{
  "title": "MCP Apps Production Decision Framework",
  "schemaVersion": "1.0",
  "researchFreeze": "2026-08-26",
  "protocolRevision": "MCP Apps 2026-01-26 / ext-apps SDK v1.7.5 / MCP core 2026-07-28",
  "sourcePackage": "research/9",
  "integrityNote": "The 93 ordinary archive entries verify. Two self-referential bookkeeping entries have disclosed stale final rows; public corrections do not modify the raw archive.",
  "count": 8,
  "records": [
    {
      "Question": "Does the user need to manipulate, compare or inspect structured information?",
      "If yes": "An App may add material value.",
      "If no": "Return text or structuredContent without UI.",
      "id": "R9-DECISION001",
      "packageSourceIds": [
        "S004",
        "S006"
      ],
      "sourceIds": [
        "S390",
        "S136"
      ]
    },
    {
      "Question": "Will a useful fallback remain available in non-App hosts?",
      "If yes": "Proceed with progressive enhancement.",
      "If no": "Redesign the tool result before relying on Apps.",
      "id": "R9-DECISION002",
      "packageSourceIds": [
        "S004",
        "S006"
      ],
      "sourceIds": [
        "S390",
        "S136"
      ]
    },
    {
      "Question": "Is the interaction short-lived and conversation-scoped?",
      "If yes": "A View is a good fit.",
      "If no": "Consider linking to a full external application.",
      "id": "R9-DECISION003",
      "packageSourceIds": [
        "S004",
        "S006"
      ],
      "sourceIds": [
        "S390",
        "S136"
      ]
    },
    {
      "Question": "Does the UI need privileged browser APIs?",
      "If yes": "Confirm host capability, permission policy and fallback.",
      "If no": "Keep requested permissions empty.",
      "id": "R9-DECISION004",
      "packageSourceIds": [
        "S004",
        "S006"
      ],
      "sourceIds": [
        "S390",
        "S136"
      ]
    },
    {
      "Question": "Can external assets/APIs be bundled or tightly allowlisted?",
      "If yes": "Declare minimal CSP and configure CORS.",
      "If no": "The app may be brittle or unsafe across hosts.",
      "id": "R9-DECISION005",
      "packageSourceIds": [
        "S004",
        "S006"
      ],
      "sourceIds": [
        "S390",
        "S136"
      ]
    },
    {
      "Question": "Does the App request high-impact tools?",
      "If yes": "Use host confirmation plus server-side authorization and semantic validation.",
      "If no": "Still enforce least privilege.",
      "id": "R9-DECISION006",
      "packageSourceIds": [
        "S004",
        "S006"
      ],
      "sourceIds": [
        "S390",
        "S136"
      ]
    },
    {
      "Question": "Will users depend on keyboard, screen reader or zoom?",
      "If yes": "Apply WCAG/APG testing before release.",
      "If no": "Accessibility remains required, not optional.",
      "id": "R9-DECISION007",
      "packageSourceIds": [
        "S004",
        "S006"
      ],
      "sourceIds": [
        "S390",
        "S136"
      ]
    },
    {
      "Question": "Is the same UI expected to work in several hosts?",
      "If yes": "Test the stable minimum and maintain a capability matrix.",
      "If no": "Label product-specific dependencies clearly.",
      "id": "R9-DECISION008",
      "packageSourceIds": [
        "S004",
        "S006"
      ],
      "sourceIds": [
        "S390",
        "S136"
      ]
    }
  ]
}