feat(ui): migrate MCP Apps SDK to v2

[SamMorrowDrums]

Summary

Migrate the MCP Apps UI from @modelcontextprotocol/ext-apps 1.7.5 to 2.0.3 and update its required SDK peers. The MCP Apps wire protocol and rendered behavior are unchanged.

Why

Follow-up to #3370, which deferred the ext-apps 2.x migration because of its split SDK peers and TypeScript API changes. No separate issue is linked.

What changed

• Upgrade @modelcontextprotocol/ext-apps to ^2.0.3; add required @modelcontextprotocol/client 2.x and zod 4.2+ peers.
• Replace the legacy @modelcontextprotocol/sdk/types.js CallToolResult imports with the SDK 2.x client package. Existing useApp initialization and event handlers are compatible; no handler behavior changes are needed.
• Replace deprecated go-github v92 Ptr calls with Go 1.26's built-in new(expr), fixing govet inline diagnostics without suppressing checks.
• Leave React 18.3.x, Primer, TypeScript, and @types/node unchanged. The SDK 2.x wire protocol is compatible with existing MCP Apps hosts.

MCP impact

• No tool or API changes — the UI dependency/API migration does not change MCP tool definitions, schemas, or server behavior.
• Tool schema or behavior changed
• New tool added

Prompts tested (tool changes only)

• N/A — no tool changes.

Security / limits

• No security or limits impact — npm audit reports 0 vulnerabilities.
• Auth / permissions considered
• Data exposure, filtering, or token/size limits considered

Tool renaming

• I am renaming tools as part of this PR (e.g. as part of a consolidation effort)
  • I have added the new tool aliases in deprecated_tool_aliases.go
• I am not renaming tools as part of this PR

Note: if you're renaming tools, you must add the tool aliases. For more information on how to do so, please refer to the official docs.

Lint & tests

• Linted locally with ./script/lint — GOTOOLCHAIN=go1.26.8 script/lint passed (0 issues).
• Tested locally with ./script/test — GOTOOLCHAIN=go1.26.8 script/test passed. Also passed cd ui && npm ci, npm run typecheck, npm run build, and npm audit (0 vulnerabilities). No separate browser/host smoke test was performed.

Docs

• Not needed — no MCP tools or generated documentation changed.
• Updated (README / docs / examples)

[Copilot]

Copilot review overview

🟢 Approval recommended

The changes follow the documented v2 migration path and introduce no unresolved issues.

Review effort: Balanced
Findings: None

What changed in this PR

Migrates the MCP Apps UI to ext-apps v2 while preserving existing behavior and wire compatibility.

Changes:

• Upgrades ext-apps and adds required v2 peer dependencies.
• Moves CallToolResult type imports to the split client package.
• Regenerates the npm lockfile.

File	Description
ui/​src/​hooks/​useMcpApp.ts	Updates the SDK type import.
ui/​src/​lib/​toolResult.ts	Updates the tool-result type import.
ui/​package.json	Declares ext-apps v2 dependencies.
ui/​package-lock.json	Locks the migrated dependency graph.

Files not reviewed (1)

• ui/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.