AWS has released a sample for building one interactive MCP App that can render in both ChatGPT and Claude. The portable widget pattern is useful. The sample’s no-auth host connections are not a production security model.
AWS published the AgentCore MCP Apps guide on September 11, 2026 and provides a companion sample repository.
One MCP server can serve two assistant hosts
The sample uses the official Model Context Protocol SDK and the MCP Apps extension. A TypeScript and Express server exposes tools that return structured data and resources that provide interactive HTML widgets.
ChatGPT and Claude can both act as hosts. The server-side tool contract stays shared while each host renders the widget in its own surface. That gives builders a path to reuse business logic without forcing every interaction into plain text.
The architecture separates data from presentation
| Layer | Sample role | Production control |
|---|---|---|
| MCP tool | Returns structured task data | Authorization, validation and rate limits |
| MCP resource | Returns widget HTML | Content Security Policy and version pinning |
| AgentCore Runtime | Hosts the MCP server | Identity, network policy and observability |
| Lambda and DynamoDB | Store and retrieve application state | Least privilege and tenant isolation |
| Assistant host | Invokes tools and displays the widget | User consent and origin verification |
Do not copy the demo’s no-auth connection
The sample host configuration uses no authentication to make a disposable demonstration easy to connect. That choice is visible in the guide and appropriate only for a tightly controlled test with no sensitive data or consequential tools.
A public MCP endpoint without authentication can become an open application interface. Attackers may invoke tools, enumerate data, consume capacity or probe widget resources. Adding a login page later does not repair missing server-side authorization.
A production hardening checklist
- Authenticate every host connection and bind tokens to the intended audience.
- Authorize each tool call against user, tenant, action and resource.
- Give Runtime, Lambda and DynamoDB the smallest useful permissions.
- Set a restrictive Content Security Policy for widget resources.
- Validate structured input and output at the server boundary.
- Rate-limit by identity and record immutable tool-call audit events.
- Require human approval for destructive, financial or external actions.
Our OpenAI Agents API guide maps the wider execution boundary. The MCP stateless migration guide explains why connection behavior and application state should be tested separately.
Portability does not mean identical behavior
A shared MCP contract reduces integration work, but ChatGPT and Claude may differ in host permissions, widget presentation, consent flows and error handling. Run the same task matrix in both hosts and save the full request, server decision and rendered outcome.
Also test degraded states: expired credentials, a missing resource, a malformed widget, a tool timeout and a user who lacks access to one record. Portability is proven by predictable failure, not only by a successful demo.
A safe first deployment
Start with read-only data in a disposable AWS account. Connect one test host, add authentication, verify audit logs and only then add the second host. Keep state-changing tools out until the same identity produces the same authorization decision in every client.
The sample is valuable because it makes the portable UI pattern concrete. Its security omissions are equally valuable when they are treated as explicit work for the production version.
Read and inspect the primary material
Checked September 12, 2026. Architecture and sample behavior are attributed to AWS. Production security recommendations are MustHave.ai analysis.
