{"name":"io.github.2nd1st/open-mcp-apps","slug":"2nd1st-open-mcp-apps","title":null,"description":"Persistent, interactive MCP Apps — the AI builds an app once, you both reuse it","url":"https://mcp.market/server/2nd1st-open-mcp-apps","rating":null,"grade":"A","score":92,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":43,"stars":36,"forks":2,"downloads_week":117,"last_push_at":"2026-10-16T13:56:31.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/2nd1st/open-mcp-apps","website":"https://openmcp.app","version":"0.5.9","remotes":[],"packages":[{"registryType":"npm","identifier":"@2nd1st/open-mcp-apps","version":"0.5.9","transport":{"type":"stdio"},"environmentVariables":[{"description":"Path to the SQLite store. Defaults to a fixed per-user data directory; set this to isolate a store.","format":"filepath","name":"OMA_DB"},{"description":"Browser viewer on loopback. On by default; set to 0 to turn it off.","format":"string","name":"OMA_VIEWER"},{"description":"Set to 1 to also expose one open_<name> tool per saved app. Off by default, because it costs prompt cache.","format":"string","name":"OMA_DYNAMIC_TOOLS"}]}],"tools":[{"name":"app_history","description":"List an app's checkpoints as {checkpoint, ts, ui_size} — metadata only, NEVER the source (keeps context small; use get_app for the current source). Checkpoint 1 is the oldest; restore_app takes that number. History survives delete_app (tombstone). Each checkpoint snapshots BOTH slots (ui + manifest); restore brings back the pair.","write_action":false,"price_micros":0,"input_schema":null},{"name":"app_html","description":"Internal: returns raw app HTML plus its trust tier and capability grants for the universal loader widget. Not useful to call directly — use get_app to read source.","write_action":false,"price_micros":0,"input_schema":null},{"name":"app_store_list","description":"Browse the built-in App Store: ready-made, high-quality apps shipped with the engine that the user can install into their registry. Shows install state. Renders no UI — open_app {app: \"app-store\"} shows the browsable App Store app.","write_action":false,"price_micros":0,"input_schema":null},{"name":"app_store_preview","description":"Internal: returns an App Store entry's ui and manifest plus its mock-data fixtures, so the App Store app can render a LIVE sandboxed preview card (srcdoc + stub oma + mock snapshot). Read-only; nothing is installed. Not useful to call directly.","write_action":false,"price_micros":0,"input_schema":null},{"name":"call_function","description":"Run a function an app declares (manifest.functions) — data in, data out, no UI needed. Args are checked against the declared params; failures return the declared schema so the retry needs no extra read. The reply carries the return value plus a receipt per write.","write_action":true,"price_micros":0,"input_schema":null},{"name":"data_add_item","description":"Add an item to a collection. `group` is the app-defined lane/section (e.g. a kanban column); `fields` is a JSON object (e.g. {title, done, notes…}).","write_action":false,"price_micros":0,"input_schema":null},{"name":"data_batch","description":"","write_action":false,"price_micros":0,"input_schema":null},{"name":"data_changes","description":"What happened in a collection after a ledger position YOU hold — including edits the USER made in the widget, which never pass through you. Any mark you already have works as `since`: a write ack's `seq`, data_list's `version`, or the last call's `next_since`. Returns the contiguous run of events right after it (oldest first, whole events: actor, item id, fields) plus `next_since` to continue; omi","write_action":false,"price_micros":0,"input_schema":null},{"name":"data_collections","description":"List every data collection that exists (name, item count, last activity). Use when unsure where data lives, what boards the user has, or which collection to bind an app to. Renders no UI.","write_action":false,"price_micros":0,"input_schema":null},{"name":"data_delete_item","description":"Delete an item permanently. May return reason:\"confirmation_required\" with a request_state — show the user what is named in `note`, then re-send the same call with request_state attached.","write_action":true,"price_micros":0,"input_schema":null},{"name":"data_list","description":"Read items in full — every field, plus the item id you need to update or delete it. No UI (use open_app for that). Returns a PAGE: up to `limit` (default 100) matching items, with `total` and — when more exist — `next_cursor`; returned/total make a short delivery self-evident. `match` filters: a bare value means equals; an object is operators {ne, lt, lte, gt, gte, contains, prefix, exists} (numer","write_action":false,"price_micros":0,"input_schema":null},{"name":"data_move_item","description":"Move an item to another group and/or position (e.g. kanban column).","write_action":false,"price_micros":0,"input_schema":null},{"name":"data_update_item","description":"Shallow-merge fields into an item (set a key to null to remove it). Uses optimistic concurrency.","write_action":true,"price_micros":0,"input_schema":null},{"name":"data_version","description":"The cheapest possible change check: returns the global change counter (seq) plus settings/files sub-counters. If seq hasn't moved since you last looked, NOTHING changed anywhere — skip re-reading. Widgets use this for adaptive polling; you can too before re-listing a collection.","write_action":false,"price_micros":0,"input_schema":null},{"name":"delete_app","description":"Delete an app from the registry. Default data:\"keep\" is a tombstone: its data, files and history are KEPT and restore_app can bring the app back. data:\"cascade\" ALSO permanently deletes the data provably only this app used (plus its settings) — it always returns a disposition plan first: read the plan to the user (what will be deleted AND what will be kept and why), then re-send the same call with","write_action":true,"price_micros":0,"input_schema":null},{"name":"edit_app","description":"Surgical edits to an app WITHOUT round-tripping the whole source. Two edit forms, mixable: RANGE {offset, length, expect_hash, new_string} replaces a span you read with get_app (cheapest — echo the window's offset/returned/hash, no anchor text travels); STRING {old_string, new_string} replaces an exact-once match (or set replace_all). Range offsets always address the expected_version document and ","write_action":false,"price_micros":0,"input_schema":null},{"name":"file_delete","description":"Permanently delete one file an app has stored.","write_action":true,"price_micros":0,"input_schema":null},{"name":"file_list","description":"List the files an app (app) has stored — a PAGE of {path, size, mime, version} plus usage totals; limit/cursor page through, prefix narrows. These are opaque user files (attachments, exports) the app keeps — separate from its structured data collection. Renders no UI.","write_action":false,"price_micros":0,"input_schema":null},{"name":"file_read","description":"Read one file an app has stored, as a WINDOW of its bytes: offset/length select it, data_base64 carries exactly that window, next_offset continues (same window grammar as get_app, and for the same reason). Reassemble by concatenating decoded windows; sha256 is the WHOLE file's hash, so reassembly is checkable.","write_action":false,"price_micros":0,"input_schema":null},{"name":"file_write","description":"Store a file for an app (create or overwrite by path). `data_base64` is the file bytes, base64-encoded — pass any file the user gave you or that you generated. Overwriting an existing path bumps its version. Single-call writes are limited to a few MiB. Files persist and are the app's own, reusable across chats.","write_action":true,"price_micros":0,"input_schema":null},{"name":"file_write_begin","description":"Start a chunked upload for a file too big for file_write's single call. Returns an upload_id; send the bytes in order with file_write_chunk (each chunk up to ~… MiB of raw bytes), then file_write_commit names the file. Uploads expire after 30 idle minutes; per-file ceiling … MiB.","write_action":true,"price_micros":0,"input_schema":null},{"name":"file_write_chunk","description":"Append the next chunk of bytes (base64) to an upload started with file_write_begin. Send chunks strictly in order, one at a time. Pass `seq` (0-based chunk index) so a resend after a lost response is acknowledged instead of double-appended.","write_action":true,"price_micros":0,"input_schema":null},{"name":"file_write_commit","description":"Finalize an upload as an app file (create or overwrite by path) — the chunked equivalent of file_write. The upload is consumed either way; on failure, restart from file_write_begin.","write_action":true,"price_micros":0,"input_schema":null},{"name":"get_app","description":"Read an app's ui source as a WINDOW — offset/length select it, next_offset continues, total is the full length. Windows exist because some hosts silently drop the MIDDLE of an oversized result: a big app read whole can arrive mutilated with no sign, and an edit saved from it destroys the source. Carries version — the expected_version for edit_app / save_app — and hash, the expect_hash for a range ","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_app_guide","description":"READ THIS FIRST before creating or editing an app. Returns the window.oma API contract, available CSS design tokens, the data model, and a minimal working app template.","write_action":false,"price_micros":0,"input_schema":null},{"name":"install_from_app_store","description":"Install (or update) a ready-made app from the built-in App Store into the user's registry. Once installed it behaves like any app of the user's own; its UI updates come from the App Store (newer store version), not from edits. Use app_store_list to see what's available. Installing is HALF the job: before handing it over, seed the collection with the user's real rows (data_batch, from what you alre","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_apps","description":"List UI apps in the registry (reusable across all chats). If the UI the user wants already exists, prefer opening it over creating a new one. Lists the user's openable apps by default — pass name to look one up, or widen with kind/visibility.","write_action":false,"price_micros":0,"input_schema":null},{"name":"promote_app","description":"Upgrade a kind:\"visual\" app to a full app in ONE atomic step: the engine flips `kind` in the stored manifest, keeping every other declared key, and saves a new version (OCC-guarded, history kept). Already an app is a no-op; downgrades are refused — demoting is an author edit (save_app with the manifest), not a lifecycle verb.","write_action":false,"price_micros":0,"input_schema":null},{"name":"restore_app","description":"Roll an app back to one of its earlier checkpoints: re-saves that checkpoint's HTML as a NEW current one (nothing is lost — history is preserved and you can roll forward again). Use when a newer edit broke the UI. Get the checkpoint number from app_history; after restoring, open_app to view it.","write_action":false,"price_micros":0,"input_schema":null},{"name":"save_app","description":"Create or update a UI app in the persistent registry. Two slots, each optional on update (an omitted slot keeps its current value): ui — the complete self-contained HTML document (contract in get_app_guide; window.oma, no external resources, NO embedded manifest block) — and manifest, the app's declaration as a JSON object (kind, collections, settings, scene; keys in get_app_guide). manifest: null","write_action":true,"price_micros":0,"input_schema":null},{"name":"security_set","description":"Privileged writer for reserved settings keys (security:* / policy:*) — the ONLY tool that can write them; the generic data_* tools refuse reserved keys. Upserts one key/value in the settings collection.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ui_prefs_schema","description":"The engine-owned catalog of SHARED preferences (key, type, label, default, options) that the settings app renders. Apps read effective values via oma.pref(); this tool only describes what exists. Read-only.","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":92,"grade":"A","scanned_at":"2026-11-03T14:23:55.832Z","report":{"scannerVersion":"0.1.10","scannedAt":"2026-11-03T14:23:55.759Z","components":{"code":{"score":25,"max":25,"notes":["84 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":15,"max":15,"notes":["last push 18 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[],"inputs":{"packages":[{"registryType":"npm","identifier":"@2nd1st/open-mcp-apps","version":"0.5.9","found":true,"license":"MIT","hasInstallScripts":false,"dependencyCount":6,"publishedAt":"2026-08-16T06:23:40.281Z","repositoryUrl":"git+https://github.com/2nd1st/open-mcp-apps.git","weeklyDownloads":117}],"repo":{"found":true,"owner":"2nd1st","repo":"open-mcp-apps","archived":false,"pushedAt":"2026-10-16T13:56:31Z","stars":36,"forks":2,"openIssues":1,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/13744891?v=4","ownerCreatedAt":"2015-08-11T08:15:23Z","license":"MIT"},"icon":{"url":"https://openmcp.app/brand/openmcp-icon-light.svg","source":"registry"},"presence":{"stars":36,"forks":2,"downloadsWeek":117,"license":"MIT","lastPushAt":"2026-10-16T13:56:31.000Z","score":43}}}},"grade_history":[],"reviews":[]}