{
  "title": "MCP Apps Myths and Evidence",
  "schemaVersion": "1.0",
  "researchFreeze": "2026-08-26",
  "protocolRevision": "MCP Apps 2026-01-26 / ext-apps SDK v1.7.5 / MCP core 2026-07-28",
  "sourcePackage": "research/9",
  "integrityNote": "The 93 ordinary archive entries verify. Two self-referential bookkeeping entries have disclosed stale final rows; public corrections do not modify the raw archive.",
  "count": 35,
  "records": [
    {
      "Myth": "An MCP App is an MCP server.",
      "Evidence-based assessment": "False. The server publishes the tool and UI resource; the App is the host-rendered View.",
      "Source IDs": "S004",
      "id": "R9-MYTH001",
      "packageSourceIds": [
        "S004"
      ],
      "sourceIds": [
        "S390"
      ]
    },
    {
      "Myth": "Every MCP tool is an MCP App.",
      "Evidence-based assessment": "False. Only tools linked to UI resources become App-enhanced in compatible hosts.",
      "Source IDs": "S004",
      "id": "R9-MYTH002",
      "packageSourceIds": [
        "S004"
      ],
      "sourceIds": [
        "S390"
      ]
    },
    {
      "Myth": "MCP Apps replace tools.",
      "Evidence-based assessment": "False. Tools remain the operational capability.",
      "Source IDs": "S004",
      "id": "R9-MYTH003",
      "packageSourceIds": [
        "S004"
      ],
      "sourceIds": [
        "S390"
      ]
    },
    {
      "Myth": "MCP Apps existed at MCP launch.",
      "Evidence-based assessment": "False. The proposal was November 2025 and stable extension January 2026.",
      "Source IDs": "S001 S002",
      "id": "R9-MYTH004",
      "packageSourceIds": [
        "S001",
        "S002"
      ],
      "sourceIds": [
        "S388",
        "S059"
      ]
    },
    {
      "Myth": "MCP Apps only work in Claude.",
      "Evidence-based assessment": "False. Multiple hosts and developer tools document support.",
      "Source IDs": "S002 S006 S044 S046 S048",
      "id": "R9-MYTH005",
      "packageSourceIds": [
        "S002",
        "S006",
        "S044",
        "S046",
        "S048"
      ],
      "sourceIds": [
        "S059",
        "S136",
        "S143",
        "S422",
        "S424"
      ]
    },
    {
      "Myth": "Every MCP host supports Apps.",
      "Evidence-based assessment": "False. Extensions are optional and support is uneven.",
      "Source IDs": "S007 S081",
      "id": "R9-MYTH006",
      "packageSourceIds": [
        "S007",
        "S081"
      ],
      "sourceIds": [
        "S392",
        "S269"
      ]
    },
    {
      "Myth": "The iframe can access the host DOM.",
      "Evidence-based assessment": "False under the intended sandbox model.",
      "Source IDs": "S004 S060",
      "id": "R9-MYTH007",
      "packageSourceIds": [
        "S004",
        "S060"
      ],
      "sourceIds": [
        "S390",
        "S436"
      ]
    },
    {
      "Myth": "CSP makes an App secure.",
      "Evidence-based assessment": "False. CSP is one control and does not validate code, data or authorization.",
      "Source IDs": "S004 S064",
      "id": "R9-MYTH008",
      "packageSourceIds": [
        "S004",
        "S064"
      ],
      "sourceIds": [
        "S390",
        "S440"
      ]
    },
    {
      "Myth": "Declaring a CSP domain fixes CORS.",
      "Evidence-based assessment": "False. The external API must permit the App origin.",
      "Source IDs": "S010 S063",
      "id": "R9-MYTH009",
      "packageSourceIds": [
        "S010",
        "S063"
      ],
      "sourceIds": [
        "S395",
        "S439"
      ]
    },
    {
      "Myth": "An App can call every tool without approval.",
      "Evidence-based assessment": "False. Host policy, visibility and server authorization apply.",
      "Source IDs": "S004",
      "id": "R9-MYTH010",
      "packageSourceIds": [
        "S004"
      ],
      "sourceIds": [
        "S390"
      ]
    },
    {
      "Myth": "App-only tools are visible to the model.",
      "Evidence-based assessment": "False; the host must exclude them from the model tool list.",
      "Source IDs": "S004",
      "id": "R9-MYTH011",
      "packageSourceIds": [
        "S004"
      ],
      "sourceIds": [
        "S390"
      ]
    },
    {
      "Myth": "A View can force fullscreen.",
      "Evidence-based assessment": "False. The host may decline.",
      "Source IDs": "S004",
      "id": "R9-MYTH012",
      "packageSourceIds": [
        "S004"
      ],
      "sourceIds": [
        "S390"
      ]
    },
    {
      "Myth": "MCP Apps use the removed core initialize handshake.",
      "Evidence-based assessment": "Misleading. The extension has its own ui/initialize lifecycle.",
      "Source IDs": "S004 S026",
      "id": "R9-MYTH013",
      "packageSourceIds": [
        "S004",
        "S026"
      ],
      "sourceIds": [
        "S390",
        "S054"
      ]
    },
    {
      "Myth": "The MCP Apps SDK version is the protocol version.",
      "Evidence-based assessment": "False. SDK and stable extension versions are independent.",
      "Source IDs": "S004 S017",
      "id": "R9-MYTH014",
      "packageSourceIds": [
        "S004",
        "S017"
      ],
      "sourceIds": [
        "S390",
        "S402"
      ]
    },
    {
      "Myth": "MCP-UI and MCP Apps were always the same project.",
      "Evidence-based assessment": "False. MCP-UI preceded and influenced the official extension.",
      "Source IDs": "S001 S032",
      "id": "R9-MYTH015",
      "packageSourceIds": [
        "S001",
        "S032"
      ],
      "sourceIds": [
        "S388",
        "S412"
      ]
    },
    {
      "Myth": "OpenAI Apps SDK and MCP Apps are automatically interchangeable.",
      "Evidence-based assessment": "False as a blanket claim. OpenAI now directs new ChatGPT UI builds to the MCP Apps standard, while optional ChatGPT extensions such as window.openai and product distribution rules still require compatibility testing.",
      "Source IDs": "S004 S034 S035",
      "id": "R9-MYTH016",
      "packageSourceIds": [
        "S004",
        "S034",
        "S035"
      ],
      "sourceIds": [
        "S390",
        "S414",
        "S415"
      ],
      "editorialCorrection": "Updated the explanation for OpenAI’s standards-first current guidance."
    },
    {
      "Myth": "An MCP App contains the model.",
      "Evidence-based assessment": "False. The model is controlled by the host.",
      "Source IDs": "S004 S006",
      "id": "R9-MYTH017",
      "packageSourceIds": [
        "S004",
        "S006"
      ],
      "sourceIds": [
        "S390",
        "S136"
      ]
    },
    {
      "Myth": "The View talks directly to the MCP server.",
      "Evidence-based assessment": "Normally false in the standardized architecture; the Host proxies permitted MCP methods.",
      "Source IDs": "S004 S014",
      "id": "R9-MYTH018",
      "packageSourceIds": [
        "S004",
        "S014"
      ],
      "sourceIds": [
        "S390",
        "S399"
      ]
    },
    {
      "Myth": "structuredContent is always sent to the model.",
      "Evidence-based assessment": "False. The stable spec recommends using it for the UI and keeping model fallback concise.",
      "Source IDs": "S004",
      "id": "R9-MYTH019",
      "packageSourceIds": [
        "S004"
      ],
      "sourceIds": [
        "S390"
      ]
    },
    {
      "Myth": "MCP Apps eliminate token costs.",
      "Evidence-based assessment": "False. UI can reduce some conversational turns but context updates and fallback content still consume tokens.",
      "Source IDs": "S004 S006",
      "id": "R9-MYTH020",
      "packageSourceIds": [
        "S004",
        "S006"
      ],
      "sourceIds": [
        "S390",
        "S136"
      ]
    },
    {
      "Myth": "Interactive UI always improves UX.",
      "Evidence-based assessment": "False. It can add latency, complexity and accessibility burden.",
      "Source IDs": "S057 S077",
      "id": "R9-MYTH021",
      "packageSourceIds": [
        "S057",
        "S077"
      ],
      "sourceIds": [
        "S433",
        "S453"
      ]
    },
    {
      "Myth": "A dedicated App domain is portable across all hosts.",
      "Evidence-based assessment": "False. Domain formats and validation are host-specific.",
      "Source IDs": "S004 S010",
      "id": "R9-MYTH022",
      "packageSourceIds": [
        "S004",
        "S010"
      ],
      "sourceIds": [
        "S390",
        "S395"
      ]
    },
    {
      "Myth": "Browser localStorage is durable application state.",
      "Evidence-based assessment": "Not reliably across hosts or View lifecycles.",
      "Source IDs": "S004 S076",
      "id": "R9-MYTH023",
      "packageSourceIds": [
        "S004",
        "S076"
      ],
      "sourceIds": [
        "S390",
        "S452"
      ]
    },
    {
      "Myth": "MCP Apps can only use React.",
      "Evidence-based assessment": "False. The protocol is framework-neutral and official examples cover several frameworks.",
      "Source IDs": "S003 S006",
      "id": "R9-MYTH024",
      "packageSourceIds": [
        "S003",
        "S006"
      ],
      "sourceIds": [
        "S389",
        "S136"
      ]
    },
    {
      "Myth": "A tool result must be UI-only.",
      "Evidence-based assessment": "False. Useful text/structured fallback is central to progressive enhancement.",
      "Source IDs": "S004 S008",
      "id": "R9-MYTH025",
      "packageSourceIds": [
        "S004",
        "S008"
      ],
      "sourceIds": [
        "S390",
        "S393"
      ]
    },
    {
      "Myth": "Permissions declared by the App are guaranteed.",
      "Evidence-based assessment": "False. Hosts and browsers may decline.",
      "Source IDs": "S004 S066",
      "id": "R9-MYTH026",
      "packageSourceIds": [
        "S004",
        "S066"
      ],
      "sourceIds": [
        "S390",
        "S442"
      ]
    },
    {
      "Myth": "Sandboxing prevents prompt injection.",
      "Evidence-based assessment": "False. Untrusted tool results and external content can still influence model or user decisions.",
      "Source IDs": "S004 S030",
      "id": "R9-MYTH027",
      "packageSourceIds": [
        "S004",
        "S030"
      ],
      "sourceIds": [
        "S390",
        "S410"
      ]
    },
    {
      "Myth": "Every current product supports PiP.",
      "Evidence-based assessment": "False. Display-mode support varies by host.",
      "Source IDs": "S007 S041 S044",
      "id": "R9-MYTH028",
      "packageSourceIds": [
        "S007",
        "S041",
        "S044"
      ],
      "sourceIds": [
        "S392",
        "S420",
        "S143"
      ]
    },
    {
      "Myth": "Cursor does not support MCP Apps.",
      "Evidence-based assessment": "False. Current official Cursor documentation explicitly lists the Apps extension as supported and describes interactive UI views.",
      "Source IDs": "S081",
      "id": "R9-MYTH029",
      "packageSourceIds": [
        "S081"
      ],
      "sourceIds": [
        "S269"
      ],
      "packageSnapshot": {
        "myth": "Cursor currently documents full MCP Apps support.",
        "assessment": "Not established by the reviewed official Cursor documentation."
      },
      "editorialCorrection": "Reframed the stale archive row around the current, source-supported product state."
    },
    {
      "Myth": "App-provided tools are stable today.",
      "Evidence-based assessment": "False as of verification; they remain draft.",
      "Source IDs": "S005 S079",
      "id": "R9-MYTH030",
      "packageSourceIds": [
        "S005",
        "S079"
      ],
      "sourceIds": [
        "S391",
        "S455"
      ]
    },
    {
      "Myth": "MCP Apps has a universal public marketplace.",
      "Evidence-based assessment": "False. Discovery remains host- and directory-specific, and a canonical Apps directory is still an open topic.",
      "Source IDs": "S071",
      "id": "R9-MYTH031",
      "packageSourceIds": [
        "S071"
      ],
      "sourceIds": [
        "S447"
      ]
    },
    {
      "Myth": "Protocol conformance guarantees accessibility.",
      "Evidence-based assessment": "False. Accessibility requires implementation and assistive-technology testing.",
      "Source IDs": "S057 S068",
      "id": "R9-MYTH032",
      "packageSourceIds": [
        "S057",
        "S068"
      ],
      "sourceIds": [
        "S433",
        "S444"
      ]
    },
    {
      "Myth": "The stable specification supports streamed HTML resources.",
      "Evidence-based assessment": "False. Streaming is an open proposal.",
      "Source IDs": "S004 S077",
      "id": "R9-MYTH033",
      "packageSourceIds": [
        "S004",
        "S077"
      ],
      "sourceIds": [
        "S390",
        "S453"
      ]
    },
    {
      "Myth": "The host confirmation replaces upstream authorization.",
      "Evidence-based assessment": "False. The server and target system must authorize the action.",
      "Source IDs": "S030",
      "id": "R9-MYTH034",
      "packageSourceIds": [
        "S030"
      ],
      "sourceIds": [
        "S410"
      ]
    },
    {
      "Myth": "An MCP App is simply an iframe URL.",
      "Evidence-based assessment": "False. Stable Apps use a declared UI resource, tool metadata and a negotiated bridge protocol.",
      "Source IDs": "S004",
      "id": "R9-MYTH035",
      "packageSourceIds": [
        "S004"
      ],
      "sourceIds": [
        "S390"
      ]
    }
  ]
}