From ea5600a4b1ab35c32c27f90564abf833d7c57255 Mon Sep 17 00:00:00 2001
From: Dustin Healy <54083382+dustinhealy@users.noreply.github.com>
Date: Tue, 30 Jun 2026 08:48:53 -0700
Subject: [PATCH] docs(mcp): clarify the UI capability is a host-level,
 per-session setting

Note at the advertising site that io.modelcontextprotocol/ui tracks the instance-wide apps setting
and per-tenant policy is enforced downstream, so the rationale lives with the code.
---
 packages/api/src/mcp/connection.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/api/src/mcp/connection.ts b/packages/api/src/mcp/connection.ts
index 24a4b7157e..a00c8f647e 100644
--- a/packages/api/src/mcp/connection.ts
+++ b/packages/api/src/mcp/connection.ts
@@ -1266,8 +1266,8 @@ export class MCPConnection extends EventEmitter {
     if (params.oauthTokens) {
       this.oauthTokens = params.oauthTokens;
     }
-    // Advertise the UI capability so servers expose app-enhanced tools; suppressed when MCP Apps
-    // are disabled by config.
+    // io.modelcontextprotocol/ui is a per-session host capability, so it tracks the instance-wide
+    // apps setting; per-tenant apps policy is enforced downstream, not renegotiated per request.
     const appsEnabled = params.enableApps !== false;
     const capabilities: ClientCapabilities = appsEnabled
       ? { extensions: { 'io.modelcontextprotocol/ui': { mimeTypes: [RESOURCE_MIME_TYPE] } } }