fix(mcp): harden MCP Apps host security and CJS compatibility

Reimplement the MCP Apps ui-meta helpers (RESOURCE_MIME_TYPE, getToolUiResourceUri,
isToolVisibilityModelOnly, isToolVisibilityAppOnly) in packages/api/src/mcp/apps.ts so
@librechat/api no longer imports the ESM-only @modelcontextprotocol/ext-apps from its CommonJS
build. ext-apps remains a client-only dependency, removing the require(ESM) boundary that throws
ERR_REQUIRE_ESM on Node versions without synchronous require(esm) support.

Add an mcpSettings.apps toggle (enabled unless explicitly false). Thread enableApps through
connection creation so the io.modelcontextprotocol/ui capability is advertised only when apps are
enabled, and gate the resource and app-tool-call routes with a requireMCPAppsEnabled middleware.

Authorize app-driven resources/read against the resources and templates a server advertises, so a
sandboxed app cannot proxy arbitrary uris. ui:// resources stay allowed and the check fails closed.

Render MCP apps in shared and search transcripts display-only by withholding the host-bound bridge
handlers and capabilities in read-only views, so an embedded app cannot call tools or read
resources with the viewer's auth while the stored tool result still renders.

api/server/controllers/mcpApps.js

@@ -3,6 +3,7 @@ const { logger } = require('@librechat/data-schemas');
 const { CacheKeys, Constants } = require('librechat-data-provider');
 const { getUserMCPAuthMap } = require('@librechat/api');
 const { getMCPManager, getFlowStateManager } = require('~/config');
+const { getAppConfig } = require('~/server/services/Config');
 const { resolveConfigServers } = require('~/server/services/MCP');
 const {
   findPluginAuthsByKeys,
@@ -249,10 +250,35 @@ const serveMCPSandbox = async (_req, res) => {
   }
 };
 
+/**
+ * Blocks MCP App endpoints when an admin has disabled apps via `mcpSettings.apps: false`.
+ * Defense-in-depth alongside the connection-level capability gate: even if a server still
+ * advertises UI tools, the host refuses to proxy resource reads and app tool calls while off.
+ */
+const requireMCPAppsEnabled = async (req, res, next) => {
+  try {
+    const appConfig =
+      req.config ??
+      (await getAppConfig({
+        role: req.user?.role,
+        userId: req.user?.id,
+        tenantId: req.user?.tenantId,
+      }));
+    if (appConfig?.mcpSettings?.apps === false) {
+      return res.status(403).json({ error: 'MCP Apps are disabled' });
+    }
+    return next();
+  } catch (error) {
+    logger.error('[requireMCPAppsEnabled] Error:', error);
+    return res.status(500).json({ error: 'Failed to resolve MCP Apps configuration' });
+  }
+};
+
 module.exports = {
   readMCPResource,
   listMCPResources,
   listMCPResourceTemplates,
   appToolCall,
   serveMCPSandbox,
+  requireMCPAppsEnabled,
 };

api/server/routes/mcp.js

@@ -37,6 +37,7 @@ const {
   listMCPResourceTemplates,
   appToolCall,
   serveMCPSandbox,
+  requireMCPAppsEnabled,
 } = require('~/server/controllers/mcpApps');
 const mcpAppToolCallLimiter = require('~/server/middleware/limiters/mcpAppToolCallLimiter');
 const {
@@ -992,13 +993,25 @@ router.delete(
  * Read a UI resource from an MCP server
  * @route POST /api/mcp/resources/read
  */
-router.post('/resources/read', requireJwtAuth, checkMCPUsePermissions, readMCPResource);
+router.post(
+  '/resources/read',
+  requireJwtAuth,
+  checkMCPUsePermissions,
+  requireMCPAppsEnabled,
+  readMCPResource,
+);
 
 /**
  * List resources available on an MCP server
  * @route POST /api/mcp/resources/list
  */
-router.post('/resources/list', requireJwtAuth, checkMCPUsePermissions, listMCPResources);
+router.post(
+  '/resources/list',
+  requireJwtAuth,
+  checkMCPUsePermissions,
+  requireMCPAppsEnabled,
+  listMCPResources,
+);
 
 /**
  * List resource templates available on an MCP server
@@ -1008,6 +1021,7 @@ router.post(
   '/resources/templates/list',
   requireJwtAuth,
   checkMCPUsePermissions,
+  requireMCPAppsEnabled,
   listMCPResourceTemplates,
 );
 
@@ -1019,6 +1033,7 @@ router.post(
   '/app-tool-call',
   requireJwtAuth,
   checkMCPUsePermissions,
+  requireMCPAppsEnabled,
   mcpAppToolCallLimiter,
   appToolCall,
 );

api/server/services/initializeMCPs.js

@@ -31,6 +31,7 @@ async function initializeMCPs() {
       appConfig?.mcpSettings?.allowedDomains,
       appConfig?.mcpSettings?.allowedAddresses,
       resolveMCPAllowlists,
+      appConfig?.mcpSettings?.apps,
     );
   } catch (error) {
     logger.error('[MCP] Failed to initialize MCPServersRegistry:', error);

api/server/services/initializeMCPs.spec.js

@@ -83,6 +83,7 @@ describe('initializeMCPs', () => {
         ['localhost'],
         undefined,
         expect.any(Function), // per-request allowlist resolver
+        undefined, // mcpSettings.apps
       );
     });
 
@@ -100,6 +101,7 @@ describe('initializeMCPs', () => {
         allowedDomains,
         undefined,
         expect.any(Function),
+        undefined,
       );
     });
 
@@ -116,6 +118,7 @@ describe('initializeMCPs', () => {
         undefined,
         undefined,
         expect.any(Function),
+        undefined,
       );
     });