Release v2.0.4 · modelcontextprotocol/ext-apps

What's Changed

Patch release: example improvements and a dependency refresh. No changes to the @modelcontextprotocol/ext-apps library API.

pdf-server: single interact app tool by default — the viewer's thirteen per-action app tools (navigate, search, add_annotations, ...) meant one approval card each on hosts that ask the user to approve app tools separately. They are folded into one interact app tool mirroring the server-side interact (an action enum plus flat parameters, with an optional commands batch sharing the same contract: content[i] per commands[i], a failed step's slot starts with ERROR, no isError on multi-step batches). The per-action tools remain available behind a new --split-app-tools CLI flag. get-document-info is renamed get_document_info. In #830
map-server: get-screenshot app tool — capture the current map view as a PNG, with an optional maxDimension (64–2048, default 1024). In #821

pdf-server: saved page restored on tool-result re-delivery — the viewer persisted the current page to localStorage but discarded it on restore because of a bounds check against structuredContent.pageCount, a field the server stopped sending; reopened conversations now come back on the page the user left. In #828

Dependency refresh clearing the open npm audit findings — solid-js override 1.9.15 → 1.9.17 (seroval advisories) with the basic-server-solid pin matched to it, sharp ^0.35.3 → ^0.35.5 (librsvg CVE-2026-96889), and in-range lockfile refreshes of the other flagged transitives (shell-quote, proxy-addr, body-parser, zod, source-map-js, ip-address, hono, vite, @vue/server-renderer and the solid toolchain companions). Generated schemas regenerated for zod 4.6.6. In #827

Full Changelog: v2.0.3...v2.0.4