxy runs it and tells you what it added. Turn this on to confirm each new server first, which is worth it on a shared machine or in repos you don’t control.",
+    "confirmLabel": "Ask before running a new server",
+    "deny": "Don’t allow",
+    "envVars": "Environment variables",
+    "explainLocal": "This runs a program on your computer with your account’s access — your files, keys and tokens. Only allow it if you recognise the command below.",
+    "explainRemote": "Roxy will connect to this server and expose its tools to the agent. Only allow it if you trust this host.",
+    "headers": "Headers",
+    "knownServers": "Known servers",
+    "noneYet": "Nothing approved yet.",
+    "origin": {
+      "agent": "“{{name}}” was added by the agent, not by you.",
+      "import": "“{{name}}” came from a config file you imported.",
+      "user": "“{{name}}” is configured in your settings.",
+      "workspace": "“{{name}}” is defined by a file in this project."
+    },
+    "panelIntro": "MCP servers can run programs on your machine, so ones that don’t come from your own settings are confirmed with you first. Everything you’ve answered is listed here and can be undone.",
+    "panelTitle": "Approved servers",
+    "previously": "Previously:",
+    "project": "Project",
+    "rememberNote": "Your answer is remembered.",
+    "revoke": "Forget this decision",
+    "scopeAnywhere": "Anywhere",
+    "secretsNote": "This server is given a credential. Values are hidden here.",
+    "title": "Run this MCP server?",
+    "trustWorkspace": "Trust every MCP server in this project",
+    "trustedProjectSub": "Every MCP server in this project runs without asking",
+    "trustedProjects": "Trusted projects",
+    "url": "URL",
+    "workingDir": "Working directory",
+    "workspaceRoot": "(project folder)"
+  },
   "models": {
     "loadFailed": "Não foi possível carregar modelos de models.dev — você ainda pode enviar com o modelo atual.",
     "loading": "Carregando modelos…",
diff --git a/src/renderer/src/locales/ru.json b/src/renderer/src/locales/ru.json
index 3a9ce24..6196cb2 100644
--- a/src/renderer/src/locales/ru.json
+++ b/src/renderer/src/locales/ru.json
@@ -179,6 +179,8 @@
     "connecting": "Подключение…",
     "editRawJson": "Редактировать необработанный JSON",
     "emptyState": "Серверы MCP не настроены. Подключите внешние серверы инструментов (файловая система, GitHub, базы данных и т. д.), чтобы расширить возможности агента. Серверы также считываются из файла <code>.roxy/mcp.json</code> в рабочей области.",
+    "eraModern": "MCP 2026",
+    "eraModernHelp": "This server speaks the 2026-07-28 protocol revision. Older servers connect over the 2025 handshake automatically.",
     "errAddFailed": "Не удалось добавить сервер.",
     "errCommandRequired": "Введите команду",
     "errDuplicateName": "Сервер с таким именем уже существует",
@@ -207,10 +209,85 @@
     "toolCount_other": "{{count}} инструментов",
     "toolsLabel": "Инструменты:"
   },
+  "mcpApp": {
+    "allow": "Allow",
+    "approveNote": "This was requested by the app’s own interface, not by you or the agent. Allowing it lets this app run this tool for as long as it stays open.",
+    "approveSubtitle": "The app from {{server}} wants to run one of that server’s tools.",
+    "approveTitle": "Let this app run a tool?",
+    "boundary": "App from {{server}}",
+    "deny": "Don’t allow",
+    "exitFullscreen": "Exit full screen",
+    "external_one": "Connects to {{count}} external site",
+    "external_other": "Connects to {{count}} external sites",
+    "frameTitle": "Interactive app from {{server}}",
+    "fullscreen": "Expand",
+    "loading": "Loading app…",
+    "rememberNote": "Remembered while this app is open.",
+    "tool": "Tool"
+  },
+  "mcpInstall": {
+    "command": "Command",
+    "done": "Got it",
+    "envVars": "Environment variables",
+    "failedTitle": "{{name}} couldn’t start",
+    "from": "from",
+    "headers": "Headers",
+    "manageNote": "Manage in Settings → MCP",
+    "noTools": "This server didn’t expose any tools.",
+    "project": "Project",
+    "secretsNote": "This server is given a credential. Values are hidden here.",
+    "source": "Source",
+    "title": "{{name}} is connected",
+    "toolsAdded__one": "Added {{count}} tool",
+    "toolsAdded__other": "Added {{count}} tools",
+    "toolsAdded_one": "Added {{count}} tool",
+    "toolsAdded_other": "Added {{count}} tools",
+    "trustSourceLocal": "This is third-party code running on your machine with your access — your files, keys and tokens. Roxy can’t vouch for what it does.",
+    "trustSourceRemote": "Anything you send through these tools goes to a third-party server. Roxy can’t vouch for what it does with it.",
+    "trustSourceTitle": "Trust your source.",
+    "url": "URL"
+  },
   "mcpPage": {
     "subtitle": "Подключите внешние серверы инструментов Model Context Protocol (файловая система, GitHub, базы данных, браузеры и т. д.), чтобы расширить возможности Roxy. Отредактируйте чистый JSON любого сервера с помощью кнопки { } для отладки. Серверы также считываются из файла .roxy/mcp.json рабочей области, и агент может добавлять их сам с помощью инструмента mcp.",
     "title": "MCP-серверы"
   },
+  "mcpTrust": {
+    "allow": "Allow",
+    "blockedServers": "Blocked servers",
+    "changedTitle": "This MCP server changed",
+    "changedWarning": "This server was approved before, but what it runs has changed. Only continue if you made this change yourself.",
+    "command": "Command",
+    "confirmHelp": "Off by default — installing a server is your decision, so Roxy runs it and tells you what it added. Turn this on to confirm each new server first, which is worth it on a shared machine or in repos you don’t control.",
+    "confirmLabel": "Ask before running a new server",
+    "deny": "Don’t allow",
+    "envVars": "Environment variables",
+    "explainLocal": "This runs a program on your computer with your account’s access — your files, keys and tokens. Only allow it if you recognise the command below.",
+    "explainRemote": "Roxy will connect to this server and expose its tools to the agent. Only allow it if you trust this host.",
+    "headers": "Headers",
+    "knownServers": "Known servers",
+    "noneYet": "Nothing approved yet.",
+    "origin": {
+      "agent": "“{{name}}” was added by the agent, not by you.",
+      "import": "“{{name}}” came from a config file you imported.",
+      "user": "“{{name}}” is configured in your settings.",
+      "workspace": "“{{name}}” is defined by a file in this project."
+    },
+    "panelIntro": "MCP servers can run programs on your machine, so ones that don’t come from your own settings are confirmed with you first. Everything you’ve answered is listed here and can be undone.",
+    "panelTitle": "Approved servers",
+    "previously": "Previously:",
+    "project": "Project",
+    "rememberNote": "Your answer is remembered.",
+    "revoke": "Forget this decision",
+    "scopeAnywhere": "Anywhere",
+    "secretsNote": "This server is given a credential. Values are hidden here.",
+    "title": "Run this MCP server?",
+    "trustWorkspace": "Trust every MCP server in this project",
+    "trustedProjectSub": "Every MCP server in this project runs without asking",
+    "trustedProjects": "Trusted projects",
+    "url": "URL",
+    "workingDir": "Working directory",
+    "workspaceRoot": "(project folder)"
+  },
   "models": {
     "loadFailed": "Не удалось загрузить модели с models.dev — вы все еще можете отправлять запросы с текущей моделью.",
     "loading": "Загрузка моделей…",
diff --git a/src/renderer/src/locales/zh.json b/src/renderer/src/locales/zh.json
index 90da9b0..4d180ef 100644
--- a/src/renderer/src/locales/zh.json
+++ b/src/renderer/src/locales/zh.json
@@ -179,6 +179,8 @@
     "connecting": "正在连接…",
     "editRawJson": "编辑原始 JSON",
     "emptyState": "未配置 MCP 服务器。连接外部工具服务器（文件系统、GitHub、数据库等）以扩展代理的功能。服务器也会从工作区 <code>.roxy/mcp.json</code> 中读取。",
+    "eraModern": "MCP 2026",
+    "eraModernHelp": "This server speaks the 2026-07-28 protocol revision. Older servers connect over the 2025 handshake automatically.",
     "errAddFailed": "添加服务器失败。",
     "errCommandRequired": "输入命令",
     "errDuplicateName": "已存在同名服务器",
@@ -207,10 +209,85 @@
     "toolCount_other": "{{count}} 个工具",
     "toolsLabel": "工具："
   },
+  "mcpApp": {
+    "allow": "Allow",
+    "approveNote": "This was requested by the app’s own interface, not by you or the agent. Allowing it lets this app run this tool for as long as it stays open.",
+    "approveSubtitle": "The app from {{server}} wants to run one of that server’s tools.",
+    "approveTitle": "Let this app run a tool?",
+    "boundary": "App from {{server}}",
+    "deny": "Don’t allow",
+    "exitFullscreen": "Exit full screen",
+    "external_one": "Connects to {{count}} external site",
+    "external_other": "Connects to {{count}} external sites",
+    "frameTitle": "Interactive app from {{server}}",
+    "fullscreen": "Expand",
+    "loading": "Loading app…",
+    "rememberNote": "Remembered while this app is open.",
+    "tool": "Tool"
+  },
+  "mcpInstall": {
+    "command": "Command",
+    "done": "Got it",
+    "envVars": "Environment variables",
+    "failedTitle": "{{name}} couldn’t start",
+    "from": "from",
+    "headers": "Headers",
+    "manageNote": "Manage in Settings → MCP",
+    "noTools": "This server didn’t expose any tools.",
+    "project": "Project",
+    "secretsNote": "This server is given a credential. Values are hidden here.",
+    "source": "Source",
+    "title": "{{name}} is connected",
+    "toolsAdded__one": "Added {{count}} tool",
+    "toolsAdded__other": "Added {{count}} tools",
+    "toolsAdded_one": "Added {{count}} tool",
+    "toolsAdded_other": "Added {{count}} tools",
+    "trustSourceLocal": "This is third-party code running on your machine with your access — your files, keys and tokens. Roxy can’t vouch for what it does.",
+    "trustSourceRemote": "Anything you send through these tools goes to a third-party server. Roxy can’t vouch for what it does with it.",
+    "trustSourceTitle": "Trust your source.",
+    "url": "URL"
+  },
   "mcpPage": {
     "subtitle": "连接外部模型上下文协议工具服务器（文件系统、GitHub、数据库、浏览器等）以扩展 Roxy 的功能。使用 { } 按钮编辑任何服务器的原始 JSON 以进行调试。服务器也会从工作区 .roxy/mcp.json 中读取，代理可以使用 mcp 工具自行添加它们。",
     "title": "MCP 服务器"
   },
+  "mcpTrust": {
+    "allow": "Allow",
+    "blockedServers": "Blocked servers",
+    "changedTitle": "This MCP server changed",
+    "changedWarning": "This server was approved before, but what it runs has changed. Only continue if you made this change yourself.",
+    "command": "Command",
+    "confirmHelp": "Off by default — installing a server is your decision, so Roxy runs it and tells you what it added. Turn this on to confirm each new server first, which is worth it on a shared machine or in repos you don’t control.",
+    "confirmLabel": "Ask before running a new server",
+    "deny": "Don’t allow",
+    "envVars": "Environment variables",
+    "explainLocal": "This runs a program on your computer with your account’s access — your files, keys and tokens. Only allow it if you recognise the command below.",
+    "explainRemote": "Roxy will connect to this server and expose its tools to the agent. Only allow it if you trust this host.",
+    "headers": "Headers",
+    "knownServers": "Known servers",
+    "noneYet": "Nothing approved yet.",
+    "origin": {
+      "agent": "“{{name}}” was added by the agent, not by you.",
+      "import": "“{{name}}” came from a config file you imported.",
+      "user": "“{{name}}” is configured in your settings.",
+      "workspace": "“{{name}}” is defined by a file in this project."
+    },
+    "panelIntro": "MCP servers can run programs on your machine, so ones that don’t come from your own settings are confirmed with you first. Everything you’ve answered is listed here and can be undone.",
+    "panelTitle": "Approved servers",
+    "previously": "Previously:",
+    "project": "Project",
+    "rememberNote": "Your answer is remembered.",
+    "revoke": "Forget this decision",
+    "scopeAnywhere": "Anywhere",
+    "secretsNote": "This server is given a credential. Values are hidden here.",
+    "title": "Run this MCP server?",
+    "trustWorkspace": "Trust every MCP server in this project",
+    "trustedProjectSub": "Every MCP server in this project runs without asking",
+    "trustedProjects": "Trusted projects",
+    "url": "URL",
+    "workingDir": "Working directory",
+    "workspaceRoot": "(project folder)"
+  },
   "models": {
     "loadFailed": "无法从 models.dev 加载模型 — 您仍然可以使用当前模型发送。",
     "loading": "正在加载模型…",
diff --git a/src/renderer/src/routes/Mcp.tsx b/src/renderer/src/routes/Mcp.tsx
index 1048ba9..7b75bbd 100644
--- a/src/renderer/src/routes/Mcp.tsx
+++ b/src/renderer/src/routes/Mcp.tsx
@@ -1,6 +1,7 @@
 import { useNavigate } from 'react-router-dom'
 import { useTranslation } from 'react-i18next'
 import { McpServers } from '../components/McpServers'
+import { McpTrustPanel } from '../components/McpTrustPanel'
 import { PageShell } from '../components/PageShell'
 
 export default function Mcp(): JSX.Element {
@@ -13,6 +14,12 @@ export default function Mcp(): JSX.Element {
       onBack={() => navigate('/')}
     >
       <McpServers showBackup />
+      {/* Consent lives next to the servers it governs, not buried in Settings:
+          the question "what have I allowed to run?" is asked here. */}
+      <section className="mt-8 border-t border-border pt-6">
+        <h2 className="mb-1 text-sm font-medium text-text">{t('mcpTrust.panelTitle')}</h2>
+        <McpTrustPanel />
+      </section>
     </PageShell>
   )
 }
diff --git a/src/shared/api.ts b/src/shared/api.ts
index 3c7a36e..ade722a 100644
--- a/src/shared/api.ts
+++ b/src/shared/api.ts
@@ -25,7 +25,16 @@ import type {
   UsageStats,
   WorktreeIntent
 } from './types'
-import type { McpServerConfig } from './mcp'
+import type { McpProtocolEra, McpServerConfig } from './mcp'
+import type { McpAppHostTheme } from './mcp-apps'
+import type {
+  McpConsentRequest,
+  McpConsentResponse,
+  McpInstallNotice,
+  McpTrustEntry,
+  McpTrustPolicy,
+  McpWorkspaceTrust
+} from './mcp-trust'
 import type { CliProxyLoginResult, CliProxyState } from './cliproxy'
 import type { ForgeStatusView, ForgeHostView, ForgeKind } from './forge'
 import type { RepoLayout } from './repos'
@@ -42,15 +51,80 @@ export interface McpServerView {
   /** Unqualified tool names exposed by the server when connected. */
   tools: string[]
   error?: string
+  /**
+   * Protocol era negotiated with this server, once connected: `modern` for the
+   * 2026-07-28 revision, `legacy` for the 2025 `initialize` handshake.
+   */
+  era?: McpProtocolEra
 }
 
-/** Payload to create/replace an MCP server entry. */
+/**
+ * Payload to create/replace an MCP server entry.
+ *
+ * No `origin` field: this crosses the IPC boundary, and provenance is decided by
+ * WHICH channel handled the call, never by what the caller claims. See
+ * McpServerRecord.origin.
+ */
 export interface UpsertMcpServerInput {
   id: string
   config: McpServerConfig
   enabled?: boolean
 }
 
+/** Everything the renderer needs to mount one MCP App view. */
+export interface McpAppLaunch {
+  sessionId: string
+  /** The view's HTML, read from its `ui://` resource. */
+  html: string
+  /** Sandbox proxy URL carrying this app's response-header CSP. */
+  sandboxUrl: string
+  /** CSP applied to the sandbox response and inherited by the view. */
+  csp: string
+  /** Complete bounded MCP tool result delivered after initialization. */
+  toolResult?: unknown
+  /** `allow` attribute for declared device permissions. */
+  allow: string
+  /** External origins the view declared, for disclosure on the card. */
+  externalDomains: string[]
+  /** Display modes both the view and this host support. */
+  displayModes: string[]
+}
+
+/** A view asking to call one of its own server’s tools. */
+export interface McpAppApprovalRequest {
+  requestId: string
+  sessionId: string
+  serverId: string
+  toolName: string
+  args: unknown
+}
+
+/** One JSON-RPC frame relayed from a view to the host. */
+export interface McpAppBridgeRequest {
+  sessionId: string
+  id?: string | number | null
+  method?: unknown
+  params?: Record<string, unknown>
+}
+
+/** The host’s answer to one relayed frame. */
+export interface McpAppBridgeReply {
+  result?: unknown
+  error?: { code: number; message: string }
+}
+
+/** Stored MCP trust state plus the current policy, for the Settings UI. */
+export interface McpTrustView {
+  entries: McpTrustEntry[]
+  workspaces: McpWorkspaceTrust[]
+  policy: McpTrustPolicy
+}
+
+/** What to forget when revoking trust. */
+export type McpTrustRevokeTarget =
+  | { kind: 'server'; id: string }
+  | { kind: 'workspace'; path: string }
+
 /** A skill discovered on disk (metadata only — the body is loaded on demand by the tool). */
 export interface SkillView {
   name: string
@@ -425,6 +499,12 @@ export type LlmEvent =
       ok: boolean
       image?: string
       diff?: ToolDiff
+      /**
+       * A server-supplied UI for this result, when the tool declared one.
+       * Resolved in main from the tool’s `_meta`, so the renderer never has
+       * to reason about MCP metadata - it is told where the view lives.
+       */
+      mcpApp?: { serverId: string; resourceUri: string }
     }
   /**
    * One step of a SUBAGENT's turn, addressed to the `task` card that spawned it.
@@ -782,6 +862,67 @@ export interface RoxyApi {
     setEnabled(id: string, enabled: boolean): Promise<McpServerView[]>
     /** Force a fresh connection attempt (to validate config); returns updated list. */
     reconnect(id: string): Promise<McpServerView[]>
+    /**
+     * Sign in to a remote, OAuth-protected server. Opens the system browser
+     * and resolves once the flow completes (or fails).
+     */
+    signIn(id: string): Promise<McpServerView[]>
+    /** Forget a remote server's OAuth credentials and disconnect it. */
+    signOut(id: string): Promise<McpServerView[]>
+    /**
+     * MCP Apps: a server-supplied UI rendered in a sandboxed frame.
+     *
+     * The renderer only ever relays JSON-RPC frames; the authenticated MCP
+     * connection stays in the main process, so a compromised view cannot
+     * reach a server even if it escaped its frame.
+     */
+    app: {
+      /** Read a UI-bearing tool’s view; null when it has none. */
+      launch(input: {
+        serverId: string
+        toolName: string
+        resourceUri: string
+      }): Promise<McpAppLaunch | null>
+      /** Relay one frame from a view and return the host’s reply. */
+      request(req: McpAppBridgeRequest): Promise<McpAppBridgeReply>
+      /** Drop a view’s session (its card unmounted). */
+      close(sessionId: string): Promise<void>
+      /** Publish the host theme so views can match it. */
+      setTheme(theme: McpAppHostTheme): void
+      /** Subscribe to view-initiated tool-call approvals. */
+      onApprovalRequest(callback: (req: McpAppApprovalRequest) => void): () => void
+      /** Answer one approval request. */
+      respondApproval(res: { requestId: string; allowed: boolean }): void
+    }
+    /**
+     * Consent to RUN a server. A local MCP server is an arbitrary command, and
+     * definitions that did not come from the user (a cloned repo's
+     * `.roxy/mcp.json`, or the model calling the `mcp` tool) must be approved
+     * before Roxy spawns them. See shared/mcp-trust.ts.
+     */
+    trust: {
+      /** Stored decisions + trusted workspaces + the current policy. */
+      list(): Promise<McpTrustView>
+      /** Forget a stored decision (a server everywhere, or one workspace). */
+      revoke(target: McpTrustRevokeTarget): Promise<McpTrustView>
+      /** Read the "confirm before running a new server" policy. */
+      getPolicy(): Promise<McpTrustPolicy>
+      /** Opt into (true) or out of (false) confirming each new server first. */
+      setPolicy(confirmBeforeRun: boolean): Promise<McpTrustPolicy>
+      /**
+       * Subscribe to install notices - "here's what just connected", with the
+       * server's tools and source. This is the NORMAL path. Returns an
+       * unsubscribe fn.
+       */
+      onInstall(callback: (notice: McpInstallNotice) => void): () => void
+      /**
+       * Subscribe to the rare blocking question (a trusted server's command
+       * changed, or the user opted into confirming). Answer with `respond`.
+       */
+      onRequest(callback: (request: McpConsentRequest) => void): () => void
+      /** Send the user's answer back, correlated by `requestId`. */
+      respond(response: McpConsentResponse): void
+    }
   }
   skills: {
     /** Discovered SKILL.md skills (workspace when a cwd is given, else the user's global skills). */
diff --git a/src/shared/ipc.ts b/src/shared/ipc.ts
index 97686bd..97f6cc1 100644
--- a/src/shared/ipc.ts
+++ b/src/shared/ipc.ts
@@ -55,6 +55,50 @@ export const CHANNELS = {
   mcpSetEnabled: 'mcp:setEnabled',
   mcpReconnect: 'mcp:reconnect',
 
+  /** Sign in to a remote (OAuth-protected) MCP server; opens the browser. */
+  mcpSignIn: 'mcp:sign-in',
+  /** Forget a remote server OAuth credentials. */
+  mcpSignOut: 'mcp:sign-out',
+
+  // ---- MCP trust (consent before Roxy spawns a server) ----
+  // A local MCP server is an arbitrary command. Definitions that did not come
+  // from the user - a cloned repo's `.roxy/mcp.json`, or the model calling the
+  // `mcp` tool - must be approved before they run. See shared/mcp-trust.ts.
+  /**
+   * main -> renderer: "here's what just connected" - the tools a newly-seen
+   * server exposed and the source it came from. The NORMAL path: a receipt, not
+   * a permission request.
+   */
+  mcpInstallNotice: 'mcp:install-notice',
+  /**
+   * main -> renderer: the rare blocking question (a trusted server's command
+   * changed, or the user opted into confirming first).
+   */
+  mcpConsentRequest: 'mcp:consent-request',
+  /** renderer -> main: the user's answer, correlated by `requestId`. */
+  mcpConsentRespond: 'mcp:consent-respond',
+  /** Trusted servers + workspaces, for the Settings list. */
+  mcpTrustList: 'mcp:trust-list',
+  /** Forget a stored decision (per-server or a whole workspace). */
+  mcpTrustRevoke: 'mcp:trust-revoke',
+  /** Read/write the opt-in "confirm before running a new server" toggle. */
+  mcpTrustGetPolicy: 'mcp:trust-get-policy',
+  mcpTrustSetPolicy: 'mcp:trust-set-policy',
+
+  // ---- MCP Apps (server-supplied UI rendered in a sandboxed frame) ----
+  /** Load a view for a completed UI-bearing tool call. */
+  mcpAppLaunch: 'mcp-app:launch',
+  /** One JSON-RPC frame from a view, relayed by the renderer. */
+  mcpAppRequest: 'mcp-app:request',
+  /** A view was unmounted; drop its session. */
+  mcpAppClose: 'mcp-app:close',
+  /** Publish the host theme so views can match it. */
+  mcpAppTheme: 'mcp-app:theme',
+  /** main -> renderer: approve a view-initiated tool call. */
+  mcpAppApprovalRequest: 'mcp-app:approval-request',
+  /** renderer -> main: the answer. */
+  mcpAppApprovalRespond: 'mcp-app:approval-respond',
+
   skillsList: 'skills:list',
   skillsRefresh: 'skills:refresh',
   skillsRead: 'skills:read',
diff --git a/src/shared/mcp-apps.ts b/src/shared/mcp-apps.ts
new file mode 100644
index 0000000..32eb6ca
--- /dev/null
+++ b/src/shared/mcp-apps.ts
@@ -0,0 +1,495 @@
+/**
+ * MCP Apps — the protocol between a server-supplied UI and Roxy.
+ *
+ * Pure logic only (no Node/Electron/DOM imports) so every rule here is unit
+ * tested in smoke:shared. Implements SEP-1865 (stable, 2026-01-26).
+ *
+ * ## What an MCP App is
+ *
+ * A tool can declare a UI in its metadata:
+ *
+ *   tool._meta['io.modelcontextprotocol/ui'].resourceUri = 'ui://server/app.html'
+ *
+ * When the model calls that tool, the host reads the `ui://` resource over
+ * `resources/read`, gets HTML back, and renders it. The view then talks JSON-RPC
+ * back to the host over `postMessage` — it can call the SAME SERVER's tools, ask
+ * to open a link, push text into the conversation, or update model context.
+ *
+ * ## The security posture this file encodes
+ *
+ * The HTML is written by whoever wrote the MCP server. It is untrusted,
+ * arbitrary, executable third-party code. Three rules follow, and every one of
+ * them is a function below rather than a comment:
+ *
+ *  1. **It never runs on Roxy's origin.** A same-origin iframe could reach the
+ *     preload bridge, `localStorage`, the session cookie jar — everything. The
+ *     spec's answer is a double iframe with a separate-origin sandbox proxy in
+ *     between, and that is what `buildCsp` + the proxy page implement.
+ *  2. **It only reaches its own server.** A view from server A must not be able
+ *     to call server B's tools. Routing is keyed to the app's origin server, not
+ *     to whatever the view asks for.
+ *  3. **Deny by default.** Unknown methods are rejected, undeclared domains are
+ *     blocked, and every capability (camera, links, tool calls) is off until the
+ *     resource declares it AND the user allows it.
+ */
+
+// ---------------------------------------------------------------------------
+// Identity
+// ---------------------------------------------------------------------------
+
+/** The `_meta` key MCP Apps reserves on tools and resources. */
+export const UI_META_KEY = 'io.modelcontextprotocol/ui'
+
+/**
+ * The short alias the official SDK actually writes.
+ *
+ * SEP-1865 reserves the fully-qualified `io.modelcontextprotocol/ui` label, but
+ * `registerAppTool` / `registerAppResource` in `@modelcontextprotocol/ext-apps`
+ * emit `_meta.ui` - and that is what every published example server carries. A
+ * host that reads only the namespaced key renders NOTHING for the entire
+ * ecosystem while looking perfectly correct against the prose.
+ *
+ * Both are accepted, namespaced first: it is the reserved, unambiguous form, and
+ * a server that sends both means the qualified one.
+ */
+export const UI_META_KEY_SHORT = 'ui'
+
+/** The MIME type an MCP App resource must declare. */
+export const UI_MIME = 'text/html;profile=mcp-app'
+
+/** URI scheme reserved for MCP App resources. */
+export const UI_SCHEME = 'ui://'
+
+/**
+ * Origin the sandbox proxy is served from.
+ *
+ * Shared so the renderer can name an explicit `targetOrigin` on every
+ * `postMessage` instead of falling back to `'*'`. A wildcard reply is readable
+ * by whatever is listening if the frame navigates, which for a document full of
+ * tool results is exactly the leak worth avoiding.
+ *
+ * Kept in step with `SANDBOX_SCHEME` in main/services/mcp-app-sandbox.ts; a
+ * smoke check pins the two together.
+ */
+export const SANDBOX_ORIGIN_HINT = 'roxy-mcp-app://view'
+
+/**
+ * `targetOrigin` for host -> proxy `postMessage`.
+ *
+ * The sandbox is a real, addressable origin, so this is explicit rather than
+ * a wildcard. That is only possible because the proxy frame carries
+ * `allow-same-origin`: an opaque frame has NO addressable origin at all -
+ * posting to the scheme URL is silently dropped, and the literal `'null'` is
+ * rejected outright by the browser.
+ *
+ * Opacity was never what isolated the view. `roxy-mcp-app://view` is a
+ * throwaway origin with no cookies, no storage and no access to the
+ * renderer's origin, which is the property the spec actually requires (host
+ * and sandbox MUST differ). `allow-same-origin` here means "same as that
+ * throwaway", not "same as Roxy".
+ */
+export const SANDBOX_POST_TARGET = SANDBOX_ORIGIN_HINT
+
+/** Protocol revision this implementation speaks. */
+export const APPS_PROTOCOL_VERSION = '2026-01-26'
+
+// ---------------------------------------------------------------------------
+// Declarations read off tool / resource metadata
+// ---------------------------------------------------------------------------
+
+/** Domains a resource declares it needs. Anything not listed is blocked. */
+export interface McpUiCsp {
+  /** Origins allowed for scripts, styles, images, fonts, media. */
+  resourceDomains?: string[]
+  /** Origins the view may `fetch`/XHR/WebSocket to. */
+  connectDomains?: string[]
+  /** Origins allowed in nested iframes. Absent means `frame-src 'none'`. */
+  frameDomains?: string[]
+  /** Origins allowed as `<base href>`. Absent means `base-uri 'self'`. */
+  baseUriDomains?: string[]
+}
+
+/** Device permissions a resource asks for; each maps to an iframe `allow` token. */
+export interface McpUiPermissions {
+  camera?: boolean
+  microphone?: boolean
+  geolocation?: boolean
+}
+
+/** The `io.modelcontextprotocol/ui` block on a TOOL. */
+export interface McpUiToolMeta {
+  /** The `ui://` resource holding this tool's view. */
+  resourceUri?: string
+  /**
+   * Who may see this tool.
+   *
+   * `['app']` means app-only: the tool exists for the view to call and MUST NOT
+   * be offered to the model. Absent means the model sees it as normal.
+   */
+  visibility?: string[]
+  /** Preferred initial size, when the view knows it up front. */
+  preferredSize?: { width?: number; height?: number }
+}
+
+/** The `io.modelcontextprotocol/ui` block on a RESOURCE. */
+export interface McpUiResourceMeta {
+  csp?: McpUiCsp
+  permissions?: McpUiPermissions
+  /** Display modes the view can render in. */
+  availableDisplayModes?: McpUiDisplayMode[]
+}
+
+export type McpUiDisplayMode = 'inline' | 'fullscreen' | 'pip'
+
+/** Read a tool's UI declaration, if it has one. */
+export function uiToolMeta(meta: Record<string, unknown> | undefined): McpUiToolMeta | undefined {
+  return readUiBlock(meta) as McpUiToolMeta | undefined
+}
+
+/**
+ * Read the UI block under either spelling.
+ *
+ * Shared by the tool and resource readers so the two can never disagree about
+ * which key counts - a split there would show up as a tool that declares a view
+ * whose resource is then judged not to be one.
+ */
+function readUiBlock(
+  meta: Record<string, unknown> | undefined
+): Record<string, unknown> | undefined {
+  for (const key of [UI_META_KEY, UI_META_KEY_SHORT]) {
+    const block = meta?.[key]
+    if (block && typeof block === 'object' && !Array.isArray(block)) {
+      return block as Record<string, unknown>
+    }
+  }
+  return undefined
+}
+
+/** Read a resource's UI declaration, if it has one. */
+export function uiResourceMeta(
+  meta: Record<string, unknown> | undefined
+): McpUiResourceMeta | undefined {
+  return readUiBlock(meta) as McpUiResourceMeta | undefined
+}
+
+/** The `ui://` resource a tool's view lives at, or undefined if it has none. */
+export function uiResourceUri(meta: Record<string, unknown> | undefined): string | undefined {
+  const uri = uiToolMeta(meta)?.resourceUri
+  return typeof uri === 'string' && uri.startsWith(UI_SCHEME) ? uri : undefined
+}
+
+/**
+ * Whether a tool is app-only and must be hidden from the model.
+ *
+ * `visibility: ['app']` exists so a server can expose fine-grained operations to
+ * its own UI (say, `set_cell`) without polluting the model's tool list with
+ * dozens of them. Getting this backwards would hand the model tools the server
+ * explicitly said were not for it.
+ */
+export function isAppOnlyTool(meta: Record<string, unknown> | undefined): boolean {
+  const vis = uiToolMeta(meta)?.visibility
+  if (!Array.isArray(vis)) return false
+  return vis.length > 0 && !vis.includes('model')
+}
+
+// ---------------------------------------------------------------------------
+// Content Security Policy
+// ---------------------------------------------------------------------------
+
+/**
+ * A domain entry that is safe to interpolate into a CSP.
+ *
+ * The declaration comes from the server, i.e. from the same untrusted place as
+ * the HTML. A value like `*; script-src *` would otherwise let a resource
+ * rewrite the very policy meant to contain it — CSP header injection. Only
+ * scheme+host(+port) shapes and a small set of keywords are allowed through;
+ * anything containing a separator is dropped.
+ */
+const SAFE_DOMAIN =
+  /^(?:https:\/\/[a-z0-9.*-]+(?::\d+)?|wss:\/\/[a-z0-9.*-]+(?::\d+)?|'self'|'none'|data:)$/i
+
+/** Keep only domain entries that cannot break out of the directive. */
+export function sanitizeDomains(list: string[] | undefined): string[] {
+  if (!Array.isArray(list)) return []
+  return list
+    .filter((d) => typeof d === 'string' && SAFE_DOMAIN.test(d.trim()))
+    .map((d) => d.trim())
+}
+
+/**
+ * Build the CSP the sandbox applies to a view.
+ *
+ * Mirrors the construction in the official ext-apps basic host.
+ * Same-origin bundled code is the floor; every external origin must be named
+ * by a directive below it. A resource that declares nothing can run its own
+ * single-file bundle but gets no external network, frames, or plugins.
+ *
+ * `'unsafe-inline'` for script and style is in the spec and unavoidable: these
+ * views are single HTML files with inline `<script>`. It is survivable precisely
+ * because the origin is disposable and `connect-src` is closed by default — the
+ * script can execute, but it cannot phone home.
+ */
+export function buildCsp(csp: McpUiCsp | undefined): string {
+  const resources = sanitizeDomains(csp?.resourceDomains).join(' ')
+  const connect = sanitizeDomains(csp?.connectDomains).join(' ')
+  const frames = sanitizeDomains(csp?.frameDomains).join(' ')
+  const baseUri = sanitizeDomains(csp?.baseUriDomains).join(' ')
+  // `blob:` appears in several directives on purpose. Graphics and mapping
+  // libraries (CesiumJS being the one that exposed this) build workers, shaders
+  // and textures from Blob URLs at runtime; without it they throw during
+  // startup and render a white box, which reads as "the app is broken" rather
+  // than "the host blocked it". A blob URL is same-origin content the document
+  // created itself, so allowing it grants no new reach.
+  return [
+    "default-src 'self' 'unsafe-inline'",
+    `script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data:${resources ? ' ' + resources : ''}`,
+    `style-src 'self' 'unsafe-inline' blob: data:${resources ? ' ' + resources : ''}`,
+    `connect-src 'self'${connect ? ' ' + connect : ''}`,
+    `img-src 'self' data: blob:${resources ? ' ' + resources : ''}`,
+    `font-src 'self' data: blob:${resources ? ' ' + resources : ''}`,
+    `media-src 'self' data: blob:${resources ? ' ' + resources : ''}`,
+    // Workers are how WebGL-heavy views decode tiles off the main thread.
+    `worker-src 'self' blob:${resources ? ' ' + resources : ''}`,
+    `frame-src ${frames || "'none'"}`,
+    "object-src 'none'",
+    `base-uri ${baseUri || "'none'"}`
+  ].join('; ')
+}
+
+/**
+ * The iframe `allow` attribute for a view's declared permissions.
+ *
+ * Empty unless the resource asked. A device permission that nobody requested is
+ * a device permission that stays off.
+ */
+export function buildAllow(permissions: McpUiPermissions | undefined): string {
+  const allow: string[] = []
+  if (permissions?.camera) allow.push('camera')
+  if (permissions?.microphone) allow.push('microphone')
+  if (permissions?.geolocation) allow.push('geolocation')
+  return allow.join('; ')
+}
+
+/**
+ * Whether a view wants access to anything outside itself.
+ *
+ * Drives the disclosure on the tool card: "this UI talks to api.example.com" is
+ * the one fact a user cannot discover by looking at the rendered view.
+ */
+export function externalDomains(meta: McpUiResourceMeta | undefined): string[] {
+  const all = [
+    ...sanitizeDomains(meta?.csp?.connectDomains),
+    ...sanitizeDomains(meta?.csp?.resourceDomains),
+    ...sanitizeDomains(meta?.csp?.frameDomains)
+  ].filter((d) => d !== "'self'" && d !== "'none'" && d !== 'data:')
+  return [...new Set(all)]
+}
+
+// ---------------------------------------------------------------------------
+// The bridge protocol
+// ---------------------------------------------------------------------------
+
+/** Methods a view may send that the host answers itself. */
+export const UI_METHODS = [
+  'ui/initialize',
+  'ui/notifications/initialized',
+  'ui/open-link',
+  'ui/message',
+  'ui/request-display-mode',
+  'ui/update-model-context'
+] as const
+
+/**
+ * Methods a view may send that the host FORWARDS to the MCP server.
+ *
+ * An explicit allowlist, not a prefix check. The spec permits forwarding
+ * anything without a `ui/` prefix, but "everything except a prefix" is a rule
+ * that silently grows as the protocol does — a future `roots/list` or
+ * `sampling/createMessage` would start flowing to the server the day a server
+ * started sending it. Naming the two methods a view legitimately needs keeps the
+ * blast radius fixed.
+ */
+export const FORWARDED_METHODS = ['tools/call', 'resources/read'] as const
+
+/** Reserved sandbox-proxy methods, which must never be forwarded onward. */
+export const SANDBOX_METHOD_PREFIX = 'ui/notifications/sandbox-'
+
+export type UiMethod = (typeof UI_METHODS)[number]
+export type ForwardedMethod = (typeof FORWARDED_METHODS)[number]
+
+/** What the host should do with an inbound message from a view. */
+export type BridgeRoute =
+  | { kind: 'host'; method: UiMethod }
+  | { kind: 'forward'; method: ForwardedMethod }
+  | { kind: 'reject'; reason: string }
+
+/**
+ * Classify one inbound method name. The single decision point for "may a view do
+ * this?", so the answer is testable without a browser.
+ *
+ * Deny by default: anything not explicitly listed is rejected, including the
+ * reserved sandbox methods (which belong to the proxy and must not reach either
+ * the host's handlers or the server).
+ */
+export function routeBridgeMethod(method: unknown): BridgeRoute {
+  if (typeof method !== 'string' || !method) {
+    return { kind: 'reject', reason: 'Missing method' }
+  }
+  if (method.startsWith(SANDBOX_METHOD_PREFIX)) {
+    return { kind: 'reject', reason: 'Reserved sandbox method' }
+  }
+  if ((UI_METHODS as readonly string[]).includes(method)) {
+    return { kind: 'host', method: method as UiMethod }
+  }
+  if ((FORWARDED_METHODS as readonly string[]).includes(method)) {
+    return { kind: 'forward', method: method as ForwardedMethod }
+  }
+  return { kind: 'reject', reason: `Unsupported method: ${method}` }
+}
+
+/** JSON-RPC error codes used by the bridge. */
+export const BRIDGE_ERROR = {
+  /** Implementation-defined; what the spec uses for denied UI requests. */
+  denied: -32000,
+  methodNotFound: -32601,
+  invalidParams: -32602
+} as const
+
+/**
+ * Whether a URL is safe to hand to the OS browser for `ui/open-link`.
+ *
+ * http/https only. A view asking to open `file:///`, or a custom scheme
+ * registered by some other installed application, is asking the host to do
+ * something on its behalf that it could not do itself — the classic sandbox
+ * escape by proxy.
+ */
+export function isOpenableUrl(raw: unknown): boolean {
+  if (typeof raw !== 'string') return false
+  try {
+    const u = new URL(raw)
+    return u.protocol === 'http:' || u.protocol === 'https:'
+  } catch {
+    return false
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Host context handed to a view at `ui/initialize`
+// ---------------------------------------------------------------------------
+
+/**
+ * Theme variables passed to the view so it can match the host.
+ *
+ * Sent as data rather than injected CSS: the view decides how to use them, and
+ * the host never writes into the view's document.
+ */
+export const MCP_APP_HOST_STYLE_KEYS = [
+  '--color-background-primary',
+  '--color-background-secondary',
+  '--color-background-tertiary',
+  '--color-text-primary',
+  '--color-text-secondary',
+  '--color-text-tertiary',
+  '--color-border-primary',
+  '--color-border-secondary',
+  '--color-ring-primary',
+  '--font-sans',
+  '--font-mono'
+] as const
+
+export type McpAppHostStyleKey = (typeof MCP_APP_HOST_STYLE_KEYS)[number]
+export type McpAppHostStyles = Partial<Record<McpAppHostStyleKey, string>>
+export type McpUiTheme = 'light' | 'dark'
+
+/** Renderer snapshot of Roxy's theme, translated to official MCP App tokens. */
+export interface McpAppHostTheme {
+  mode: McpUiTheme
+  variables: McpAppHostStyles
+}
+
+/**
+ * Validate the IPC theme snapshot before including it in `ui/initialize`.
+ *
+ * MCP Apps style variables are a closed schema. Unknown CSS properties make the
+ * official SDK reject the entire initialization result, so stale renderers and
+ * malformed IPC payloads are stripped rather than turning cosmetic data into a
+ * connection failure.
+ */
+export function sanitizeMcpAppHostTheme(value: unknown): McpAppHostTheme {
+  const raw = value && typeof value === 'object' ? (value as Record<string, unknown>) : {}
+  const rawVariables =
+    raw.variables && typeof raw.variables === 'object'
+      ? (raw.variables as Record<string, unknown>)
+      : {}
+  const variables: McpAppHostStyles = {}
+  for (const key of MCP_APP_HOST_STYLE_KEYS) {
+    const style = rawVariables[key]
+    if (typeof style === 'string' && style.length <= 512) variables[key] = style
+  }
+  return {
+    mode: raw.mode === 'light' ? 'light' : 'dark',
+    variables
+  }
+}
+
+/** The result of a view's `ui/initialize` request. */
+export interface McpUiInitializeResult {
+  protocolVersion: string
+  hostInfo: { name: string; version: string }
+  hostCapabilities: {
+    /** The view may call its own server's tools (subject to approval). */
+    serverTools?: { listChanged?: boolean }
+    /** The view may read its own server's resources. */
+    serverResources?: { listChanged?: boolean }
+    /** `ui/open-link` is available. */
+    openLinks?: Record<string, never>
+    /** `ui/update-model-context` is available. */
+    updateModelContext?: { text?: Record<string, never> }
+  }
+  /** Rich host context. The official App SDK expects these fields nested here. */
+  hostContext: {
+    theme?: 'light' | 'dark'
+    styles?: { variables?: McpAppHostStyles }
+    displayMode?: McpUiDisplayMode
+    availableDisplayModes?: McpUiDisplayMode[]
+    containerDimensions?: { maxHeight?: number; maxWidth?: number }
+    platform?: 'desktop'
+    userAgent?: string
+  }
+}
+
+/**
+ * Display modes Roxy supports.
+ *
+ * `pip` is deliberately absent: advertising a mode the host cannot honour means
+ * a view renders itself for a floating window that never appears. Better to say
+ * no and have the view fall back than to say yes and be wrong.
+ */
+export const SUPPORTED_DISPLAY_MODES: McpUiDisplayMode[] = ['inline', 'fullscreen']
+
+/** Clamp a requested display mode to one this host actually implements. */
+export function negotiateDisplayMode(requested: unknown): McpUiDisplayMode {
+  return (SUPPORTED_DISPLAY_MODES as string[]).includes(requested as string)
+    ? (requested as McpUiDisplayMode)
+    : 'inline'
+}
+
+// ---------------------------------------------------------------------------
+// Sizing
+// ---------------------------------------------------------------------------
+
+/**
+ * Bounds on how tall a view may make itself.
+ *
+ * A view reports its own content height and the host resizes to fit. Unbounded,
+ * that is a trivial denial of service on the transcript: one card claiming
+ * 900,000px pushes every other message out of reach. The floor exists so a view
+ * that reports 0 during layout doesn't collapse to an invisible sliver.
+ */
+export const APP_HEIGHT = { min: 80, max: 1200, initial: 320 } as const
+
+/** Clamp a self-reported height into something a transcript can hold. */
+export function clampAppHeight(height: unknown): number {
+  const n = typeof height === 'number' && Number.isFinite(height) ? height : APP_HEIGHT.initial
+  return Math.max(APP_HEIGHT.min, Math.min(APP_HEIGHT.max, Math.round(n)))
+}
diff --git a/src/shared/mcp-content.ts b/src/shared/mcp-content.ts
new file mode 100644
index 0000000..ff83427
--- /dev/null
+++ b/src/shared/mcp-content.ts
@@ -0,0 +1,527 @@
+/**
+ * MCP content blocks and results, kept LOSSLESS.
+ *
+ * Pure logic only (no Node/SDK imports) so every rule here is unit tested in
+ * smoke:shared.
+ *
+ * ## Why this module exists
+ *
+ * A `tools/call` result is a structured, typed thing: an ordered list of content
+ * blocks (text, image, audio, resource links, embedded resources), optional
+ * `structuredContent` matching the tool's `outputSchema`, and `_meta` carrying
+ * whatever extensions the server speaks. Roxy used to reduce all of that, at the
+ * moment it arrived, to `{ ok, output: string, image? }`.
+ *
+ * That flattening is correct for ONE consumer - the model, which reads text -
+ * and destructive for every other one. A resource link became the sentence
+ * "[resource: file://x]" with the URI no longer addressable. A second image was
+ * dropped entirely. `_meta` never survived at all, which is precisely where MCP
+ * Apps puts the identity of the view a result belongs to.
+ *
+ * So the rule this module enforces is: **parse into a typed model, keep
+ * everything, and flatten only at the boundary that actually needs a string.**
+ * `toModelText` is that boundary. Nothing else should be lowering a result.
+ *
+ * ## Bounded, not unlimited
+ *
+ * "Lossless" cannot mean "hold whatever a server sends". A tool can return a
+ * 200MB base64 blob, and MCP connections are warm and long-lived, so anything
+ * retained is retained for the life of the session. Every field that can grow
+ * without bound is capped HERE, at parse time, and the cap is recorded in the
+ * value itself (`truncated`, `omitted`) rather than left implicit - a consumer
+ * must be able to tell "empty" from "too big to keep".
+ */
+
+import type { ToolResult } from './types'
+
+// ---------------------------------------------------------------------------
+// Limits
+// ---------------------------------------------------------------------------
+
+/**
+ * Caps applied when parsing a result. Deliberately generous for text (a file
+ * listing is legitimately large) and strict for binary (base64 in memory is the
+ * only thing here that can realistically exhaust a session).
+ */
+export const MCP_LIMITS = {
+  /** Per model-facing text block, in chars. */
+  textChars: 200_000,
+  /**
+   * Per MCP App HTML resource, in chars.
+   *
+   * Apps are Vite-style single-file bundles rather than prose. The official map
+   * app is ~343k, so applying the model-text cap here truncated JavaScript in
+   * the middle of the bundle and left a blank document. Keep a separate, still
+   * bounded ceiling for executable app resources.
+   */
+  appHtmlChars: 4_000_000,
+  /** Per inline binary payload (image/audio/blob), in base64 chars (~3MB decoded). */
+  binaryChars: 4_000_000,
+  /** Blocks kept per result; beyond this we count and drop. */
+  blocks: 1_000,
+  /** Serialized size cap for `structuredContent` / `_meta`, in chars. */
+  jsonChars: 200_000
+} as const
+
+// ---------------------------------------------------------------------------
+// Content blocks
+// ---------------------------------------------------------------------------
+
+/** Text a server returned. */
+export interface McpTextBlock {
+  kind: 'text'
+  text: string
+  /** True when `text` was cut to `MCP_LIMITS.textChars`. */
+  truncated?: boolean
+  annotations?: Record<string, unknown>
+  _meta?: Record<string, unknown>
+}
+
+/** Inline binary (an image or audio clip) as base64, with its media type. */
+export interface McpBinaryBlock {
+  kind: 'image' | 'audio'
+  /** base64 payload, or undefined when it exceeded `MCP_LIMITS.binaryChars`. */
+  data?: string
+  mimeType: string
+  /** True when the payload was dropped for size (so `data` is absent by policy). */
+  omitted?: boolean
+  annotations?: Record<string, unknown>
+  _meta?: Record<string, unknown>
+}
+
+/**
+ * A pointer to a resource the server hosts (`resource_link`).
+ *
+ * The URI is the whole point and must stay addressable: this is what a client
+ * calls `resources/read` with. Flattening it into prose - as the old renderer
+ * did - is exactly the loss this module exists to prevent.
+ */
+export interface McpResourceLinkBlock {
+  kind: 'resource_link'
+  uri: string
+  name?: string
+  title?: string
+  description?: string
+  mimeType?: string
+  annotations?: Record<string, unknown>
+  _meta?: Record<string, unknown>
+}
+
+/** A resource embedded directly in the result (text or base64 blob). */
+export interface McpEmbeddedResourceBlock {
+  kind: 'resource'
+  uri: string
+  mimeType?: string
+  /** Inline text contents, when the resource is textual. */
+  text?: string
+  /** Inline base64 contents, when it is binary. */
+  blob?: string
+  truncated?: boolean
+  omitted?: boolean
+  annotations?: Record<string, unknown>
+  _meta?: Record<string, unknown>
+}
+
+/**
+ * A block whose `type` this version of Roxy does not model.
+ *
+ * Kept rather than discarded, because the spec is actively gaining content
+ * types and "we didn't recognise it" is not a reason to make it unrecoverable.
+ * The raw JSON is retained (bounded) so a newer consumer can interpret it.
+ */
+export interface McpUnknownBlock {
+  kind: 'unknown'
+  /** The server's own `type` discriminator, when it had one. */
+  type?: string
+  /** The block verbatim, serialized. Absent if it exceeded the JSON cap. */
+  raw?: string
+}
+
+export type McpContentBlock =
+  | McpTextBlock
+  | McpBinaryBlock
+  | McpResourceLinkBlock
+  | McpEmbeddedResourceBlock
+  | McpUnknownBlock
+
+/**
+ * One `tools/call` result, with nothing thrown away.
+ *
+ * This is what the service returns and what every non-model consumer should
+ * read. `toModelText` derives the string the model sees; it is a projection of
+ * this, never a replacement for it.
+ */
+export interface McpCallResult {
+  /** `isError: true` from the server (a tool-level failure, not a transport one). */
+  isError: boolean
+  /** Content blocks in the order the server sent them. */
+  content: McpContentBlock[]
+  /** Typed output, when the tool declares an `outputSchema`. */
+  structuredContent?: unknown
+  /** Result-level extension data (MCP Apps and friends live here). */
+  _meta?: Record<string, unknown>
+  /** How many blocks were dropped for exceeding `MCP_LIMITS.blocks`. */
+  droppedBlocks?: number
+}
+
+// ---------------------------------------------------------------------------
+// Parsing
+// ---------------------------------------------------------------------------
+
+function isRecord(v: unknown): v is Record<string, unknown> {
+  return !!v && typeof v === 'object' && !Array.isArray(v)
+}
+
+function str(v: unknown): string | undefined {
+  return typeof v === 'string' && v ? v : undefined
+}
+
+/** Copy a `_meta`/`annotations` bag if it is a plain object AND fits the cap. */
+function bag(v: unknown): Record<string, unknown> | undefined {
+  if (!isRecord(v)) return undefined
+  const json = safeJson(v)
+  if (!json || json.length > MCP_LIMITS.jsonChars) return undefined
+  return v
+}
+
+function clampText(v: string): { text: string; truncated?: boolean } {
+  if (v.length <= MCP_LIMITS.textChars) return { text: v }
+  return { text: v.slice(0, MCP_LIMITS.textChars), truncated: true }
+}
+
+/** Parse one content block, preserving everything that fits the caps. */
+function parseBlock(raw: unknown): McpContentBlock {
+  if (!isRecord(raw)) return { kind: 'unknown', raw: boundedJson(raw) }
+  const type = str(raw.type)
+  const annotations = bag(raw.annotations)
+  const meta = bag(raw._meta)
+
+  if (type === 'text' && typeof raw.text === 'string') {
+    const { text, truncated } = clampText(raw.text)
+    return { kind: 'text', text, ...(truncated && { truncated }), annotations, _meta: meta }
+  }
+
+  if ((type === 'image' || type === 'audio') && typeof raw.data === 'string') {
+    const mimeType = str(raw.mimeType) ?? (type === 'image' ? 'image/png' : 'audio/mpeg')
+    const tooBig = raw.data.length > MCP_LIMITS.binaryChars
+    return {
+      kind: type,
+      ...(tooBig ? { omitted: true } : { data: raw.data }),
+      mimeType,
+      annotations,
+      _meta: meta
+    }
+  }
+
+  if (type === 'resource_link' && str(raw.uri)) {
+    return {
+      kind: 'resource_link',
+      uri: str(raw.uri)!,
+      name: str(raw.name),
+      title: str(raw.title),
+      description: str(raw.description),
+      mimeType: str(raw.mimeType),
+      annotations,
+      _meta: meta
+    }
+  }
+
+  if (type === 'resource' && isRecord(raw.resource)) {
+    const r = raw.resource
+    const uri = str(r.uri) ?? ''
+    const block: McpEmbeddedResourceBlock = {
+      kind: 'resource',
+      uri,
+      mimeType: str(r.mimeType),
+      annotations,
+      _meta: meta
+    }
+    if (typeof r.text === 'string') {
+      const { text, truncated } = clampText(r.text)
+      block.text = text
+      if (truncated) block.truncated = true
+    } else if (typeof r.blob === 'string') {
+      if (r.blob.length > MCP_LIMITS.binaryChars) block.omitted = true
+      else block.blob = r.blob
+    }
+    return block
+  }
+
+  // Unrecognised. A `text` field is still worth surfacing to the model, so a
+  // block that is merely NEWER than us doesn't read as empty - but it stays
+  // typed as unknown, because guessing at its semantics would be worse.
+  if (typeof raw.text === 'string') {
+    const { text, truncated } = clampText(raw.text)
+    return { kind: 'text', text, ...(truncated && { truncated }), annotations, _meta: meta }
+  }
+  return { kind: 'unknown', type, raw: boundedJson(raw) }
+}
+
+/**
+ * Parse a raw `tools/call` result into the lossless model.
+ *
+ * Never throws: a malformed result degrades to an empty-but-valid value, since
+ * the caller is an agent turn that must not die because a server misbehaved.
+ */
+export function parseCallResult(raw: {
+  content?: unknown
+  isError?: boolean
+  structuredContent?: unknown
+  _meta?: unknown
+}): McpCallResult {
+  const list = Array.isArray(raw?.content) ? raw.content : []
+  const kept = list.slice(0, MCP_LIMITS.blocks)
+  const result: McpCallResult = {
+    isError: raw?.isError === true,
+    content: kept.map(parseBlock)
+  }
+  if (list.length > kept.length) result.droppedBlocks = list.length - kept.length
+  if (raw?.structuredContent !== undefined && raw.structuredContent !== null) {
+    result.structuredContent = raw.structuredContent
+  }
+  const meta = bag(raw?._meta)
+  if (meta) result._meta = meta
+  return result
+}
+
+// ---------------------------------------------------------------------------
+// Projection to the model's view
+// ---------------------------------------------------------------------------
+
+// ---------------------------------------------------------------------------
+// Resources
+// ---------------------------------------------------------------------------
+
+/** One entry from `resources/list`. */
+export interface McpResourceInfo {
+  uri: string
+  name?: string
+  title?: string
+  description?: string
+  mimeType?: string
+  /** Listing-level extension metadata, used as fallback by MCP Apps. */
+  _meta?: Record<string, unknown>
+}
+
+/**
+ * The contents of one resource, as read.
+ *
+ * Text and binary are separate fields rather than one `data: string`, because a
+ * consumer must not have to guess which it got: an MCP App's HTML is text to be
+ * rendered, a PNG is bytes to be embedded, and conflating them is how you end up
+ * rendering base64 into a document.
+ */
+export interface McpResourceContents {
+  uri: string
+  mimeType?: string
+  /** Decoded text, when the resource is textual. */
+  text?: string
+  /** base64 payload, when it is binary. */
+  blob?: string
+  /** Content-level extension metadata. MCP Apps CSP lives here. */
+  _meta?: Record<string, unknown>
+  /** True when `text` was cut to its applicable resource limit. */
+  truncated?: boolean
+  /** True when a payload was dropped for exceeding `MCP_LIMITS.binaryChars`. */
+  omitted?: boolean
+}
+
+/**
+ * Parse a `resources/read` response.
+ *
+ * The wire returns an ARRAY of contents (one URI can expand to several parts).
+ * Roxy reads one addressable resource at a time, so the first entry is the
+ * answer; flattening that here keeps every call site from re-deciding it.
+ *
+ * Bounded on the same terms as content blocks - see the note on `MCP_LIMITS`.
+ */
+export function parseResourceContents(uri: string, contents: unknown): McpResourceContents {
+  const first = Array.isArray(contents) ? contents[0] : undefined
+  if (!isRecord(first)) return { uri }
+  const mimeType = str(first.mimeType)
+  // MCP App views are executable single-file bundles, not model-facing prose.
+  // The official map bundle is ~343k, so applying the 200k text-block cap cut
+  // its JavaScript in half. Keep the app-specific ceiling bounded but complete.
+  const textLimit = mimeType?.toLowerCase().includes('profile=mcp-app')
+    ? MCP_LIMITS.appHtmlChars
+    : MCP_LIMITS.textChars
+  // `_meta` is the spec spelling. Some SDKs serialize the same field as `meta`;
+  // the official reference host accepts both, so Roxy does too.
+  const meta = bag(first._meta) ?? bag(first.meta)
+  const out: McpResourceContents = {
+    uri: str(first.uri) ?? uri,
+    mimeType,
+    ...(meta ? { _meta: meta } : {})
+  }
+  if (typeof first.text === 'string') {
+    out.text = first.text.length <= textLimit ? first.text : first.text.slice(0, textLimit)
+    if (first.text.length > textLimit) out.truncated = true
+  } else if (typeof first.blob === 'string') {
+    if (first.blob.length > MCP_LIMITS.binaryChars) out.omitted = true
+    else out.blob = first.blob
+  }
+  return out
+}
+
+/**
+ * Convert the bounded internal result back to the standard MCP CallToolResult
+ * wire shape expected by MCP Apps.
+ *
+ * The internal model uses `kind` rather than the wire's `type`, so passing it
+ * directly to `ui/notifications/tool-result` fails the official App SDK's
+ * schema validation. This is a projection, not a second source of truth.
+ */
+export function toMcpCallResult(
+  result: McpCallResult | undefined
+): Record<string, unknown> | undefined {
+  if (!result) return undefined
+  const content: Record<string, unknown>[] = []
+  for (const block of result.content) {
+    switch (block.kind) {
+      case 'text':
+        content.push({
+          type: 'text',
+          text: block.text,
+          ...(block.annotations ? { annotations: block.annotations } : {}),
+          ...(block._meta ? { _meta: block._meta } : {})
+        })
+        break
+      case 'image':
+      case 'audio':
+        if (!block.data) break
+        content.push({
+          type: block.kind,
+          data: block.data,
+          mimeType: block.mimeType,
+          ...(block.annotations ? { annotations: block.annotations } : {}),
+          ...(block._meta ? { _meta: block._meta } : {})
+        })
+        break
+      case 'resource_link':
+        content.push({
+          type: 'resource_link',
+          uri: block.uri,
+          ...(block.name ? { name: block.name } : {}),
+          ...(block.title ? { title: block.title } : {}),
+          ...(block.description ? { description: block.description } : {}),
+          ...(block.mimeType ? { mimeType: block.mimeType } : {}),
+          ...(block.annotations ? { annotations: block.annotations } : {}),
+          ...(block._meta ? { _meta: block._meta } : {})
+        })
+        break
+      case 'resource':
+        content.push({
+          type: 'resource',
+          resource: {
+            uri: block.uri,
+            ...(block.mimeType ? { mimeType: block.mimeType } : {}),
+            ...(block.text !== undefined ? { text: block.text } : {}),
+            ...(block.blob !== undefined ? { blob: block.blob } : {})
+          },
+          ...(block.annotations ? { annotations: block.annotations } : {}),
+          ...(block._meta ? { _meta: block._meta } : {})
+        })
+        break
+      case 'unknown': {
+        // Unknown blocks were retained as bounded JSON precisely so a newer
+        // consumer can still receive them. Parse defensively; malformed raw
+        // data is omitted rather than making the whole result invalid.
+        try {
+          const raw = block.raw ? JSON.parse(block.raw) : undefined
+          if (isRecord(raw)) content.push(raw)
+        } catch {
+          /* omit one malformed unknown block */
+        }
+        break
+      }
+    }
+  }
+  return {
+    content,
+    ...(result.structuredContent !== undefined
+      ? { structuredContent: result.structuredContent }
+      : {}),
+    ...(result.isError ? { isError: true } : {}),
+    ...(result._meta ? { _meta: result._meta } : {})
+  }
+}
+
+/**
+ * Render a result as the text the MODEL sees.
+ *
+ * The single place a lossless result is allowed to become a string. Every block
+ * contributes something legible: a resource link keeps its URI (so the model can
+ * ask for it by name), an omitted payload says so rather than vanishing, and a
+ * block we don't understand still reports its type instead of silently emptying.
+ */
+export function toModelText(result: McpCallResult): string {
+  const parts: string[] = []
+  for (const b of result.content) {
+    switch (b.kind) {
+      case 'text':
+        parts.push(b.truncated ? `${b.text}\n…[truncated]` : b.text)
+        break
+      case 'image':
+      case 'audio':
+        parts.push(b.omitted ? `[${b.kind} omitted: too large]` : `[${b.kind}: ${b.mimeType}]`)
+        break
+      case 'resource_link':
+        // The URI stays verbatim: it is an address the model can act on.
+        parts.push(`[resource: ${b.name || b.title || b.uri}](${b.uri})`)
+        break
+      case 'resource':
+        if (b.text) parts.push(b.truncated ? `${b.text}\n…[truncated]` : b.text)
+        else if (b.omitted) parts.push(`[resource ${b.uri}: contents too large]`)
+        else parts.push(`[resource: ${b.uri}]`)
+        break
+      case 'unknown':
+        parts.push(`[unsupported content${b.type ? `: ${b.type}` : ''}]`)
+        break
+    }
+  }
+  if (result.droppedBlocks) {
+    parts.push(`…[${result.droppedBlocks} further block(s) omitted]`)
+  }
+
+  // Only fall back to the structured half when the blocks said nothing. A server
+  // returning both means text for the model and structure for the application;
+  // appending the JSON too would pay twice in context for one answer.
+  let joined = parts.join('\n').trim()
+  if (!joined && result.structuredContent !== undefined) {
+    joined = boundedJson(result.structuredContent) ?? ''
+  }
+  return joined
+}
+
+/**
+ * Lower a lossless result to the flat `ToolResult` the agent loop and UI use.
+ *
+ * Keeps the FIRST inline image as the renderable preview, matching how every
+ * other Roxy tool reports imagery.
+ */
+export function toToolResult(result: McpCallResult): ToolResult {
+  const text = toModelText(result)
+  const output =
+    text || (result.isError ? 'The MCP tool reported an error with no message.' : '(no output)')
+  const out: ToolResult = { ok: !result.isError, output }
+  const img = result.content.find(
+    (b): b is McpBinaryBlock => b.kind === 'image' && !!(b as McpBinaryBlock).data
+  )
+  if (img?.data) out.image = `data:${img.mimeType};base64,${img.data}`
+  return out
+}
+
+/** JSON for display, bounded, never throwing on a cycle or a BigInt. */
+function boundedJson(value: unknown): string | undefined {
+  const json = safeJson(value)
+  if (!json) return undefined
+  return json.length > MCP_LIMITS.jsonChars ? json.slice(0, MCP_LIMITS.jsonChars) : json
+}
+
+function safeJson(value: unknown): string | undefined {
+  try {
+    return JSON.stringify(value, null, 2) ?? undefined
+  } catch {
+    return undefined
+  }
+}
diff --git a/src/shared/mcp-trust.ts b/src/shared/mcp-trust.ts
new file mode 100644
index 0000000..fe1b7dc
--- /dev/null
+++ b/src/shared/mcp-trust.ts
@@ -0,0 +1,478 @@
+/**
+ * MCP server trust — deciding when Roxy may start a server, and what to tell the
+ * user when it does.
+ *
+ * Pure logic only (no Node/Electron/SDK imports) so every rule here is unit
+ * tested in smoke:shared. Store + prompt plumbing lives in
+ * `src/main/services/mcp-trust.ts`.
+ *
+ * ## The stance
+ *
+ * Installing an MCP server is like installing an extension: the user picked the
+ * source, and picking the source IS the decision. Roxy is not in a position to
+ * second-guess it — an approval dialog in front of an action the user just took
+ * teaches nothing, and a dialog people always approve is worse than no dialog,
+ * because it trains the reflex that later waves through the one that mattered.
+ *
+ * So the default is YES: servers connect, and the user is TOLD what happened —
+ * which tools appeared, and where they came from. Disclosure after the fact,
+ * not permission before it.
+ *
+ * Two things are still gated, because neither is a decision the user made:
+ *
+ *  - **A definition Roxy has never shown anyone.** Not a veto, a notification:
+ *    the servers a project declares are surfaced with their tools, once.
+ *  - **A trusted entry whose command changed.** Approving `npx server-github`
+ *    is not approving whatever replaced it. This is the one case that gets a
+ *    real, blocking prompt, because it is the one case the user did not do.
+ *
+ * The warning belongs where the trust actually lives: the SOURCE. An MCP server
+ * runs with your privileges, so the honest message is "trust the source you got
+ * this from", not "are you sure?" — a question the user cannot answer better
+ * than they already did when they chose it.
+ */
+
+import type { McpServerConfig, McpLocalConfig, McpRemoteConfig } from './mcp'
+
+// ---------------------------------------------------------------------------
+// Provenance
+// ---------------------------------------------------------------------------
+
+/**
+ * Where a server definition came from. Drives what the user is TOLD, and (for
+ * the one blocking case) whether they are asked.
+ *
+ * - `user`      added in Settings / the MCP page.
+ * - `workspace` declared by a project file (`.roxy/mcp.json`).
+ * - `agent`     added by the model via the `mcp` tool.
+ * - `import`    arrived in a portable config bundle.
+ */
+export type McpProvenance = 'user' | 'workspace' | 'agent' | 'import'
+
+// ---------------------------------------------------------------------------
+// Fingerprinting — the identity a remembered decision is bound to
+// ---------------------------------------------------------------------------
+
+/**
+ * Canonical string identifying WHAT WILL EXECUTE, so Roxy can tell "the server
+ * you already know" from "something else wearing its name".
+ *
+ * Included, because changing any of them changes what runs:
+ *   local  → argv, cwd, and the NAMES of injected env vars
+ *   remote → scheme, host, port, path, and the NAMES of injected headers
+ *
+ * Excluded, deliberately:
+ *   - env/header VALUES. They are secrets (`GITHUB_TOKEN`), and rotating a token
+ *     is not a new decision. The NAMES are in, because gaining
+ *     `AWS_SECRET_ACCESS_KEY` where there was none is.
+ *   - `timeout`. A number that cannot change what executes.
+ *   - the server id. Renaming an entry is not re-installing it.
+ *
+ * Not a hash: this string is shown in the UI and diffed in tests, so it is kept
+ * legible on purpose. It is an identity key, never a security token.
+ */
+export function fingerprintConfig(config: McpServerConfig): string {
+  if (config.type === 'local') {
+    const cfg = config as McpLocalConfig
+    const argv = cfg.command.join('\u0000')
+    const cwd = cfg.cwd ?? ''
+    const envNames = Object.keys(cfg.environment ?? {})
+      .sort()
+      .join(',')
+    return `local\u0001${argv}\u0001${cwd}\u0001${envNames}`
+  }
+  const cfg = config as McpRemoteConfig
+  const headerNames = Object.keys(cfg.headers ?? {})
+    .sort()
+    .join(',')
+  return `remote\u0001${canonicalUrl(cfg.url)}\u0001${headerNames}`
+}
+
+/**
+ * Normalize a URL for fingerprinting so cosmetic differences (case, a trailing
+ * slash, the default port) don't read as a different server.
+ *
+ * Query and fragment are KEPT: `?tenant=acme` can select an entirely different
+ * backend. An unparseable URL falls back to the trimmed raw string — a config
+ * that cannot be parsed must never silently collapse onto another's identity.
+ */
+function canonicalUrl(raw: string): string {
+  try {
+    const u = new URL(raw.trim())
+    const protocol = u.protocol.toLowerCase()
+    const host = u.hostname.toLowerCase()
+    const port = u.port && !isDefaultPort(protocol, u.port) ? `:${u.port}` : ''
+    const path = u.pathname.replace(/\/+$/, '')
+    return `${protocol}//${host}${port}${path}${u.search}${u.hash}`
+  } catch {
+    return raw.trim()
+  }
+}
+
+function isDefaultPort(protocol: string, port: string): boolean {
+  return (protocol === 'http:' && port === '80') || (protocol === 'https:' && port === '443')
+}
+
+// ---------------------------------------------------------------------------
+// Disclosure — what the user is shown
+// ---------------------------------------------------------------------------
+
+/**
+ * The facts about a server, derived from its config so the UI cannot drift from
+ * what actually runs, and so the copy is testable without rendering React.
+ */
+export interface McpDisclosure {
+  transport: 'local' | 'remote'
+  /** The resolved executable — argv[0] for a local server. */
+  executable?: string
+  /** Arguments after argv[0], verbatim (never re-quoted or shortened). */
+  args?: string[]
+  /** Working directory as written; `undefined` means the workspace root. */
+  cwd?: string
+  /** NAMES of injected env vars, sorted. Values are never included. */
+  envNames?: string[]
+  /** Full URL for a remote server. */
+  url?: string
+  /** Host of the remote URL — the thing to actually recognise or not. */
+  host?: string
+  /** NAMES of injected headers, sorted. Values are never included. */
+  headerNames?: string[]
+  /** Whether any credential-shaped env var / header is being injected. */
+  injectsSecrets: boolean
+  /**
+   * The package or host the server comes FROM (`@modelcontextprotocol/server-github`,
+   * `api.acme.com`). This is the thing worth trusting or not, so it is the thing
+   * the UI leads with.
+   */
+  source: string
+}
+
+/** Env/header names that look like credentials, for the "shares a secret" note. */
+const SECRET_NAME =
+  /(?:^|_)(?:token|key|secret|password|passwd|credential|auth|apikey|session)s?(?:_|$)/i
+
+/** Runners that front for a package: the interesting name is their argument. */
+const PACKAGE_RUNNERS = /^(?:npx|pnpx|bunx|uvx|pipx|deno|dlx)$/i
+
+/** Flags to skip when hunting for the package name after a runner. */
+const RUNNER_FLAGS = /^-/
+
+/**
+ * The source a server actually comes from.
+ *
+ * `npx -y @modelcontextprotocol/server-github` is not meaningfully "npx" — it is
+ * the package, and the package is what the user is being asked to trust. Same
+ * for a remote server: the host, not the full URL with its path and query.
+ */
+export function sourceOf(config: McpServerConfig): string {
+  if (config.type === 'remote') {
+    try {
+      return new URL(config.url).host
+    } catch {
+      return config.url
+    }
+  }
+  const [exe, ...rest] = (config as McpLocalConfig).command
+  if (!exe) return ''
+  const base = exe.replace(/\\/g, '/').split('/').pop() ?? exe
+  if (PACKAGE_RUNNERS.test(base.replace(/\.(?:exe|cmd|bat)$/i, ''))) {
+    const pkg = rest.find((a) => !RUNNER_FLAGS.test(a))
+    if (pkg) return pkg
+  }
+  return base
+}
+
+/** Build the disclosure shown alongside a server. */
+export function describeConfig(config: McpServerConfig): McpDisclosure {
+  if (config.type === 'local') {
+    const cfg = config as McpLocalConfig
+    const [executable, ...args] = cfg.command
+    const envNames = Object.keys(cfg.environment ?? {}).sort()
+    return {
+      transport: 'local',
+      executable: executable ?? '',
+      args,
+      cwd: cfg.cwd,
+      envNames,
+      injectsSecrets: envNames.some((n) => SECRET_NAME.test(n)),
+      source: sourceOf(config)
+    }
+  }
+  const cfg = config as McpRemoteConfig
+  const headerNames = Object.keys(cfg.headers ?? {}).sort()
+  let host: string | undefined
+  try {
+    host = new URL(cfg.url).host
+  } catch {
+    host = undefined
+  }
+  return {
+    transport: 'remote',
+    url: cfg.url,
+    host,
+    headerNames,
+    injectsSecrets: headerNames.some((n) => SECRET_NAME.test(n) || /^authorization$/i.test(n)),
+    source: sourceOf(config)
+  }
+}
+
+/**
+ * A one-line summary for compact UI (list rows, the agent's tool output).
+ * Local servers show the command; remote servers show the host, since the full
+ * URL of an API endpoint is noise in a list.
+ */
+export function summarizeConfig(config: McpServerConfig): string {
+  const d = describeConfig(config)
+  if (d.transport === 'local') {
+    return [d.executable, ...(d.args ?? [])].filter(Boolean).join(' ')
+  }
+  return d.host || d.url || ''
+}
+
+// ---------------------------------------------------------------------------
+// Stored decisions
+// ---------------------------------------------------------------------------
+
+/** A remembered decision about one server. */
+export interface McpTrustEntry {
+  /** Server id as it was when decided (display only — identity is the fingerprint). */
+  id: string
+  /** `fingerprintConfig` of the config this decision covers. */
+  fingerprint: string
+  /** Where it came from when the decision was made. */
+  provenance: McpProvenance
+  /**
+   * Absolute workspace path this decision is scoped to, or null for "anywhere".
+   *
+   * Workspace-declared servers are scoped so that one project's `db` server is
+   * not confused with a different project's `db` server.
+   */
+  scope: string | null
+  decision: 'allow' | 'deny'
+  decidedAt: number
+}
+
+/** A whole workspace the user chose to trust, covering its current + future servers. */
+export interface McpWorkspaceTrust {
+  /** Absolute workspace path. */
+  path: string
+  trustedAt: number
+}
+
+/** The persisted trust state, as handed to the pure resolver. */
+export interface McpTrustStore {
+  entries: McpTrustEntry[]
+  workspaces: McpWorkspaceTrust[]
+}
+
+/** User-controlled policy knobs. */
+export interface McpTrustPolicy {
+  /**
+   * Ask before starting any server Roxy hasn't run before, instead of starting
+   * it and reporting what it exposed.
+   *
+   * OFF by default: installing a server is itself the decision, so the useful
+   * output is "here is what it gave you", not "are you sure?". People who want
+   * the stricter posture (shared machines, untrusted repos) can opt in.
+   */
+  confirmBeforeRun: boolean
+}
+
+export const DEFAULT_TRUST_POLICY: McpTrustPolicy = { confirmBeforeRun: false }
+
+// ---------------------------------------------------------------------------
+// The decision
+// ---------------------------------------------------------------------------
+
+/** Why a server may start (or must not) — surfaced in logs, tests, and the UI. */
+export type McpTrustReason =
+  /** The user configured it themselves. */
+  | 'self-consented'
+  /** The user trusted the whole workspace. */
+  | 'workspace-trusted'
+  /** A stored allow decision matched this exact fingerprint. */
+  | 'remembered-allow'
+  /** A stored deny decision matched this exact fingerprint. */
+  | 'remembered-deny'
+  /** Not seen before; allowed, and disclosed to the user afterwards. */
+  | 'first-run'
+  /** Not seen before, and the user opted into confirming first. */
+  | 'confirm-first-run'
+  /** Approved before, but what would execute has changed since. */
+  | 'changed'
+
+export interface McpTrustDecision {
+  allowed: boolean
+  /** True when the user must be asked BEFORE this server may start. */
+  needsPrompt: boolean
+  /**
+   * True when the server may start, but the user should be TOLD - with its tool
+   * list and source - once it is up. The disclosure that replaces a prompt.
+   */
+  needsDisclosure: boolean
+  reason: McpTrustReason
+  /** For `changed`, the fingerprint that was previously approved. */
+  previousFingerprint?: string
+}
+
+/**
+ * Decide what happens with a server. Pure: same inputs, same answer, no I/O.
+ *
+ * Order matters:
+ *   1. A remembered DENY — the user said no; honour it without re-asking.
+ *   2. A remembered ALLOW for this exact fingerprint — silent, the steady state.
+ *   3. A fingerprint MISMATCH → `changed`. The one blocking prompt: the user
+ *      approved a different command, and swapping it is not their decision.
+ *      Checked before workspace trust so a swap resurfaces even in a trusted
+ *      project.
+ *   4. Self-consent / workspace trust → run silently.
+ *   5. Anything else → RUN, and disclose (or prompt, if the user opted in).
+ */
+export function decideTrust(input: {
+  id: string
+  config: McpServerConfig
+  provenance: McpProvenance
+  /** Absolute workspace path, when the server is scoped to one. */
+  workspace?: string | null
+  store: McpTrustStore
+  policy?: McpTrustPolicy
+}): McpTrustDecision {
+  const { id, config, provenance, store } = input
+  const policy = input.policy ?? DEFAULT_TRUST_POLICY
+  const workspace = input.workspace ?? null
+
+  const fingerprint = fingerprintConfig(config)
+  const relevant = store.entries.filter((e) => e.id === id && inScope(e.scope, workspace))
+
+  const denied = relevant.find((e) => e.decision === 'deny' && e.fingerprint === fingerprint)
+  if (denied) {
+    return {
+      allowed: false,
+      needsPrompt: false,
+      needsDisclosure: false,
+      reason: 'remembered-deny'
+    }
+  }
+
+  const allowed = relevant.find((e) => e.decision === 'allow' && e.fingerprint === fingerprint)
+  if (allowed) {
+    return {
+      allowed: true,
+      needsPrompt: false,
+      needsDisclosure: false,
+      reason: 'remembered-allow'
+    }
+  }
+
+  // The one case worth interrupting for: this name was approved running
+  // something ELSE. Not a first install - a substitution.
+  const prior = relevant.find((e) => e.decision === 'allow')
+  if (prior) {
+    return {
+      allowed: false,
+      needsPrompt: true,
+      needsDisclosure: false,
+      reason: 'changed',
+      previousFingerprint: prior.fingerprint
+    }
+  }
+
+  if (provenance === 'user') {
+    return { allowed: true, needsPrompt: false, needsDisclosure: false, reason: 'self-consented' }
+  }
+
+  if (workspace && store.workspaces.some((w) => samePath(w.path, workspace))) {
+    return {
+      allowed: true,
+      needsPrompt: false,
+      needsDisclosure: false,
+      reason: 'workspace-trusted'
+    }
+  }
+
+  if (policy.confirmBeforeRun) {
+    return {
+      allowed: false,
+      needsPrompt: true,
+      needsDisclosure: false,
+      reason: 'confirm-first-run'
+    }
+  }
+
+  // Default: run it, then tell the user what it exposed and where it came from.
+  return { allowed: true, needsPrompt: false, needsDisclosure: true, reason: 'first-run' }
+}
+
+/**
+ * Whether a stored decision applies here. A `null` scope is global (it came from
+ * a non-workspace source); a scoped entry only applies in its own workspace, so
+ * one repo's decision never leaks into another's.
+ */
+function inScope(scope: string | null, workspace: string | null): boolean {
+  if (scope === null) return true
+  if (!workspace) return false
+  return samePath(scope, workspace)
+}
+
+/**
+ * Compare two absolute paths. Case-insensitive (Windows and macOS both have
+ * case-insensitive filesystems by default, and treating `C:\Repo` as a
+ * different project from `c:\repo` would re-disclose the same folder).
+ * Separators are normalized so a path that arrived over IPC still matches.
+ */
+export function samePath(a: string, b: string): boolean {
+  return normalizePath(a) === normalizePath(b)
+}
+
+function normalizePath(p: string): string {
+  return p.replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase()
+}
+
+// ---------------------------------------------------------------------------
+// Payloads
+// ---------------------------------------------------------------------------
+
+/**
+ * "Here's what you just installed" — sent AFTER a server connects, listing the
+ * tools it exposes and the source it came from.
+ *
+ * This is the normal path. It is not a permission request; it is the receipt.
+ */
+export interface McpInstallNotice {
+  id: string
+  provenance: McpProvenance
+  /** Workspace the server is scoped to, when it came from one. */
+  workspace: string | null
+  disclosure: McpDisclosure
+  /** Unqualified tool names the server exposed, in discovery order. */
+  tools: string[]
+  /** Set when the server failed to start; the notice doubles as the error report. */
+  error?: string
+}
+
+/** A blocking question. Only raised for `changed`, or when the user opts in. */
+export interface McpConsentRequest {
+  /** Correlates the renderer's answer with the awaiting main-process promise. */
+  requestId: string
+  id: string
+  config: McpServerConfig
+  provenance: McpProvenance
+  workspace: string | null
+  disclosure: McpDisclosure
+  /** `changed` = a trusted entry was altered; `confirm-first-run` = opted-in check. */
+  reason: Extract<McpTrustReason, 'changed' | 'confirm-first-run'>
+  /** Human-readable summary of the previously approved config, for `changed`. */
+  previousSummary?: string
+}
+
+/** The user's answer. `scope` says how widely to remember it. */
+export interface McpConsentResponse {
+  requestId: string
+  decision: 'allow' | 'deny'
+  /**
+   * - `once`      run now, remember nothing.
+   * - `server`    remember this server + fingerprint.
+   * - `workspace` trust the workspace: every server it declares, now and later.
+   */
+  scope: 'once' | 'server' | 'workspace'
+}
diff --git a/src/shared/mcp.ts b/src/shared/mcp.ts
index 7eab3e8..a4c4b0c 100644
--- a/src/shared/mcp.ts
+++ b/src/shared/mcp.ts
@@ -1,7 +1,7 @@
 /**
  * Pure MCP (Model Context Protocol) primitives — no Node/SDK imports, so this is
  * fully testable in smoke:shared. The transport + client lifecycle (built on the
- * official `@modelcontextprotocol/sdk`) lives in `src/main/services/mcp.ts`.
+ * official `@modelcontextprotocol/client`) lives in `src/main/services/mcp.ts`.
  *
  * What lives here:
  *  - Server config types + a defensive normalizer (parses untrusted JSON from the
@@ -14,6 +14,7 @@
  */
 
 import type { ToolResult } from './types'
+import { parseCallResult, toToolResult } from './mcp-content'
 
 // ---------------------------------------------------------------------------
 // Config types
@@ -42,11 +43,55 @@ export interface McpRemoteConfig {
 
 export type McpServerConfig = McpLocalConfig | McpRemoteConfig
 
+/**
+ * Which protocol era a connection negotiated.
+ *
+ * `legacy` is the `initialize` handshake (revisions `2024-10-07` through
+ * `2025-11-25`); `modern` is `2026-07-28`+, which replaced the handshake with a
+ * `server/discover` advertisement and a per-request `_meta` envelope. Mirrors
+ * the SDK's own `ProtocolEra`, re-declared here so this isomorphic module stays
+ * free of SDK imports.
+ */
+export type McpProtocolEra = 'legacy' | 'modern'
+
+/**
+ * A tool exactly as the server described it.
+ *
+ * Deliberately loose: Roxy stores the definition verbatim and reads specific
+ * keys (`_meta`, `outputSchema`) where it understands them, rather than
+ * modelling a spec that is still gaining fields. Narrow at the point of use.
+ */
+export interface McpToolDefinition {
+  name: string
+  title?: string
+  description?: string
+  inputSchema?: unknown
+  outputSchema?: unknown
+  annotations?: Record<string, unknown>
+  icons?: unknown
+  /** Extension data - where MCP Apps puts `io.modelcontextprotocol/ui`. */
+  _meta?: Record<string, unknown>
+}
+
 /** A configured server as persisted (DB row / workspace-file entry). */
 export interface McpServerRecord {
   id: string
   config: McpServerConfig
   enabled: boolean
+  /**
+   * Who put this row in the database.
+   *
+   * Persisted because it is a SECURITY fact, not UI trivia: a row the user typed
+   * in Settings is self-consenting, while one the `mcp` tool added came from the
+   * model (which reads web pages, issues and READMEs) and must clear the consent
+   * gate before it can run. Without this column an agent-added command would be
+   * indistinguishable from a user-added one the moment it was written, laundering
+   * itself into "the user configured this".
+   *
+   * Absent on rows written before this existed, and on workspace-file entries
+   * (whose provenance comes from the file they were read out of, not the DB).
+   */
+  origin?: 'user' | 'agent'
 }
 
 // ---------------------------------------------------------------------------
@@ -329,49 +374,25 @@ function sanitizeJsonSchema(schema: unknown): Record<string, unknown> {
 // Result rendering (MCP CallTool content blocks → roxy ToolResult)
 // ---------------------------------------------------------------------------
 
-interface McpContentBlock {
-  type?: string
-  text?: string
-  data?: string
-  mimeType?: string
-  resource?: { uri?: string; text?: string; mimeType?: string }
-}
-
 /**
- * Flatten an MCP `tools/call` result into a roxy `ToolResult`. Text blocks are
- * joined; the first image block becomes the inline `image` (data URL); resources
- * contribute their inline text or a URI pointer. `isError` maps to `ok:false`.
+ * Flatten an MCP `tools/call` result into a roxy `ToolResult`.
+ *
+ * A thin projection over the lossless model in `./mcp-content`: parse the raw
+ * result into typed blocks (keeping resource URIs, `_meta`, every image, and
+ * anything this version doesn't recognise), then lower THAT to a string for the
+ * model. The parse is the source of truth; this is one of its consumers.
+ *
+ * Kept as a function because callers that only want the flat form shouldn't have
+ * to know about the two-step. Callers that want the structure - MCP Apps needs
+ * `_meta`, resource links need their URI - should call `parseCallResult`
+ * directly and read the result, rather than re-deriving anything from this text.
  */
-export function renderMcpContent(content: unknown, isError: boolean | undefined): ToolResult {
-  const blocks = Array.isArray(content) ? (content as McpContentBlock[]) : []
-  const parts: string[] = []
-  let image: string | undefined
-
-  for (const b of blocks) {
-    if (!b || typeof b !== 'object') continue
-    if (b.type === 'text' && typeof b.text === 'string') {
-      parts.push(b.text)
-    } else if (b.type === 'image' && typeof b.data === 'string') {
-      const mime = typeof b.mimeType === 'string' && b.mimeType ? b.mimeType : 'image/png'
-      if (!image) image = `data:${mime};base64,${b.data}`
-      parts.push(`[image: ${mime}]`)
-    } else if (b.type === 'audio' && typeof b.data === 'string') {
-      parts.push(`[audio: ${b.mimeType || 'audio'}]`)
-    } else if (b.type === 'resource' && b.resource && typeof b.resource === 'object') {
-      const r = b.resource
-      if (typeof r.text === 'string' && r.text) parts.push(r.text)
-      else if (typeof r.uri === 'string' && r.uri) parts.push(`[resource: ${r.uri}]`)
-    } else if (typeof b.text === 'string') {
-      parts.push(b.text)
-    }
-  }
-
-  const joined = parts.join('\n').trim()
-  const output =
-    joined || (isError ? 'The MCP tool reported an error with no message.' : '(no output)')
-  const result: ToolResult = { ok: !isError, output }
-  if (image) result.image = image
-  return result
+export function renderMcpContent(
+  content: unknown,
+  isError: boolean | undefined,
+  structuredContent?: unknown
+): ToolResult {
+  return toToolResult(parseCallResult({ content, isError, structuredContent }))
 }
 
 // ---------------------------------------------------------------------------
@@ -384,6 +405,11 @@ export interface McpServerSummary {
   /** Unqualified tool display names exposed by the server. */
   tools: string[]
   error?: string
+  /**
+   * Protocol era this server negotiated, once connected. Undefined for servers
+   * that never connected (and, harmlessly, for any that predate the field).
+   */
+  era?: McpProtocolEra
 }
 
 /**
diff --git a/src/shared/parts.ts b/src/shared/parts.ts
index bb57d8e..81f93b8 100644
--- a/src/shared/parts.ts
+++ b/src/shared/parts.ts
@@ -108,7 +108,9 @@ function foldInto(
             state: event.ok ? 'done' : 'error',
             output: cap > 0 ? capChildOutput(event.output) : event.output,
             image: event.image,
-            diff: event.diff
+            diff: event.diff,
+            // Carried through so the card can mount a server-supplied view.
+            mcpApp: event.mcpApp
           }
         : p
     )
diff --git a/src/shared/types.ts b/src/shared/types.ts
index 7937c5d..f6532b7 100644
--- a/src/shared/types.ts
+++ b/src/shared/types.ts
@@ -223,6 +223,14 @@ export type MessagePart =
       callId?: string
       /** The arguments the model passed to the tool — rebuilds `tool_calls[].function.arguments`. */
       input?: Record<string, unknown>
+      /**
+       * The MCP App this tool declared, if any.
+       *
+       * Resolved in main at tool-call time (from the tool’s `_meta`) and
+       * carried on the part so the card can mount a view without the
+       * renderer having to know anything about MCP metadata.
+       */
+      mcpApp?: { serverId: string; resourceUri: string }
       /** One-line summary shown on the tool card (e.g. the command run). */
       title?: string
       /**
diff --git a/test/fixtures/mock-mcp-modern.cjs b/test/fixtures/mock-mcp-modern.cjs
new file mode 100644
index 0000000..fd0997a
--- /dev/null
+++ b/test/fixtures/mock-mcp-modern.cjs
@@ -0,0 +1,280 @@
+/**
+ * Mock MCP server speaking the MODERN protocol era (revision 2026-07-28).
+ *
+ * The sibling `mock-mcp.cjs` is a 2025-era server: it answers `initialize` and
+ * returns method-not-found for anything it doesn't know. This one is its
+ * opposite - it answers `server/discover` and refuses `initialize` - so together
+ * they pin BOTH branches of `versionNegotiation: { mode: 'auto' }`:
+ *
+ *   mock-mcp.cjs        -> probe rejected -> fall back to `initialize` -> legacy
+ *   mock-mcp-modern.cjs -> probe answered -> no handshake               -> modern
+ *
+ * Without this fixture the auto-negotiation path would be half-tested: a suite
+ * where every server is legacy passes just as well with negotiation switched off
+ * entirely, which is precisely the regression worth catching.
+ *
+ * Tools mirror the legacy mock (`echo`, `boom`) and add `structured`, which
+ * returns ONLY `structuredContent` - the case where a result carries typed data
+ * and no text blocks at all.
+ *
+ * Run as: <node|electron-as-node> mock-mcp-modern.cjs
+ */
+'use strict'
+
+const PROTOCOL_VERSION = '2026-07-28'
+
+let buf = ''
+
+// Larger than Roxy's normal 200k model-text cap, matching the published map
+// app (~343k). If app HTML is treated as prose this is truncated mid-bundle.
+const MOCK_APP_HTML =
+  '<!doctype html><html><body><h1>hi</h1><script>window.__complete=true</script>' +
+  'x'.repeat(342000) +
+  '<!--app-complete--></body></html>'
+const MOCK_APP_META = {
+  ui: {
+    csp: {
+      connectDomains: ['https://*.openstreetmap.org', 'https://cesium.com', 'https://*.cesium.com'],
+      resourceDomains: ['https://*.openstreetmap.org', 'https://cesium.com', 'https://*.cesium.com']
+    }
+  }
+}
+
+process.stdin.setEncoding('utf8')
+process.stdin.on('data', (chunk) => {
+  buf += chunk
+  for (;;) {
+    const nl = buf.indexOf('\n')
+    if (nl < 0) break
+    const line = buf.slice(0, nl).trim()
+    buf = buf.slice(nl + 1)
+    if (!line) continue
+    let msg
+    try {
+      msg = JSON.parse(line)
+    } catch {
+      continue
+    }
+    handle(msg)
+  }
+})
+
+function send(obj) {
+  process.stdout.write(JSON.stringify(obj) + '\n')
+}
+
+/**
+ * Reply with a successful result.
+ *
+ * Every modern-era result MUST carry `resultType`: the 2026-07-28 revision
+ * removed the "absent means complete" bridge that earlier revisions allowed, and
+ * the SDK rejects a result without it. Funnelling every success through one
+ * helper keeps that invariant in a single place.
+ */
+function sendResult(id, result) {
+  send({ jsonrpc: '2.0', id, result: { resultType: 'complete', ...result } })
+}
+
+const TOOLS = [
+  {
+    name: 'echo',
+    description: 'Echo back the provided message.',
+    inputSchema: {
+      type: 'object',
+      properties: { message: { type: 'string', description: 'Text to echo' } },
+      required: ['message']
+    }
+  },
+  {
+    name: 'boom',
+    description: 'Always fails (for error-path testing).',
+    inputSchema: { type: 'object', properties: {} }
+  },
+  {
+    // Declared app-only: it exists for the VIEW to call, and SEP-1865 says the
+    // host MUST NOT offer it to the model.
+    name: 'set_cell',
+    description: 'Internal operation for the view.',
+    inputSchema: { type: 'object', properties: {} },
+    _meta: { 'io.modelcontextprotocol/ui': { visibility: ['app'] } }
+  },
+  {
+    // Never answers within the test's patience: used to prove a cancelled call
+    // stops waiting rather than hanging for the full request timeout.
+    name: 'slow',
+    description: 'Never replies.',
+    inputSchema: { type: 'object', properties: {} }
+  },
+  {
+    // Returns a mixed result: prose, an addressable resource link, a second
+    // image, and result-level _meta. The flat projection can represent none of
+    // it faithfully, which is the point.
+    name: 'rich',
+    description: 'Returns mixed content plus result metadata.',
+    inputSchema: { type: 'object', properties: {} }
+  },
+  {
+    // Declares an outputSchema and returns ONLY structuredContent, so the
+    // client's structured-result handling is exercised for real.
+    name: 'structured',
+    description: 'Returns typed output and no text blocks.',
+    inputSchema: { type: 'object', properties: {} },
+    outputSchema: {
+      type: 'object',
+      properties: { total: { type: 'number' }, currency: { type: 'string' } },
+      required: ['total', 'currency']
+    },
+    // Extension metadata must survive discovery intact; MCP Apps keys its UI
+    // off exactly this shape.
+    // Short key on purpose: this is what @modelcontextprotocol/ext-apps'
+    // registerAppTool emits, and what every published example server carries.
+    _meta: { ui: { resourceUri: 'ui://mockmodern/app.html' } }
+  }
+]
+
+function handle(msg) {
+  if (msg.id === undefined || msg.id === null) return
+
+  switch (msg.method) {
+    // The modern-era advertisement that replaces the `initialize` handshake.
+    //
+    // Shape matters: the field is `supportedVersions` (NOT `protocolVersions`),
+    // and server identity lives in `_meta['io.modelcontextprotocol/serverInfo']`
+    // rather than a top-level `serverInfo`. Get either wrong and the client
+    // rejects the advertisement and quietly falls back to `initialize` - i.e.
+    // the test would still pass while proving the opposite of what it claims.
+    case 'server/discover':
+      sendResult(msg.id, {
+        supportedVersions: [PROTOCOL_VERSION],
+        capabilities: { tools: {}, resources: {} },
+        _meta: {
+          'io.modelcontextprotocol/serverInfo': { name: 'mock-mcp-modern', version: '0.0.1' }
+        }
+      })
+      return
+    // Deliberately refused: a modern server does not implement `initialize`.
+    // Answering it would make this fixture indistinguishable from the legacy
+    // mock and quietly defeat the point of the test.
+    case 'initialize':
+      send({
+        jsonrpc: '2.0',
+        id: msg.id,
+        error: { code: -32601, message: 'initialize is not supported (modern era)' }
+      })
+      return
+    // Modern-era list results carry cache hints (SEP-2549). They are required,
+    // not optional: the client validates the wire shape and rejects a list
+    // without them. `ttlMs: 0` means "usable, but don't hold it" - the honest
+    // answer for a fixture whose tool list is fixed for the life of the process.
+    case 'resources/list':
+      sendResult(msg.id, {
+        resources: [
+          {
+            uri: 'ui://mockmodern/app.html',
+            name: 'app.html',
+            mimeType: 'text/html;profile=mcp-app'
+          },
+          { uri: 'file:///notes.txt', name: 'notes.txt', mimeType: 'text/plain' }
+        ],
+        ttlMs: 0,
+        cacheScope: 'private'
+      })
+      return
+    case 'resources/read': {
+      const uri = msg.params && msg.params.uri
+      if (uri === 'ui://mockmodern/app.html') {
+        // The shape MCP Apps uses: an HTML view delivered as a resource.
+        sendResult(msg.id, {
+          contents: [
+            {
+              uri,
+              mimeType: 'text/html;profile=mcp-app',
+              text: MOCK_APP_HTML,
+              // Content-level metadata is where the official map server puts
+              // its Cesium/OpenStreetMap CSP.
+              _meta: MOCK_APP_META
+            }
+          ],
+          ttlMs: 0,
+          cacheScope: 'private'
+        })
+        return
+      }
+      if (uri === 'file:///notes.txt') {
+        sendResult(msg.id, {
+          contents: [{ uri, mimeType: 'text/plain', text: 'note body' }],
+          ttlMs: 0,
+          cacheScope: 'private'
+        })
+        return
+      }
+      send({
+        jsonrpc: '2.0',
+        id: msg.id,
+        error: { code: -32602, message: 'Unknown resource: ' + String(uri) }
+      })
+      return
+    }
+    case 'tools/list':
+      sendResult(msg.id, { tools: TOOLS, ttlMs: 0, cacheScope: 'private' })
+      return
+    case 'tools/call': {
+      const name = msg.params && msg.params.name
+      const args = (msg.params && msg.params.arguments) || {}
+      if (name === 'echo') {
+        sendResult(msg.id, {
+          content: [{ type: 'text', text: 'echo: ' + String(args.message ?? '') }]
+        })
+        return
+      }
+      if (name === 'boom') {
+        sendResult(msg.id, {
+          content: [{ type: 'text', text: 'boom: intentional failure' }],
+          isError: true
+        })
+        return
+      }
+      if (name === 'set_cell') {
+        sendResult(msg.id, { content: [{ type: 'text', text: 'cell set' }] })
+        return
+      }
+      if (name === 'slow') {
+        // Deliberately no reply, ever.
+        return
+      }
+      if (name === 'rich') {
+        sendResult(msg.id, {
+          content: [
+            { type: 'text', text: 'here is the report' },
+            {
+              type: 'resource_link',
+              uri: 'file:///repo/report.pdf',
+              name: 'report.pdf',
+              mimeType: 'application/pdf'
+            },
+            { type: 'image', data: 'AAA', mimeType: 'image/png' },
+            { type: 'image', data: 'BBB', mimeType: 'image/jpeg' }
+          ],
+          _meta: { 'io.modelcontextprotocol/ui': { resourceUri: 'ui://mockmodern/app.html' } }
+        })
+        return
+      }
+      if (name === 'structured') {
+        sendResult(msg.id, {
+          content: [],
+          structuredContent: { total: 61.5, currency: 'EUR' },
+          _meta: { viewUUID: 'mock-view-uuid' }
+        })
+        return
+      }
+      send({
+        jsonrpc: '2.0',
+        id: msg.id,
+        error: { code: -32602, message: 'Unknown tool: ' + String(name) }
+      })
+      return
+    }
+    default:
+      send({ jsonrpc: '2.0', id: msg.id, error: { code: -32601, message: 'Method not found' } })
+  }
+}
diff --git a/test/fixtures/mock-mcp.cjs b/test/fixtures/mock-mcp.cjs
index dbd09e2..15faca0 100644
--- a/test/fixtures/mock-mcp.cjs
+++ b/test/fixtures/mock-mcp.cjs
@@ -1,10 +1,14 @@
 /**
  * Minimal mock MCP server for the Phase 13 smoke test. Speaks the real
  * newline-delimited JSON-RPC-over-stdio MCP wire protocol so it exercises the
- * ACTUAL @modelcontextprotocol/sdk Client machinery — initialize handshake,
- * capability negotiation, tools/list, tools/call — without needing an external
+ * ACTUAL @modelcontextprotocol/client machinery - the `initialize` handshake,
+ * capability negotiation, tools/list, tools/call - without needing an external
  * MCP server installed.
  *
+ * This is a 2025-era (`legacy`) server: it answers `initialize` and returns
+ * method-not-found for `server/discover`, so it exercises the FALLBACK branch of
+ * the client’s era negotiation. Its 2026-era counterpart is mock-mcp-modern.cjs.
+ *
  * Tools:
  *   - echo: returns a text result echoing its `message` argument.
  *   - boom: returns an `isError` result (to prove error rendering + ok:false).
diff --git a/test/shared.ts b/test/shared.ts
index 927b4d5..0a66f6b 100644
--- a/test/shared.ts
+++ b/test/shared.ts
@@ -270,6 +270,37 @@ import {
   serializeServerConfig,
   type McpServerSummary
 } from '../src/shared/mcp'
+import {
+  MCP_LIMITS,
+  parseCallResult,
+  parseResourceContents,
+  toModelText,
+  toToolResult
+} from '../src/shared/mcp-content'
+import {
+  APP_HEIGHT,
+  SUPPORTED_DISPLAY_MODES,
+  buildAllow,
+  buildCsp,
+  clampAppHeight,
+  externalDomains,
+  isAppOnlyTool,
+  isOpenableUrl,
+  negotiateDisplayMode,
+  routeBridgeMethod,
+  sanitizeDomains,
+  sanitizeMcpAppHostTheme,
+  uiResourceUri
+} from '../src/shared/mcp-apps'
+import {
+  DEFAULT_TRUST_POLICY,
+  decideTrust,
+  describeConfig,
+  fingerprintConfig,
+  sourceOf,
+  summarizeConfig,
+  type McpTrustStore
+} from '../src/shared/mcp-trust'
 import {
   SKILL_TOOL_NAME,
   SKILL_TOOL_DESCRIPTION,
@@ -2313,6 +2344,536 @@ check(
   'mcp render: empty content → placeholder',
   renderMcpContent([], false).output === '(no output)' && renderMcpContent([], false).ok
 )
+
+// structuredContent: a modern result may carry typed output and NO text blocks.
+// Reporting that as "(no output)" would describe a successful, data-returning
+// call as empty - so the structured half is serialized when nothing else spoke.
+check(
+  'mcp render: structured-only result is serialized, not dropped',
+  (() => {
+    const r = renderMcpContent([], false, { total: 61.5, currency: 'EUR' })
+    return r.ok && r.output.includes('61.5') && r.output.includes('EUR')
+  })()
+)
+// ...but when the tool also returned prose, the text is the model's view, and
+// appending the JSON would pay twice in context for one answer.
+check(
+  'mcp render: text wins over structured when both are present',
+  renderMcpContent([{ type: 'text', text: 'done' }], false, { total: 1 }).output === 'done'
+)
+// ---- MCP content: lossless in, projected out --------------------------------
+// The property under test is that parsing DOESN'T destroy anything. The old
+// renderer flattened on arrival, so a resource URI, a second image, and every
+// byte of `_meta` were gone before any consumer could look. Each case below is
+// something MCP Apps (or a future extension) needs to still be there.
+
+// A resource link is an ADDRESS. Flattening it to prose is the canonical loss.
+{
+  const r = parseCallResult({
+    content: [
+      {
+        type: 'resource_link',
+        uri: 'file:///repo/report.pdf',
+        name: 'report.pdf',
+        mimeType: 'application/pdf'
+      }
+    ]
+  })
+  const link = r.content[0]
+  check(
+    'mcp content: a resource link keeps its URI',
+    link.kind === 'resource_link' && link.uri === 'file:///repo/report.pdf'
+  )
+  check(
+    'mcp content: ...and its name and mime type',
+    link.kind === 'resource_link' &&
+      link.name === 'report.pdf' &&
+      link.mimeType === 'application/pdf'
+  )
+  // The model still needs to be able to refer to it.
+  check(
+    'mcp content: the URI survives into the model text',
+    toModelText(r).includes('file:///repo/report.pdf')
+  )
+}
+
+// Result-level `_meta` is where MCP Apps identifies the view a result belongs to.
+{
+  const r = parseCallResult({
+    content: [{ type: 'text', text: 'ok' }],
+    _meta: { 'io.modelcontextprotocol/ui': { resourceUri: 'ui://srv/app.html' } }
+  })
+  const ui = r._meta?.['io.modelcontextprotocol/ui'] as { resourceUri?: string } | undefined
+  check('mcp content: result _meta survives', ui?.resourceUri === 'ui://srv/app.html')
+  // ...but it is metadata, not prose: it must not leak into the model's view.
+  check(
+    'mcp content: _meta stays out of the model text',
+    !toModelText(r).includes('ui://srv/app.html')
+  )
+}
+
+// Every image is kept, not just the one the flat form can render.
+{
+  const r = parseCallResult({
+    content: [
+      { type: 'image', data: 'AAA', mimeType: 'image/png' },
+      { type: 'image', data: 'BBB', mimeType: 'image/jpeg' }
+    ]
+  })
+  check('mcp content: every image block is kept', r.content.length === 2)
+  const flat = toToolResult(r)
+  check(
+    'mcp content: the flat form previews the first image',
+    flat.image === 'data:image/png;base64,AAA'
+  )
+}
+
+// Block ORDER is meaning: interleaved text and images are a narrative.
+{
+  const r = parseCallResult({
+    content: [
+      { type: 'text', text: 'before' },
+      { type: 'image', data: 'AAA', mimeType: 'image/png' },
+      { type: 'text', text: 'after' }
+    ]
+  })
+  check(
+    'mcp content: block order is preserved',
+    r.content.map((b) => b.kind).join(',') === 'text,image,text'
+  )
+  const text = toModelText(r)
+  check(
+    'mcp content: ...and reflected in the model text',
+    text.indexOf('before') < text.indexOf('after')
+  )
+}
+
+// A block type this version doesn't model must stay recoverable, not vanish.
+{
+  const r = parseCallResult({ content: [{ type: 'video', src: 'x.mp4' }] })
+  const b = r.content[0]
+  check(
+    'mcp content: an unknown block is kept as unknown',
+    b.kind === 'unknown' && b.type === 'video'
+  )
+  check(
+    'mcp content: ...with its raw JSON retained',
+    b.kind === 'unknown' && !!b.raw && b.raw.includes('x.mp4')
+  )
+  check('mcp content: ...and is announced, not silently empty', toModelText(r).includes('video'))
+}
+
+// An embedded resource keeps its URI even when it also has inline text.
+{
+  const r = parseCallResult({
+    content: [
+      { type: 'resource', resource: { uri: 'file://a.txt', text: 'body', mimeType: 'text/plain' } }
+    ]
+  })
+  const b = r.content[0]
+  check(
+    'mcp content: an embedded resource keeps uri AND text',
+    b.kind === 'resource' && b.uri === 'file://a.txt' && b.text === 'body'
+  )
+  check('mcp content: its text is what the model reads', toModelText(r) === 'body')
+}
+
+// Annotations (audience, priority) are how a server says who a block is for.
+{
+  const r = parseCallResult({
+    content: [{ type: 'text', text: 'hi', annotations: { audience: ['user'], priority: 0.9 } }]
+  })
+  const b = r.content[0]
+  check(
+    'mcp content: block annotations survive',
+    b.kind === 'text' && (b.annotations?.audience as string[])?.[0] === 'user'
+  )
+}
+
+// ---- MCP Apps: the rules that keep untrusted HTML contained ----------------
+// Every check here is a containment property. The HTML is written by whoever
+// wrote the MCP server; these are the invariants that make running it survivable.
+
+check(
+  'mcp apps: a ui:// resource is found on tool _meta',
+  uiResourceUri({ 'io.modelcontextprotocol/ui': { resourceUri: 'ui://s/app.html' } }) ===
+    'ui://s/app.html'
+)
+check(
+  'mcp apps: a non-ui:// resourceUri is ignored',
+  uiResourceUri({
+    'io.modelcontextprotocol/ui': { resourceUri: 'https://evil.example/a.html' }
+  }) === undefined
+)
+check('mcp apps: a tool without ui meta has no view', uiResourceUri({}) === undefined)
+check('mcp apps: a tool with no meta at all is safe', uiResourceUri(undefined) === undefined)
+
+// visibility:["app"] means the server said this tool is NOT for the model.
+// Getting it backwards hands the model tools it was never offered.
+check(
+  'mcp apps: an app-only tool is hidden from the model',
+  isAppOnlyTool({ 'io.modelcontextprotocol/ui': { visibility: ['app'] } }) === true
+)
+check(
+  'mcp apps: an explicitly model-visible tool stays visible',
+  isAppOnlyTool({ 'io.modelcontextprotocol/ui': { visibility: ['model', 'app'] } }) === false
+)
+check(
+  'mcp apps: absent visibility means model-visible',
+  isAppOnlyTool({ 'io.modelcontextprotocol/ui': { resourceUri: 'ui://s/a.html' } }) === false
+)
+
+// ---- CSP: deny by default, and un-escapable -------------------------------
+{
+  const base = buildCsp(undefined)
+  check(
+    'mcp apps: bundled app code is allowed on the sandbox origin',
+    base.includes("default-src 'self' 'unsafe-inline'")
+  )
+  // The property is "no EXTERNAL reach", not a literal directive string.
+  // `self`, `data:` and `blob:` are all content the document already has - a
+  // blob URL is something it created itself - so they grant nothing new, while
+  // being required for WebGL/mapping views to start at all.
+  const connectDirective = base.split('; ').find((d) => d.startsWith('connect-src'))!
+  check(
+    'mcp apps: ...cannot reach any external origin',
+    !/https?:/.test(connectDirective),
+    connectDirective
+  )
+  check('mcp apps: ...and workers stay same-origin', base.includes("worker-src 'self' blob:"))
+  check('mcp apps: ...cannot frame anything', base.includes("frame-src 'none'"))
+  check('mcp apps: ...cannot load plugins', base.includes("object-src 'none'"))
+  check('mcp apps: ...cannot retarget relative URLs', base.includes("base-uri 'none'"))
+}
+{
+  const declared = buildCsp({ connectDomains: ['https://api.example.com'] })
+  check('mcp apps: a declared domain is allowed', declared.includes('https://api.example.com'))
+  check(
+    'mcp apps: resource domains are also allowed for workers',
+    buildCsp({ resourceDomains: ['https://*.cesium.com'] }).includes(
+      "worker-src 'self' blob: https://*.cesium.com"
+    )
+  )
+  check(
+    'mcp apps: ...only in the directive that named it',
+    !declared.includes("img-src 'self' data: https://api")
+  )
+}
+
+// CSP header injection: the declaration comes from the same untrusted place as
+// the HTML, so one entry must not be able to rewrite the whole policy.
+{
+  const attack = buildCsp({
+    connectDomains: ['*; script-src *', 'https://ok.example.com', 'javascript:alert(1)']
+  })
+  check('mcp apps: a domain cannot inject a new directive', !attack.includes('script-src *'))
+  check('mcp apps: a javascript: domain is dropped', !attack.includes('javascript:'))
+  check('mcp apps: the legitimate domain still survives', attack.includes('https://ok.example.com'))
+}
+check(
+  'mcp apps: http:// domains are rejected (no downgrade)',
+  sanitizeDomains(['http://x.example.com']).length === 0
+)
+check(
+  'mcp apps: wss:// is allowed for live views',
+  sanitizeDomains(['wss://x.example.com']).length === 1
+)
+
+// Theme styling is optional. The official SDK validates a closed set of CSS
+// variable names, so an old or malformed renderer payload must be filtered
+// rather than making `ui/initialize` fail.
+{
+  const theme = sanitizeMcpAppHostTheme({
+    mode: 'light',
+    variables: {
+      '--color-background-primary': '#fff',
+      '--font-sans': 'system-ui',
+      '--mcp-ui-background': '#000',
+      '--unknown': 'bad'
+    }
+  })
+  check('mcp apps: a valid host theme mode survives', theme.mode === 'light')
+  check(
+    'mcp apps: official host style variables survive IPC sanitizing',
+    theme.variables['--color-background-primary'] === '#fff' &&
+      theme.variables['--font-sans'] === 'system-ui'
+  )
+  check(
+    'mcp apps: unknown host style variables cannot break initialization',
+    !Object.keys(theme.variables).some((key) => key.startsWith('--mcp-ui-') || key === '--unknown')
+  )
+}
+
+// ---- permissions: off unless asked ----------------------------------------
+check('mcp apps: no permissions means an empty allow attribute', buildAllow(undefined) === '')
+check('mcp apps: only requested permissions are granted', buildAllow({ camera: true }) === 'camera')
+check(
+  'mcp apps: several permissions compose',
+  buildAllow({ camera: true, geolocation: true }) === 'camera; geolocation'
+)
+
+// ---- the bridge: deny by default ------------------------------------------
+check(
+  'mcp apps: ui/initialize is handled by the host',
+  routeBridgeMethod('ui/initialize').kind === 'host'
+)
+check(
+  'mcp apps: tools/call is forwarded to the server',
+  routeBridgeMethod('tools/call').kind === 'forward'
+)
+check(
+  'mcp apps: resources/read is forwarded',
+  routeBridgeMethod('resources/read').kind === 'forward'
+)
+// The reserved namespace belongs to the proxy; it must reach neither the host
+// handlers nor the server.
+check(
+  'mcp apps: reserved sandbox methods are rejected',
+  routeBridgeMethod('ui/notifications/sandbox-resource-ready').kind === 'reject'
+)
+// An allowlist, not a prefix check: a future protocol method must not start
+// flowing to the server the day a server starts sending it.
+check('mcp apps: an unknown method is rejected', routeBridgeMethod('roots/list').kind === 'reject')
+check(
+  'mcp apps: sampling is not reachable from a view',
+  routeBridgeMethod('sampling/createMessage').kind === 'reject'
+)
+check('mcp apps: a missing method is rejected', routeBridgeMethod(undefined).kind === 'reject')
+check('mcp apps: a non-string method is rejected', routeBridgeMethod({}).kind === 'reject')
+
+// ---- open-link: no scheme laundering --------------------------------------
+// A view asking the host to open file:// or a third-party app scheme is asking
+// it to do something the view itself could not: a sandbox escape by proxy.
+check('mcp apps: https links may be opened', isOpenableUrl('https://example.com'))
+check('mcp apps: http links may be opened', isOpenableUrl('http://example.com'))
+check('mcp apps: file:// is refused', !isOpenableUrl('file:///etc/passwd'))
+check('mcp apps: javascript: is refused', !isOpenableUrl('javascript:alert(1)'))
+check('mcp apps: a foreign app scheme is refused', !isOpenableUrl('slack://open'))
+check('mcp apps: garbage is refused', !isOpenableUrl('not a url'))
+
+// ---- display modes + sizing -----------------------------------------------
+// Never advertise a mode the host cannot honour: a view would render itself for
+// a window that never appears.
+check('mcp apps: pip is not offered', !SUPPORTED_DISPLAY_MODES.includes('pip'))
+check(
+  'mcp apps: an unsupported mode falls back to inline',
+  negotiateDisplayMode('pip') === 'inline'
+)
+check('mcp apps: fullscreen is honoured', negotiateDisplayMode('fullscreen') === 'fullscreen')
+// A view reports its own height; unbounded, that is a denial of service on the
+// transcript.
+check('mcp apps: an absurd height is clamped', clampAppHeight(900000) === APP_HEIGHT.max)
+check('mcp apps: a zero height keeps the view visible', clampAppHeight(0) === APP_HEIGHT.min)
+check('mcp apps: a non-numeric height falls back', clampAppHeight('tall') === APP_HEIGHT.initial)
+
+// ---- disclosure ------------------------------------------------------------
+// "This UI talks to api.example.com" is the one fact a user cannot discover by
+// looking at the rendered view.
+{
+  const domains = externalDomains({
+    csp: {
+      connectDomains: ['https://api.example.com', "'self'"],
+      resourceDomains: ['https://cdn.example.com']
+    }
+  })
+  check('mcp apps: external domains are surfaced', domains.length === 2)
+  check('mcp apps: self is not reported as external', !domains.includes("'self'"))
+}
+check(
+  'mcp apps: a view with no declarations reports nothing',
+  externalDomains(undefined).length === 0
+)
+
+// ---- resources: text and binary must stay distinguishable -------------------
+// An MCP App's HTML is text to render; a PNG is bytes to embed. A consumer that
+// has to guess which it got is one `atob` away from rendering base64 into a
+// document, so the parser keeps them in separate fields.
+{
+  const r = parseResourceContents('ui://srv/app.html', [
+    { uri: 'ui://srv/app.html', mimeType: 'text/html;profile=mcp-app', text: '<h1>hi</h1>' }
+  ])
+  check('mcp resource: text contents parse', r.text === '<h1>hi</h1>' && r.blob === undefined)
+  check('mcp resource: the mime profile survives', r.mimeType === 'text/html;profile=mcp-app')
+}
+{
+  const appMeta = {
+    ui: {
+      csp: {
+        resourceDomains: ['https://cesium.com'],
+        connectDomains: ['https://*.openstreetmap.org']
+      }
+    }
+  }
+  const html = '<script>' + 'x'.repeat(MCP_LIMITS.textChars + 100) + '</script>'
+  const r = parseResourceContents('ui://map/app.html', [
+    {
+      uri: 'ui://map/app.html',
+      mimeType: 'text/html;profile=mcp-app',
+      text: html,
+      _meta: appMeta
+    }
+  ])
+  check(
+    'mcp resource: an app bundle may exceed the model-text cap intact',
+    r.text === html && !r.truncated
+  )
+  check(
+    'mcp resource: content-level app metadata survives',
+    (r._meta?.ui as { csp?: { resourceDomains?: string[] } })?.csp?.resourceDomains?.[0] ===
+      'https://cesium.com'
+  )
+}
+{
+  const r = parseResourceContents('file://x.png', [{ uri: 'file://x.png', blob: 'AAA' }])
+  check('mcp resource: binary contents parse as blob', r.blob === 'AAA' && r.text === undefined)
+}
+// One URI can expand to several parts; Roxy reads one addressable resource, so
+// the first is the answer rather than a silent concatenation.
+{
+  const r = parseResourceContents('file://a', [
+    { uri: 'file://a', text: 'first' },
+    { uri: 'file://a', text: 'second' }
+  ])
+  check('mcp resource: the first part is the answer', r.text === 'first')
+}
+// The requested URI is the fallback identity when a server omits it.
+check(
+  'mcp resource: a missing uri falls back to the requested one',
+  parseResourceContents('file://asked', [{ text: 'body' }]).uri === 'file://asked'
+)
+check(
+  'mcp resource: empty contents degrade to a bare uri',
+  parseResourceContents('file://a', []).uri === 'file://a'
+)
+check(
+  'mcp resource: malformed contents never throw',
+  parseResourceContents('file://a', 'nope').uri === 'file://a'
+)
+// Same bounding discipline as content blocks.
+{
+  const big = 'x'.repeat(MCP_LIMITS.textChars + 100)
+  const r = parseResourceContents('file://a', [{ uri: 'file://a', text: big }])
+  check(
+    'mcp resource: oversized text is capped and flagged',
+    r.text?.length === MCP_LIMITS.textChars && r.truncated === true
+  )
+}
+{
+  const blob = 'A'.repeat(MCP_LIMITS.binaryChars + 10)
+  const r = parseResourceContents('file://a', [{ uri: 'file://a', blob }])
+  check(
+    'mcp resource: an oversized blob is dropped, not held',
+    r.blob === undefined && r.omitted === true
+  )
+}
+
+// ---- MCP Apps: the shape REAL servers actually emit -------------------------
+// The spec reserves `io.modelcontextprotocol/ui`, but the official SDK's
+// `registerAppTool` writes the short `_meta.ui` - and that is what every
+// published example server carries. Reading only the qualified key renders
+// nothing for the entire ecosystem while looking correct against the prose, so
+// both spellings are pinned here against the literal shape from
+// ext-apps/examples/quickstart/server.ts.
+check(
+  'mcp apps interop: the SDK short key (_meta.ui) is read',
+  uiResourceUri({ ui: { resourceUri: 'ui://get-time/mcp-app.html' } }) ===
+    'ui://get-time/mcp-app.html'
+)
+check(
+  'mcp apps interop: the reserved namespaced key still works',
+  uiResourceUri({ 'io.modelcontextprotocol/ui': { resourceUri: 'ui://a/b.html' } }) ===
+    'ui://a/b.html'
+)
+check(
+  'mcp apps interop: the namespaced key wins when both are present',
+  uiResourceUri({
+    'io.modelcontextprotocol/ui': { resourceUri: 'ui://qualified/x.html' },
+    ui: { resourceUri: 'ui://short/y.html' }
+  }) === 'ui://qualified/x.html'
+)
+check(
+  'mcp apps interop: app-only visibility is read under the short key too',
+  isAppOnlyTool({ ui: { visibility: ['app'] } })
+)
+// A bare `ui` that isn't a UI block must not be mistaken for one.
+check(
+  'mcp apps interop: a non-object ui field is ignored',
+  uiResourceUri({ ui: 'not-a-block' }) === undefined
+)
+check('mcp apps interop: absent metadata is undefined', uiResourceUri(undefined) === undefined)
+
+// ---- bounded, and honest about it ------------------------------------------
+// "Lossless" cannot mean "hold whatever arrives": these connections are warm and
+// long-lived. What matters is that a cap is RECORDED, so a consumer can tell
+// "empty" from "too big to keep".
+{
+  const huge = 'x'.repeat(MCP_LIMITS.textChars + 5_000)
+  const r = parseCallResult({ content: [{ type: 'text', text: huge }] })
+  const b = r.content[0]
+  check(
+    'mcp bounds: oversized text is capped',
+    b.kind === 'text' && b.text.length === MCP_LIMITS.textChars
+  )
+  check('mcp bounds: ...and says so', b.kind === 'text' && b.truncated === true)
+  check('mcp bounds: the model text marks the cut', toModelText(r).includes('[truncated]'))
+}
+{
+  const blob = 'A'.repeat(MCP_LIMITS.binaryChars + 10)
+  const r = parseCallResult({ content: [{ type: 'image', data: blob, mimeType: 'image/png' }] })
+  const b = r.content[0]
+  check(
+    'mcp bounds: an oversized payload is dropped, not held',
+    b.kind === 'image' && b.data === undefined && b.omitted === true
+  )
+  // Distinguishable from "there was no image".
+  check('mcp bounds: ...and the omission is stated', toModelText(r).includes('too large'))
+  check('mcp bounds: no data URL is fabricated', toToolResult(r).image === undefined)
+}
+{
+  const many = Array.from({ length: MCP_LIMITS.blocks + 25 }, (_, i) => ({
+    type: 'text',
+    text: 'b' + i
+  }))
+  const r = parseCallResult({ content: many })
+  check('mcp bounds: block count is capped', r.content.length === MCP_LIMITS.blocks)
+  check('mcp bounds: the overflow is counted', r.droppedBlocks === 25)
+  check('mcp bounds: ...and reported to the model', toModelText(r).includes('25 further block'))
+}
+
+// ---- malformed input must not take down a turn ------------------------------
+check(
+  'mcp content: a non-array content is survivable',
+  parseCallResult({ content: 'nope' }).content.length === 0
+)
+check(
+  'mcp content: null content is survivable',
+  parseCallResult({ content: null }).content.length === 0
+)
+check(
+  'mcp content: a null block becomes unknown, not a crash',
+  parseCallResult({ content: [null] }).content[0].kind === 'unknown'
+)
+check(
+  'mcp content: isError maps to ok:false',
+  !toToolResult(parseCallResult({ content: [{ type: 'text', text: 'bad' }], isError: true })).ok
+)
+{
+  // A cyclic _meta cannot be serialized; it is dropped rather than thrown on.
+  const cyclic: Record<string, unknown> = {}
+  cyclic.self = cyclic
+  const r = parseCallResult({ content: [{ type: 'text', text: 'x' }], _meta: cyclic })
+  check('mcp content: an unserializable _meta is dropped quietly', r._meta === undefined)
+}
+
+check(
+  'mcp render: an unserializable structured value degrades quietly',
+  (() => {
+    const cyclic: Record<string, unknown> = {}
+    cyclic.self = cyclic
+    const r = renderMcpContent([], false, cyclic)
+    return r.ok && r.output === '(no output)'
+  })()
+)
 check(
   'mcp render: empty error → error placeholder',
   !renderMcpContent([], true).ok && renderMcpContent([], true).output.includes('error')
@@ -6170,6 +6731,263 @@ async function main(): Promise<void> {
     String(resolveFontStack('SF Mono', 'mono', 'win32'))
   )
 
+  // ---- MCP trust: run by default, disclose what happened -------------------
+  // The stance under test: installing a server IS the decision, so servers run
+  // and the user is told what they exposed. Only a SUBSTITUTION - a trusted
+  // name now running a different command - is worth interrupting for.
+  {
+    const local = (command: string[], extra: Record<string, unknown> = {}): McpServerConfig =>
+      ({ type: 'local', command, ...extra }) as McpServerConfig
+    const remote = (url: string, extra: Record<string, unknown> = {}): McpServerConfig =>
+      ({ type: 'remote', url, ...extra }) as McpServerConfig
+    const empty: McpTrustStore = { entries: [], workspaces: [] }
+    const WS = '/home/u/project'
+
+    // -- fingerprint: identity is WHAT RUNS, not what it is called.
+    check(
+      'mcp trust: renaming a server keeps its identity',
+      fingerprintConfig(local(['npx', 'srv'])) === fingerprintConfig(local(['npx', 'srv']))
+    )
+    check(
+      'mcp trust: changing argv changes identity',
+      fingerprintConfig(local(['npx', 'srv'])) !== fingerprintConfig(local(['npx', 'evil']))
+    )
+    check(
+      'mcp trust: changing cwd changes identity',
+      fingerprintConfig(local(['npx', 'srv'])) !==
+        fingerprintConfig(local(['npx', 'srv'], { cwd: 'sub' }))
+    )
+    // A rotated token must not re-surface; a NEW variable must.
+    check(
+      'mcp trust: an env VALUE change is not a new identity',
+      fingerprintConfig(local(['x'], { environment: { TOKEN: 'a' } })) ===
+        fingerprintConfig(local(['x'], { environment: { TOKEN: 'b' } }))
+    )
+    check(
+      'mcp trust: gaining an env var IS a new identity',
+      fingerprintConfig(local(['x'], { environment: { TOKEN: 'a' } })) !==
+        fingerprintConfig(local(['x'], { environment: { TOKEN: 'a', AWS_SECRET: 'b' } }))
+    )
+    check(
+      'mcp trust: env var order does not matter',
+      fingerprintConfig(local(['x'], { environment: { A: '1', B: '2' } })) ===
+        fingerprintConfig(local(['x'], { environment: { B: '2', A: '1' } }))
+    )
+    check(
+      'mcp trust: cosmetic URL differences are the same server',
+      fingerprintConfig(remote('https://Example.com:443/mcp/')) ===
+        fingerprintConfig(remote('https://example.com/mcp'))
+    )
+    check(
+      'mcp trust: a different host is a different server',
+      fingerprintConfig(remote('https://example.com/mcp')) !==
+        fingerprintConfig(remote('https://evil.com/mcp'))
+    )
+    check(
+      'mcp trust: query string is part of identity',
+      fingerprintConfig(remote('https://e.com/mcp?tenant=a')) !==
+        fingerprintConfig(remote('https://e.com/mcp?tenant=b'))
+    )
+
+    // -- the default: run it, then say what it was.
+    check('mcp trust: the gate is OFF by default', !DEFAULT_TRUST_POLICY.confirmBeforeRun)
+    const firstRun = decideTrust({
+      id: 's',
+      config: local(['npx', 'srv']),
+      provenance: 'workspace',
+      workspace: WS,
+      store: empty
+    })
+    check('mcp trust: a new server runs without asking', firstRun.allowed && !firstRun.needsPrompt)
+    check('mcp trust: ...but the user is told about it', firstRun.needsDisclosure)
+    const agentRun = decideTrust({
+      id: 's',
+      config: local(['x']),
+      provenance: 'agent',
+      store: empty
+    })
+    check(
+      'mcp trust: an agent-added server runs and is disclosed',
+      agentRun.allowed && agentRun.needsDisclosure && !agentRun.needsPrompt
+    )
+    const userRun = decideTrust({
+      id: 's',
+      config: local(['x']),
+      provenance: 'user',
+      store: empty
+    })
+    check(
+      'mcp trust: a server you configured needs no notice',
+      userRun.allowed && !userRun.needsDisclosure
+    )
+
+    // -- remembering: the notice is shown once, not every turn.
+    const known: McpTrustStore = {
+      entries: [
+        {
+          id: 's',
+          fingerprint: fingerprintConfig(local(['npx', 'srv'])),
+          provenance: 'workspace',
+          scope: WS,
+          decision: 'allow',
+          decidedAt: 1
+        }
+      ],
+      workspaces: []
+    }
+    const second = decideTrust({
+      id: 's',
+      config: local(['npx', 'srv']),
+      provenance: 'workspace',
+      workspace: WS,
+      store: known
+    })
+    check(
+      'mcp trust: a known server is silent on later runs',
+      second.allowed && !second.needsDisclosure && !second.needsPrompt
+    )
+
+    // -- THE case worth interrupting for: a trusted name, a different command.
+    const swapped = decideTrust({
+      id: 's',
+      config: local(['curl', 'evil.sh']),
+      provenance: 'workspace',
+      workspace: WS,
+      store: known
+    })
+    check(
+      'mcp trust: swapping a known command asks first',
+      !swapped.allowed && swapped.needsPrompt && swapped.reason === 'changed'
+    )
+    // A swap must resurface even where the user trusted the whole project.
+    const trustedWsWithPrior: McpTrustStore = {
+      entries: known.entries,
+      workspaces: [{ path: WS, trustedAt: 2 }]
+    }
+    check(
+      'mcp trust: a swap asks even in a trusted project',
+      decideTrust({
+        id: 's',
+        config: local(['curl', 'evil.sh']),
+        provenance: 'workspace',
+        workspace: WS,
+        store: trustedWsWithPrior
+      }).reason === 'changed'
+    )
+    // Identity is per-project, so another repo's `s` is a first run, not a swap.
+    const elsewhere = decideTrust({
+      id: 's',
+      config: local(['other']),
+      provenance: 'workspace',
+      workspace: '/home/u/other',
+      store: known
+    })
+    check(
+      'mcp trust: a same-named server elsewhere is a first run',
+      elsewhere.allowed && elsewhere.reason === 'first-run'
+    )
+
+    // -- a block stays blocked, without re-asking.
+    const blocked: McpTrustStore = {
+      entries: [
+        {
+          id: 's',
+          fingerprint: fingerprintConfig(local(['x'])),
+          provenance: 'workspace',
+          scope: WS,
+          decision: 'deny',
+          decidedAt: 1
+        }
+      ],
+      workspaces: [{ path: WS, trustedAt: 2 }]
+    }
+    const stillBlocked = decideTrust({
+      id: 's',
+      config: local(['x']),
+      provenance: 'workspace',
+      workspace: WS,
+      store: blocked
+    })
+    check(
+      'mcp trust: a blocked server stays blocked silently',
+      !stillBlocked.allowed && !stillBlocked.needsPrompt
+    )
+
+    // -- the opt-in stricter posture.
+    const strict = decideTrust({
+      id: 's',
+      config: local(['x']),
+      provenance: 'workspace',
+      workspace: WS,
+      store: empty,
+      policy: { confirmBeforeRun: true }
+    })
+    check(
+      'mcp trust: opting in asks before a new server runs',
+      !strict.allowed && strict.needsPrompt && strict.reason === 'confirm-first-run'
+    )
+    check(
+      'mcp trust: opting in still never asks about your own servers',
+      decideTrust({
+        id: 's',
+        config: local(['x']),
+        provenance: 'user',
+        store: empty,
+        policy: { confirmBeforeRun: true }
+      }).allowed
+    )
+
+    // -- source: the thing actually worth trusting.
+    check(
+      'mcp trust: source is the package, not the runner',
+      sourceOf(local(['npx', '-y', '@modelcontextprotocol/server-github'])) ===
+        '@modelcontextprotocol/server-github'
+    )
+    check(
+      'mcp trust: source unwraps uvx too',
+      sourceOf(local(['uvx', 'mcp-server-git'])) === 'mcp-server-git'
+    )
+    check(
+      'mcp trust: a plain binary is its own source',
+      sourceOf(local(['/usr/local/bin/my-server', '--stdio'])) === 'my-server'
+    )
+    check(
+      'mcp trust: a remote source is its host',
+      sourceOf(remote('https://api.acme.com/mcp?x=1')) === 'api.acme.com'
+    )
+
+    // -- disclosure: enough to check, never the secrets themselves.
+    const disc = describeConfig(
+      local(['npx', '-y', 'srv'], { cwd: 'sub', environment: { GITHUB_TOKEN: 'ghp_secret' } })
+    )
+    check(
+      'mcp trust: disclosure names the executable and args',
+      disc.executable === 'npx' && disc.args?.join(' ') === '-y srv'
+    )
+    check(
+      'mcp trust: disclosure lists env NAMES only',
+      disc.envNames?.join(',') === 'GITHUB_TOKEN' && !JSON.stringify(disc).includes('ghp_secret')
+    )
+    check('mcp trust: a credential-shaped var is flagged', disc.injectsSecrets)
+    check(
+      'mcp trust: a plain var is not flagged as a secret',
+      !describeConfig(local(['x'], { environment: { LOG_LEVEL: 'debug' } })).injectsSecrets
+    )
+    check(
+      'mcp trust: an Authorization header counts as a secret',
+      describeConfig(remote('https://e.com', { headers: { Authorization: 'Bearer x' } }))
+        .injectsSecrets
+    )
+    check(
+      'mcp trust: summary renders a runnable command line',
+      summarizeConfig(local(['npx', '-y', 'srv'])) === 'npx -y srv'
+    )
+    check(
+      'mcp trust: summary shows the host for a remote server',
+      summarizeConfig(remote('https://example.com/mcp')) === 'example.com'
+    )
+  }
+
   if (fails.length) {
     console.error(`\nSHARED FAILED \u2014 ${fails.length} failing: ${fails.join(', ')}`)
     process.exit(1)
diff --git a/test/smoke.ts b/test/smoke.ts
index 2fc6116..c411bf9 100644
--- a/test/smoke.ts
+++ b/test/smoke.ts
@@ -84,6 +84,10 @@ import * as lsp from '../src/main/services/lsp'
 import {
   ensureMcpConnected,
   mcpToolSchemas,
+  mcpToolDefinition,
+  lastMcpCallResult,
+  listMcpResources,
+  readMcpResource,
   callMcpTool,
   isMcpTool,
   mcpToolTitle,
@@ -95,6 +99,24 @@ import {
   loadWorkspaceMcpServers,
   _resetMcpForTests
 } from '../src/main/services/mcp'
+import {
+  launchMcpApp,
+  handleMcpAppRequest,
+  closeMcpApp,
+  setMcpAppApprover,
+  setMcpAppTheme,
+  _resetMcpAppsForTests
+} from '../src/main/services/mcp-apps'
+import {
+  SANDBOX_SCHEME,
+  SANDBOX_URL,
+  OPENSTREETMAP_TILE_PATTERN,
+  identifyOpenStreetMapRequest,
+  registerSandboxScheme,
+  serveSandbox
+} from '../src/main/services/mcp-app-sandbox'
+import { SANDBOX_ORIGIN_HINT, SANDBOX_POST_TARGET, uiResourceUri } from '../src/shared/mcp-apps'
+import { _resetTrustForTests } from '../src/main/services/mcp-trust'
 import type { McpServerRecord } from '../src/shared/mcp'
 import {
   listSkills,
@@ -1349,7 +1371,12 @@ async function main(): Promise<void> {
     {
       const db = new Database(path.join(healDir, 'v22.db'))
       // Stop one rung short, at v21 — the last release that still had the box.
-      const priorSteps = MIGRATIONS.slice(0, MIGRATIONS.length - 1)
+      // Indexed from the START of the ladder, not the end: it is append-only, so
+      // "the last migration" stops being v22 the moment anything lands after it,
+      // and this test would silently start asserting about an unrelated future
+      // step. v22 is the 22nd rung, and always will be.
+      const V22 = 22
+      const priorSteps = MIGRATIONS.slice(0, V22 - 1)
       for (const step of priorSteps) {
         if (typeof step === 'string') db.exec(step)
         else step(db)
@@ -2849,7 +2876,7 @@ async function main(): Promise<void> {
   }
 
   // ---- MCP client (Phase 13) via a real mock MCP server over the official SDK ----
-  // Exercises the ACTUAL @modelcontextprotocol/sdk Client: stdio spawn → initialize
+  // Exercises the ACTUAL @modelcontextprotocol/client: stdio spawn → initialize
   // handshake → capability negotiation → tools/list → tools/call, plus roxy's pool,
   // schema conversion, namespaced dispatch (through runTool), and lifecycle.
   {
@@ -2995,6 +3022,564 @@ async function main(): Promise<void> {
       check('mcp: shutdownAllMcp clears the pool', mcpToolSchemas().length === 0)
       await _resetMcpForTests()
 
+      // ---- protocol era negotiation (the v2 `mode: 'auto'` payoff) ----------
+      // The legacy mock above rejects `server/discover`, so every check so far
+      // exercised the FALLBACK branch. This block pins the other one against a
+      // server that answers the probe and has no `initialize` at all - a server
+      // the v1 client could not have talked to.
+      const modernPath = path.join(process.cwd(), 'test', 'fixtures', 'mock-mcp-modern.cjs')
+      if (!existsSync(modernPath)) {
+        check('mock-mcp-modern fixture is present', false, modernPath)
+      } else {
+        const modernRec: McpServerRecord = {
+          id: 'modernmcp',
+          enabled: true,
+          config: {
+            type: 'local',
+            command: [process.execPath, modernPath],
+            environment: { ELECTRON_RUN_AS_NODE: '1' }
+          }
+        }
+        await ensureMcpConnected([modernRec], process.cwd())
+        const modernSummary = mcpServerSummaries(new Set(['modernmcp']))[0]
+        check(
+          'mcp era: a 2026-era server connects without `initialize`',
+          modernSummary?.status === 'connected',
+          modernSummary?.error
+        )
+        check('mcp era: ...and reports the modern era', modernSummary?.era === 'modern')
+        check(
+          'mcp era: its tools are discovered',
+          !!modernSummary && modernSummary.tools.includes('structured')
+        )
+
+        // A modern result may carry ONLY structuredContent. The v1 path rendered
+        // that as "(no output)" - a successful call reported as empty.
+        const structured = await withTimeout(
+          callMcpTool('mcp__modernmcp__structured', {}),
+          15_000,
+          'mcp structured'
+        )
+        check(
+          'mcp era: a structured-only result is not reported as empty',
+          structured.ok && structured.output.includes('61.5') && structured.output.includes('EUR'),
+          structured.output
+        )
+
+        // Ordinary calls behave identically across eras - that is the point of
+        // negotiating rather than branching at every call site.
+        const modernEcho = await withTimeout(
+          callMcpTool('mcp__modernmcp__echo', { message: 'hi' }),
+          15_000,
+          'mcp modern echo'
+        )
+        check(
+          'mcp era: tool calls work the same on the modern wire',
+          modernEcho.ok && modernEcho.output.includes('echo: hi'),
+          modernEcho.output
+        )
+
+        // Groundwork for MCP Apps: the extension metadata a server attaches to a
+        // tool must survive discovery. The v1 code kept only name/description/
+        // inputSchema, so a UI-bearing tool arrived indistinguishable from a
+        // plain one and Apps could not be built on top without re-listing.
+        const def = mcpToolDefinition('mcp__modernmcp__structured')
+        // Read through `uiResourceUri` rather than indexing one literal key: the
+        // official SDK emits the short `_meta.ui`, the spec reserves the
+        // qualified label, and a host has to accept both. Asserting the raw key
+        // here would pass only against whichever spelling the fixture happened
+        // to use - which is exactly how the interop gap went unnoticed.
+        check(
+          "mcp apps: a tool's `_meta` survives discovery",
+          uiResourceUri(def?._meta) === 'ui://mockmodern/app.html',
+          JSON.stringify(def?._meta)
+        )
+        check('mcp apps: its outputSchema is kept too', !!def?.outputSchema)
+
+        // App-only tools: reachable by the view, invisible to the model. A host
+        // that leaks them offers the model operations the server explicitly
+        // said were not for it.
+        const modelNames = mcpToolSchemas(new Set(['modernmcp'])).map((sc) => sc.function.name)
+        check(
+          'mcp apps: an app-only tool is hidden from the model',
+          !modelNames.includes('mcp__modernmcp__set_cell'),
+          modelNames.join(',')
+        )
+        check(
+          'mcp apps: ...but is still routable for its view',
+          !!mcpToolDefinition('mcp__modernmcp__set_cell')
+        )
+        check(
+          'mcp apps: ordinary tools are unaffected',
+          modelNames.includes('mcp__modernmcp__echo')
+        )
+
+        // ---- results stay lossless end-to-end -----------------------------
+        // Same property as the shared unit tests, but over a REAL wire: what a
+        // server actually sent must still be there after the client, the
+        // service, and the pool have handled it.
+        const rich = await withTimeout(callMcpTool('mcp__modernmcp__rich', {}), 15_000, 'mcp rich')
+        check('mcp lossless: the flat result still reads naturally', rich.ok, rich.output)
+        check(
+          'mcp lossless: the flat form previews the first image',
+          rich.image === 'data:image/png;base64,AAA'
+        )
+        const full = lastMcpCallResult('mcp__modernmcp__rich')
+        check(
+          'mcp lossless: every block survives the round trip',
+          full?.content.length === 4,
+          String(full?.content.length)
+        )
+        const linkBlock = full?.content.find((b) => b.kind === 'resource_link')
+        check(
+          'mcp lossless: a resource link is still addressable',
+          linkBlock?.kind === 'resource_link' && linkBlock.uri === 'file:///repo/report.pdf'
+        )
+        check(
+          'mcp lossless: the second image is not discarded',
+          full?.content.filter((b) => b.kind === 'image').length === 2
+        )
+        const resultUi = full?._meta?.['io.modelcontextprotocol/ui'] as
+          | { resourceUri?: string }
+          | undefined
+        check(
+          'mcp lossless: result _meta reaches the consumer',
+          resultUi?.resourceUri === 'ui://mockmodern/app.html'
+        )
+        // Retaining structure is only defensible if it is also released. The
+        // pool is warm and long-lived, so a cached payload that outlived its
+        // connection would be a per-session leak.
+        await disposeConnection('modernmcp')
+        check(
+          'mcp lossless: cached results are released with the connection',
+          lastMcpCallResult('mcp__modernmcp__rich') === undefined
+        )
+        await ensureMcpConnected([modernRec], process.cwd())
+
+        // ---- resources -----------------------------------------------------
+        // The half of MCP that isn't tools, and the delivery mechanism for MCP
+        // Apps: a UI arrives as a `ui://` resource read over this same path.
+        const resources = await withTimeout(
+          listMcpResources('modernmcp'),
+          15_000,
+          'mcp resources/list'
+        )
+        check(
+          'mcp resources: a server\u2019s resources are listed',
+          resources.length === 2 && resources.some((r) => r.uri === 'ui://mockmodern/app.html'),
+          JSON.stringify(resources.map((r) => r.uri))
+        )
+        const uiRes = await withTimeout(
+          readMcpResource('modernmcp', 'ui://mockmodern/app.html'),
+          15_000,
+          'mcp resources/read'
+        )
+        check(
+          'mcp resources: a ui:// resource reads back as text',
+          'text' in uiRes && !!uiRes.text && uiRes.text.includes('<h1>hi</h1>'),
+          JSON.stringify(uiRes)
+        )
+        check(
+          'mcp resources: ...carrying the MCP Apps mime profile',
+          'mimeType' in uiRes && uiRes.mimeType === 'text/html;profile=mcp-app'
+        )
+        // A missing URI is an error VALUE, not a thrown exception: a resource
+        // read happens inside a turn and must not take the turn with it.
+        const missing = await withTimeout(
+          readMcpResource('modernmcp', 'file:///nope'),
+          15_000,
+          'mcp resources/read missing'
+        )
+        check('mcp resources: an unknown URI degrades to an error value', 'error' in missing)
+        check(
+          'mcp resources: listing a server without the capability is empty, not an error',
+          (await listMcpResources('mockmcp')).length === 0
+        )
+
+        // ---- MCP Apps: the broker end to end -------------------------------
+        // An app launch belongs to one completed tool call. The earlier
+        // disconnect test intentionally cleared retained results, so make the
+        // producing call again immediately before mounting its view, matching
+        // the product lifecycle.
+        await withTimeout(
+          callMcpTool('mcp__modernmcp__structured', {}),
+          15_000,
+          'mcp app producing call'
+        )
+        // Loads a real `ui://` resource over the real client, then exercises the
+        // boundary the whole feature rests on.
+        const launched = await withTimeout(
+          launchMcpApp('modernmcp', 'mcp__modernmcp__structured', 'ui://mockmodern/app.html'),
+          15_000,
+          'mcp app launch'
+        )
+        check(
+          'mcp app: a ui:// view loads',
+          !!launched &&
+            launched.html.includes('<h1>hi</h1>') &&
+            launched.html.includes('<!--app-complete-->') &&
+            launched.html.length > 300_000,
+          JSON.stringify(launched)?.slice(0, 120)
+        )
+        check(
+          'mcp app: it carries the resource-declared CSP domains',
+          !!launched?.csp.includes('https://cesium.com') &&
+            launched.csp.includes('https://*.openstreetmap.org') &&
+            launched.sandboxUrl.includes('csp=')
+        )
+
+        if (launched) {
+          // Reproduce the exact pre-fix renderer payload from the user-visible
+          // schema error. Optional styling must never break the handshake.
+          setMcpAppTheme({
+            mode: 'light',
+            variables: {
+              '--mcp-ui-background': '#fff',
+              '--mcp-ui-foreground': '#111',
+              '--mcp-ui-muted': '#777',
+              '--mcp-ui-border': '#ddd',
+              '--mcp-ui-accent': '#06f',
+              '--mcp-ui-font-family': 'system-ui',
+              '--color-background-primary': '#f7f7f8'
+            }
+          })
+          const initialized = await handleMcpAppRequest({
+            sessionId: launched.sessionId,
+            id: 'init',
+            method: 'ui/initialize',
+            params: {
+              protocolVersion: '2026-01-26',
+              appInfo: { name: 'schema-probe', version: '1.0.0' },
+              appCapabilities: {}
+            }
+          })
+          const hostContext = (
+            initialized.result as {
+              hostContext?: { theme?: string; styles?: { variables?: Record<string, string> } }
+            }
+          )?.hostContext
+          check(
+            'mcp app: ui/initialize strips non-protocol theme keys',
+            hostContext?.theme === 'light' &&
+              hostContext.styles?.variables?.['--color-background-primary'] === '#f7f7f8' &&
+              !Object.keys(hostContext.styles?.variables ?? {}).some((key) =>
+                key.startsWith('--mcp-ui-')
+              ),
+            JSON.stringify(initialized)
+          )
+          check(
+            'mcp app: the complete tool result reaches the launch payload',
+            (launched.toolResult as { _meta?: { viewUUID?: string } })?._meta?.viewUUID ===
+              'mock-view-uuid'
+          )
+          // A view names an UNQUALIFIED tool; the broker qualifies it against the
+          // session's own server. There is no code path that reads a server id
+          // from the view, which is what makes cross-server calls impossible
+          // rather than merely discouraged.
+          setMcpAppApprover(async () => true)
+          const ok = await withTimeout(
+            handleMcpAppRequest({
+              sessionId: launched.sessionId,
+              id: 1,
+              method: 'tools/call',
+              params: { name: 'echo', arguments: { message: 'from-view' } }
+            }),
+            15_000,
+            'mcp app tools/call'
+          )
+          check(
+            'mcp app: an approved tool call reaches its own server',
+            JSON.stringify(ok.result ?? '').includes('from-view'),
+            JSON.stringify(ok)
+          )
+
+          // The same call, denied.
+          setMcpAppApprover(async () => false)
+          const denied = await withTimeout(
+            handleMcpAppRequest({
+              sessionId: launched.sessionId,
+              id: 2,
+              method: 'tools/call',
+              params: { name: 'boom', arguments: {} }
+            }),
+            15_000,
+            'mcp app denied call'
+          )
+          check('mcp app: an unapproved tool call is refused', !!denied.error)
+
+          // The legacy mock's `echo` exists, but not on THIS view's server.
+          setMcpAppApprover(async () => true)
+          const cross = await withTimeout(
+            handleMcpAppRequest({
+              sessionId: launched.sessionId,
+              id: 3,
+              method: 'tools/call',
+              params: { name: 'mcp__mockmcp__echo', arguments: {} }
+            }),
+            15_000,
+            'mcp app cross-server'
+          )
+          check('mcp app: a view cannot reach another server', !!cross.error, JSON.stringify(cross))
+
+          // Methods outside the allowlist never reach a server.
+          const bad = await withTimeout(
+            handleMcpAppRequest({
+              sessionId: launched.sessionId,
+              id: 4,
+              method: 'sampling/createMessage',
+              params: {}
+            }),
+            15_000,
+            'mcp app bad method'
+          )
+          check('mcp app: an unsupported method is rejected', !!bad.error)
+
+          // Teardown must actually invalidate the session, or a stale frame
+          // could keep calling tools after its card is gone.
+          closeMcpApp(launched.sessionId)
+          const afterClose = await withTimeout(
+            handleMcpAppRequest({
+              sessionId: launched.sessionId,
+              id: 5,
+              method: 'tools/call',
+              params: { name: 'echo', arguments: {} }
+            }),
+            15_000,
+            'mcp app after close'
+          )
+          check('mcp app: a closed session serves nothing', !!afterClose.error)
+        }
+        // The renderer names an explicit targetOrigin on every postMessage, so
+        // the constant it uses MUST match the scheme main actually serves. If
+        // these drift, every reply is silently dropped by the browser and the
+        // bridge dies with no error anywhere.
+        check(
+          'mcp app: the sandbox origin matches the served scheme',
+          SANDBOX_ORIGIN_HINT.startsWith(SANDBOX_SCHEME + '://') &&
+            SANDBOX_URL.startsWith(SANDBOX_ORIGIN_HINT)
+        )
+        // The official map runs from a custom scheme, so it has no HTTPS
+        // referrer. OSM requires native clients to identify themselves and
+        // otherwise returns a policy-block PNG with HTTP 200.
+        {
+          const headers = identifyOpenStreetMapRequest(
+            {
+              'User-Agent': 'Electron/33.4.11',
+              Accept: 'image/*',
+              'X-Unrelated': 'kept'
+            },
+            '0.0.93'
+          )
+          check(
+            'mcp map: OSM requests use a stable Roxy identity',
+            headers['User-Agent'] === 'Roxy/0.0.93 (+https://roxy.gg)'
+          )
+          check(
+            'mcp map: replacing the user agent preserves unrelated headers',
+            headers.Accept === 'image/*' && headers['X-Unrelated'] === 'kept'
+          )
+          check(
+            'mcp map: the interception is scoped to the official tile host',
+            OPENSTREETMAP_TILE_PATTERN === 'https://tile.openstreetmap.org/*'
+          )
+        }
+
+        // ---- the sandbox origin, for real ----------------------------------
+        // Everything above tests the BROKER. None of it proves the custom
+        // scheme actually serves, and that is the one layer whose failure mode
+        // is invisible: `registerSchemesAsPrivileged` has to run before
+        // app-ready, and if it didn't, every app view silently renders a blank
+        // frame with no error on any channel. Load it in a real window.
+        {
+          const win = new BrowserWindow({ show: false })
+          try {
+            // Load the proxy inside the same sandbox attributes as the product,
+            // then drive a real host -> proxy -> view -> host round trip. A
+            // top-level load only proves the custom scheme serves; it does not
+            // prove that the inner document receives host messages.
+            // Parent must be a REAL origin, as Roxy's renderer is; a `data:` parent
+            // is itself opaque and would test a situation the product never
+            // creates. The proxy is served on its own scheme, so loading it
+            // top-level gives the probe page a normal origin to act as host.
+            await win.loadURL(SANDBOX_URL)
+            const probe = (await win.webContents.executeJavaScript(
+              `new Promise((resolve) => {
+                 document.body.innerHTML = ''
+                 const seen = []
+                 let delivered = false
+                 let postError = null
+                 // Listener BEFORE the frame exists: the proxy announces itself
+                 // the moment its script runs, and registering afterwards loses
+                 // the very message under test.
+                 window.addEventListener('message', (e) => {
+                   if (e.source !== f.contentWindow) return
+                   seen.push({ method: e.data && e.data.method, origin: e.origin })
+                   if (e.data && e.data.method === "ui/notifications/sandbox-proxy-ready") {
+                     // Reply with the SAME target origin McpAppView uses, so a
+                     // mismatch fails here rather than as a blank frame in the
+                     // product.
+                     try {
+                       f.contentWindow.postMessage(
+                       {
+                         jsonrpc: '2.0',
+                         method: "ui/notifications/sandbox-resource-ready",
+                         params: {
+                           // No literal </script>: build the element instead,
+                           // so nothing depends on escaping surviving three
+                           // levels of nesting.
+                           html:
+                             '<body><script>' +
+                             'parent.postMessage({jsonrpc:"2.0",method:"ui/notifications/initialized"},"*")' +
+                             String.fromCharCode(60) + '/script' + String.fromCharCode(62) +
+                             '</body>',
+                           csp: "default-src 'none'; script-src 'unsafe-inline'"
+                         }
+                       },
+                       // The PRODUCT's constant, injected - not a literal. A
+                       // hardcoded '*' here would pass no matter what
+                       // McpAppView actually posts, which is exactly the gap
+                       // that let a broken targetOrigin ship green.
+                         ${JSON.stringify(SANDBOX_POST_TARGET)}
+                       )
+                     } catch (err) {
+                       // e.g. "Invalid target origin 'null'" - the browser
+                       // refusing the value outright.
+                       postError = String(err && err.message ? err.message : err)
+                       resolve({ seen, delivered, postError })
+                     }
+                   }
+                   // The inner view only speaks if the reply above arrived and
+                   // the proxy built its frame - end-to-end delivery, not a
+                   // guess about it.
+                   if (e.data && e.data.method === "ui/notifications/initialized") {
+                     delivered = true
+                     resolve({ seen, delivered, postError })
+                   }
+                 })
+                 const f = document.createElement('iframe')
+                 f.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-forms')
+                 f.src = window.location.href
+                 document.body.appendChild(f)
+                 setTimeout(() => resolve({ seen, delivered, postError }), 4000)
+               })`
+            )) as {
+              seen: { method?: string; origin: string }[]
+              delivered: boolean
+              postError: string | null
+            }
+            const ready = probe.seen.find((m) => m.method?.endsWith('proxy-ready'))
+            check(
+              'mcp app: the proxy announces itself from inside a sandboxed frame',
+              !!ready,
+              JSON.stringify(probe.seen)
+            )
+            // The proxy must have a real, addressable sandbox origin. If it
+            // becomes opaque, explicit host messages are silently dropped.
+            check(
+              'mcp app: ...from the sandbox origin, not an opaque one',
+              ready?.origin === SANDBOX_ORIGIN_HINT,
+              String(ready?.origin)
+            )
+            // Round trip: host -> proxy -> view -> host. Fails if targetOrigin
+            // is wrong, since the reply is dropped and the view never speaks.
+            check(
+              'mcp app: the host reply reaches the view',
+              probe.delivered === true,
+              probe.postError ?? undefined
+            )
+            // Match the official host: the dedicated sandbox origin is explicit
+            // rather than a wildcard, while frame identity is also checked.
+            check(
+              'mcp app: the host posts to the dedicated sandbox origin',
+              SANDBOX_POST_TARGET === SANDBOX_ORIGIN_HINT,
+              SANDBOX_POST_TARGET
+            )
+          } catch (e) {
+            check(
+              'mcp app: the proxy announces itself from inside a sandboxed frame',
+              false,
+              String(e)
+            )
+          } finally {
+            win.destroy()
+          }
+        }
+
+        _resetMcpAppsForTests()
+
+        // ---- cancellation --------------------------------------------------
+        // The `slow` tool never replies. Without a signal this would block for
+        // the full request timeout; with one it returns as soon as we abort.
+        const ac = new AbortController()
+        const startedAt = Date.now()
+        setTimeout(() => ac.abort(), 250)
+        const cancelled = await withTimeout(
+          callMcpTool('mcp__modernmcp__slow', {}, ac.signal),
+          15_000,
+          'mcp cancel'
+        )
+        check(
+          'mcp cancel: an aborted call returns promptly',
+          Date.now() - startedAt < 5_000,
+          `${Date.now() - startedAt}ms`
+        )
+        check(
+          'mcp cancel: ...and reports cancellation, not a server failure',
+          !cancelled.ok && /cancelled/i.test(cancelled.output),
+          cancelled.output
+        )
+
+        // ---- per-server request timeouts -----------------------------------
+        // Calls arrive by TOOL name, so `callMcpTool` has no config in hand and
+        // used to fall back to the global 120s default - a server configured
+        // with `timeout: 800` still hung a turn for two minutes. The budget is
+        // resolved at connect and carried on the connection.
+        const impatientRec: McpServerRecord = {
+          id: 'impatient',
+          enabled: true,
+          config: {
+            type: 'local',
+            command: [process.execPath, modernPath],
+            environment: { ELECTRON_RUN_AS_NODE: '1' },
+            timeout: 800
+          }
+        }
+        await ensureMcpConnected([impatientRec], process.cwd())
+        const slowStart = Date.now()
+        const timedOut = await withTimeout(
+          callMcpTool('mcp__impatient__slow', {}),
+          20_000,
+          'mcp per-server timeout'
+        )
+        const elapsed = Date.now() - slowStart
+        check(
+          'mcp timeout: a server\u2019s own budget is honoured, not the global default',
+          !timedOut.ok && elapsed < 10_000,
+          `${elapsed}ms`
+        )
+        await disposeConnection('impatient')
+
+        // ...and none of it leaks into what the model sees.
+        const modelSchema = mcpToolSchemas(new Set(['modernmcp'])).find(
+          (s) => s.function.name === 'mcp__modernmcp__structured'
+        )
+        check(
+          "mcp apps: extension metadata stays out of the model's tool list",
+          !!modelSchema && !JSON.stringify(modelSchema).includes('io.modelcontextprotocol/ui')
+        )
+
+        // Both eras coexist in one warm pool, each on its own negotiated wire.
+        await ensureMcpConnected([rec], process.cwd())
+        const legacySummary = mcpServerSummaries(new Set(['mockmcp']))[0]
+        check(
+          'mcp era: a 2025-era server still negotiates legacy alongside it',
+          legacySummary?.status === 'connected' && legacySummary?.era === 'legacy',
+          `${legacySummary?.era} / ${legacySummary?.error}`
+        )
+
+        await _resetMcpForTests()
+      }
+
       // ---- the `mcp` MANAGEMENT tool (add/list/enable/disable/reconnect/remove) ----
       // Drives the agent-facing tool through runTool end-to-end against the real DB
       // + the mock server: add → connect → use in the same flow → toggle → remove.
@@ -3004,6 +3589,12 @@ async function main(): Promise<void> {
         command: [process.execPath, mockPath],
         env: { ELECTRON_RUN_AS_NODE: '1' }
       }
+      // ---- the default: an agent-added server just runs ----------------------
+      // Installing a server is the user's decision, so the `mcp` tool connects
+      // it and Roxy discloses what it exposed afterwards. No prompt, no window
+      // needed - which is why this works in a headless run.
+      _resetTrustForTests()
+      repo.revokeMcpTrust('toolmcp')
       const added = await withTimeout(run('mcp', mcpCmd), 20_000, 'mcp tool add')
       check(
         'mcp tool: add connects the server and names its tools',
@@ -3014,6 +3605,47 @@ async function main(): Promise<void> {
         'mcp tool: add persists the server to the DB',
         repo.listMcpServers().some((r) => r.id === 'toolmcp')
       )
+      // Provenance still survives the write. It no longer gates anything by
+      // default, but it is what the disclosure says ("added by the agent") and
+      // what the opt-in confirm posture keys off.
+      check(
+        'mcp trust: an agent-added row stays marked agent-added',
+        repo.listMcpServers().find((r) => r.id === 'toolmcp')?.origin === 'agent'
+      )
+      // Connecting records the server, so the notice is a one-off rather than a
+      // banner on every turn.
+      check(
+        'mcp trust: connecting remembers the server',
+        repo.getMcpTrustStore().entries.some((e) => e.id === 'toolmcp' && e.decision === 'allow')
+      )
+
+      // ---- the exception: a KNOWN name now running something else ------------
+      // This is the one case that interrupts. With no window to ask, it must
+      // resolve to "not connected" rather than silently running the substitute.
+      const swapped = await withTimeout(
+        run('mcp', {
+          action: 'add',
+          id: 'toolmcp',
+          command: [process.execPath, mockPath, '--different'],
+          env: { ELECTRON_RUN_AS_NODE: '1' }
+        }),
+        20_000,
+        'mcp tool add (swapped)'
+      )
+      check(
+        'mcp trust: swapping a known server does not silently run it',
+        !swapped.ok && /declined/i.test(swapped.output),
+        swapped.output
+      )
+      // A refused swap must leave NO trace: the rejected command must not be
+      // sitting in the DB waiting to be picked up by the next enable/reconnect.
+      check(
+        'mcp trust: a declined swap does not overwrite the stored config',
+        repo.listMcpServers().find((r) => r.id === 'toolmcp')?.config.type === 'local' &&
+          !JSON.stringify(repo.listMcpServers().find((r) => r.id === 'toolmcp')?.config).includes(
+            '--different'
+          )
+      )
       // This is what runLoop calls to rebuild the live tool list mid-turn:
       check(
         'mcp tool: added server is immediately in the scoped schemas (usable same turn)',
@@ -4834,7 +5466,14 @@ async function main(): Promise<void> {
   await fs.rm(tmp, { recursive: true, force: true }).catch(() => undefined)
 }
 
+// Mirror src/main/index.ts: the MCP App sandbox scheme's privileges are locked
+// in at app-ready, so registration has to happen before it. Without this the
+// smoke process cannot load the sandbox origin at all - which is a property of
+// THIS harness, not of the product.
+registerSandboxScheme()
+
 app.whenReady().then(async () => {
+  serveSandbox()
   console.log('roxy runtime smoke test\n')
   // Watchdog so an overnight run can never hang.
   //