v1.31.0

Servers that deliver interactive UIs through the MCP Apps extension now get
six checks in a new apps group: well-formed UI metadata, ui:// pointers
that resolve, and HTML content served with the right MIME type. Servers
without UI metadata skip the group, so their scores do not move. mcpscore
now declares the MCP Apps extension, so servers that show UI tools only to
supporting clients show them to the audit.

Added

• MCP Apps rules: six checks for servers that deliver interactive UIs.
  A server whose tools point at a ui:// resource (_meta.ui.resourceUri)
  now gets a new apps group: the UI metadata is well-formed, each pointer
  names a ui:// URI that resources/read returns, and the content is an
  HTML document served as text/html;profile=mcp-app. A LOW check flags
  tools that use only the deprecated _meta["ui/resourceUri"] key; sending
  both keys passes. Servers without UI metadata skip the group as
  not-applicable, so their scores do not move.

Changed

• mcpscore now declares the MCP Apps extension (io.modelcontextprotocol/ui)
  in initialize and in its stateless server/discover, tools/list and
  extension requests, as hosts do. A server that registers UI tools only for
  supporting clients now shows them to the audit.
• Dependencies refreshed: anyio 4.16.0 and python-multipart 0.0.33
  (through the MCP SDK). The mcp==2.3.0 pin is the latest SDK release.

Fixed

• A lone surrogate in a skill URI no longer aborts the audit. URI
  comparison now encodes it as its UTF-8 bytes, so it matches only itself.