feat: add mcp app renderer (#6095)

Co-authored-by: Douwe Osinga <douwe@block.xyz>
Co-authored-by: Douwe Osinga <douwe@squareup.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

ui/desktop/openapi.json

@@ -2698,6 +2698,9 @@
           "is_error"
         ],
         "properties": {
+          "_meta": {
+            "nullable": true
+          },
           "content": {
             "type": "array",
             "items": {
@@ -2942,6 +2945,28 @@
           }
         }
       },
+      "CspMetadata": {
+        "type": "object",
+        "description": "Content Security Policy metadata for MCP Apps\nSpecifies allowed domains for network connections and resource loading",
+        "properties": {
+          "connectDomains": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Domains allowed for connect-src (fetch, XHR, WebSocket)",
+            "nullable": true
+          },
+          "resourceDomains": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Domains allowed for resource loading (scripts, styles, images, fonts, media)",
+            "nullable": true
+          }
+        }
+      },
       "DeclarativeProviderConfig": {
         "type": "object",
         "required": [
@@ -3734,6 +3759,52 @@
           }
         }
       },
+      "McpAppResource": {
+        "type": "object",
+        "description": "MCP App Resource\nRepresents a UI resource that can be rendered in an MCP App",
+        "required": [
+          "uri",
+          "name",
+          "mimeType"
+        ],
+        "properties": {
+          "_meta": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/ResourceMetadata"
+              }
+            ],
+            "nullable": true
+          },
+          "blob": {
+            "type": "string",
+            "description": "Base64-encoded binary content (alternative to text)",
+            "nullable": true
+          },
+          "description": {
+            "type": "string",
+            "description": "Optional description of what this resource does",
+            "nullable": true
+          },
+          "mimeType": {
+            "type": "string",
+            "description": "MIME type (should be \"text/html;profile=mcp-app\" for MCP Apps)"
+          },
+          "name": {
+            "type": "string",
+            "description": "Human-readable name of the resource"
+          },
+          "text": {
+            "type": "string",
+            "description": "Text content of the resource (HTML for MCP Apps)",
+            "nullable": true
+          },
+          "uri": {
+            "type": "string",
+            "description": "URI of the resource (must use ui:// scheme)"
+          }
+        }
+      },
       "Message": {
         "type": "object",
         "description": "A message to or from an LLM",
@@ -4807,6 +4878,20 @@
           }
         ]
       },
+      "ResourceMetadata": {
+        "type": "object",
+        "description": "Resource metadata containing UI configuration",
+        "properties": {
+          "ui": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/UiMetadata"
+              }
+            ],
+            "nullable": true
+          }
+        }
+      },
       "Response": {
         "type": "object",
         "properties": {
@@ -5722,6 +5807,30 @@
           "disabled"
         ]
       },
+      "UiMetadata": {
+        "type": "object",
+        "description": "UI-specific metadata for MCP resources",
+        "properties": {
+          "csp": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/CspMetadata"
+              }
+            ],
+            "nullable": true
+          },
+          "domain": {
+            "type": "string",
+            "description": "Preferred domain for the app (used for CORS)",
+            "nullable": true
+          },
+          "prefersBorder": {
+            "type": "boolean",
+            "description": "Whether the app prefers to have a border around it",
+            "nullable": true
+          }
+        }
+      },
       "UpdateCustomProviderRequest": {
         "type": "object",
         "required": [