What's new

The ggui protocol is a pre-1.0 draft (currently draft-2026-06-12) — it can still change. This page tracks releases and protocol-affecting changes as they ship. For the semver rules behind what counts as breaking, see Version policy.

2026-08-13 — v0.9.0: host helpers get their real name

• Breaking: @ggui-ai/react is now @ggui-ai/mcp-apps-react, and @ggui-ai/react-native is now @ggui-ai/mcp-apps-react-native. Update your imports — the old package names are retired. The new names say what these packages are: MCP Apps host-helper libraries, not a ggui SDK.
• GguiRender and useWebSocket are removed from both packages. Rendering semantics live in the mounted view (iframe runtime), never in the helper.
• First release of the React Native host helper: @ggui-ai/mcp-apps-react-native, with <McpAppIframe> as its front door.
• All 32 published @ggui-ai/* packages moved to 0.9.0 in lockstep.

2026-08-11 — hub.ggui.ai: browse the public registry

• The registry browser is live at hub.ggui.ai — search published blueprints and gadgets, filter by the MCP tool or server they bind to, and see works-with chips and verified-publisher badges at a glance.

2026-08-10 — v0.7.0: renders that outlive their cache

• Reopening an old card from chat history now works even after its render was evicted from cache: resources/read re-mints the view from its stored blueprint and committed body, so old cards rehydrate instead of going stale.
• Resource-read failures are typed against a closed error enum, so a host can tell “gone” from “denied” from “malformed” instead of guessing.
• Hosted renders are kept indefinitely by default.
• All @ggui-ai/* packages moved to 0.7.0 in lockstep.

2026-08-08 — Host-capability awareness

• The iframe runtime now reads the host’s advertised capabilities at boot, instead of assuming every embedding host behaves the same way.
• Hosts that don’t relay ui/message back to the agent get an honest, one-time explanation in the UI instead of a gesture that silently goes nowhere.
• Relay incapability is only latched after a confirmed failure — a host is never assumed broken just because it hasn’t advertised a capability yet.

2026-08-08 — Browser CORS support on the MCP plane

• The MCP server now mounts a browser CORS layer with an allowlisted-origins model, so browser-based MCP clients can call it directly without a proxy.
• Origin and Host validation is enforced on both the HTTP and WebSocket upgrade ingresses, closing a DNS-rebinding gap.
• The CLI gained a --browser-origin flag (and GGUI_BROWSER_ORIGINS environment variable) to configure which origins are allowed.
• The /ggui/health endpoint now surfaces the effective allowed origins for debugging.

2026-08-07 — v0.6.3: rich text

• UI components generated by ggui can now carry rich-text descriptions — bold, italics, links, and inline code — instead of plain strings only.
• The rich-text parser is now vendored directly in the design package rather than pulled in as an external dependency.
• All @ggui-ai/* packages moved to 0.6.3 in lockstep.

Protocol baseline

The current protocol draft is draft-2026-06-12. See Version policy for how draft versions relate to semver on @ggui-ai/protocol, and what changes would trigger the next draft bump.