Zullo warns developers: build MCP apps now or risk getting bypassed

This evolution is not just about aesthetics; it is about rewriting how users interact with software. As major AI platforms open their app marketplaces, the companies that fail to ship native interactive agents risk fading into obsolescence.

The Anatomy of an MCP App

Unlike traditional MCP servers that merely feed raw text or structured data to an LLM, an MCP App delivers a sandboxed iframe containing a rich frontend widget. This architecture fundamentally changes the user experience. Instead of forcing a human to read through a dense wall of text, the host client—such as Claude Desktop or ChatGPT—renders a structured, interactive UI dynamically populated by tool arguments.

This interaction is bidirectional. A JSON-RPC transport layer built over postMessage allows the sandboxed iframe and the LLM host to exchange data in real time. The app registers UI resources during initialization using the ui:// URI scheme. When the user interacts with the rendered widget, those state changes immediately propagate back to the host application, creating a continuous feedback loop between the human, the UI, and the model.

Bidirectional Primitives You Need to Know

To build these experiences, developers must understand the core primitives that drive bidirectional communication. Zullo highlights several critical capabilities:

• Context Syncing via State Manipulation: Using the set state primitive, the iframe can push its current state directly into the model's context window. If a user clicks an item or selects an option within the widget, the model instantly becomes aware of that change without requiring the user to type a single explanatory message.
• Direct Message Ingestion: The ui/message primitive allows the widget to programmatically send follow-up prompts back to the conversation. On platforms like ChatGPT, clicking a button in the UI can immediately trigger the model to stream a new response, while Claude populates the chat input box for user approval.
• Real-time Token Streaming: The UI can ingest partial token outputs dynamically as the LLM generates them. A prime example of this is the Excalidraw MCP server, which visually renders an interactive vector canvas stroke-by-stroke in real time as the model outputs raw syntax.

Securing Data Privacy with Decoupled Outputs

One of the most compelling advantages of the MCP App architecture is its native solution to LLM data privacy concerns. When an MCP server handles sensitive, proprietary, or personal data, sending that raw information to a model provider's servers is often a regulatory non-starter.

MCP Apps solve this by decoupling the UI rendering layer from the model's context payload. Developers can design tools that return two entirely separate outputs. The first is a highly detailed, data-rich card displayed locally to the user within the sandboxed widget. The second is a heavily redacted, high-level text summary sent to the LLM itself.

For example, an app can render a user's full, private billing history in the local iframe while telling the model nothing more than: "The user is viewing their private billing panel." The model can guide the interaction, but the underlying private records never leave the local environment.

Organic Discovery and the Death of the Dashboard

Distribution has evolved beyond manual configuration. The introduction of self-serve submission processes in the App Stores for Claude, ChatGPT, and Cursor has eliminated the need for users to copy and paste fragile JSON configuration files.

More importantly, platforms like Claude have introduced dynamic, organic discovery. When a user asks Claude to complete a task, the LLM client searches the global MCP registry to locate, recommend, and install the appropriate connector on the fly. If a developer's tool is vetted and available in the store, the model will dynamically pull that tool into the conversation to solve the user's problem.

This shift challenges the very necessity of traditional web dashboards. As AI agents become the primary workspace where humans manage code, compile reports, and track tasks, SaaS products must meet users where they are. Rather than forcing users to navigate to an external browser tab, modern software must deliver its entire interface directly inside the chat window. The command center has migrated, and the AI client is the new browser.