Skip to content

saga a2ui 1.0.0-rc.1

Pre-release
Pre-release

Choose a tag to compare

View all tags
@timeleft-- timeleft-- released this 05 Nov 16:52
v1.0.0-rc.1
4a5eec2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

saga a2ui 1.0 is the first release with a compatibility promise. Build an agentic app once with React or Lit, and serve it through MCP Apps to Claude, ChatGPT and Alexa+.

npm install @saga-a2ui/react-mcp-stack@next react react-dom zod

Hardened for security

1.0 builds on the Daybreak Blue certified code. That code went through more than five days of scanning and remediation with OpenAI Daybreak Blue at Extra High:

  • The final scan covered all 1,033 tracked files and found no new reportable findings.
  • 37 findings were closed: 30 fixed, 3 mitigated and 4 not applicable.
  • 27 remediation pull requests landed, each reviewed independently.

Every change since then was independently reviewed as well.

SAGA bounds the paths where it meets untrusted input:

  • Conversation payloads are size-checked before they reach the host.
  • Operation results are size- and shape-checked before serialization.
  • Protected media and decoded audio are capped.
  • Known issues in the MCP SDK and A2UI libraries are blocked before they can be reached.

Answer cards render Markdown through a maintained parser into restricted nodes. A Content-Security-Policy derived from the card's content policy is embedded in the served document, and images load only from hosts the application lists, after the reader consents.

Built to stay small in your app

Seven packages, each with one owner and one job:

Package What it gives you
@saga-a2ui/react-mcp-stack, @saga-a2ui/lit-mcp-stack One install per renderer: your catalog, surfaces, actions, FaithfulCard and server entry points
@saga-a2ui/core A2UI message validation, surfaces and the action runtime, independent of any renderer
@saga-a2ui/mcp MCP and MCP Apps delivery: views, operations and content policy
@saga-a2ui/react, @saga-a2ui/lit The renderers
@saga-a2ui/components FaithfulCard, the versioned answer card

An application states its layout, its catalog, what a result means and what its actions do. SAGA writes the A2UI messages, connects to the MCP Apps bridge and orders the handshake. Starters ship for Node, Express, Fastify, Hono and Hapi.

What 1.0 settles

  • Stable view addresses. A view's ui:// address names its compatibility major: operationViewFromHtml({ ..., major: 1 }) serves ui://views/answer.v1.html. Compatible redeploys keep the address, so hosts that cached a tool descriptor keep reading a served view.
  • Catalog id. FaithfulCard surfaces open over https://saga-a2ui.dev/catalogs/faithful-card/v1.
  • Zod, named for what it is. Use the stack's z3, A2UI's Zod 3, for surface and catalog schemas, and zod 4 for MCP tool schemas.
  • React peers accept React 19 from 19.3.1.

Upgrading from 0.x

  • Pass major: 1 to operationViewFromHtml. Keep any build stamp in your HTML: it no longer changes the address.
  • Replace z imported from a stack with z3.
  • If you persist or compare catalog ids, update them to the saga-a2ui.dev id.

1.0.0-rc.1 still accepts the 0.x forms (z, and omitting major) so you can move at your own pace. 1.0.0 removes them.

Semver

Semver covers SAGA's exports, the FaithfulCard contract version and its catalog id. SAGA targets A2UI v0.9 and the MCP 2026-07-28 protocol; moving to a new protocol version is called out in the release that does it. Packages ship TypeScript source for a TypeScript-aware bundler.

Source

The released code is at release/1.0.0-rc.1 and the v1.0.0-rc.1 tag (4a5eec2). The packages are on npm under next.

Assets 2
Loading