Confirm the tool advertises a UI
Inspect the tool descriptor returned by tools/list. The UI metadata must point to the exact ui:// resource URI. One different slash or hostname-like segment is a different resource.
Read that exact resource
Call resources/read with the advertised URI. Confirm the returned item uses the MCP Apps HTML profile MIME type expected by the host and contains actual HTML text. A normal text/html response from an unrelated web route is not automatically the same contract.
Look at policy before JavaScript
If the shell renders but scripts, fonts or API calls fail, compare every external origin with the declared CSP metadata. Keep the list narrow. Adding a wildcard to make the panel work trades one visible bug for an invisible security problem.
Open the host console. A CSP refusal is better evidence than changing resource metadata at random.
Check visibility and permissions
Make sure the tool is visible in the contexts where you expect it and that optional permissions match what the UI uses. Do not request clipboard, camera or network access simply because the host supports those fields.
Validate the contract together
Paste the tool descriptor, resource response and HTML into MCP App Ready. The checker correlates the URI and metadata that are easy to review incorrectly in separate logs.
Expected result
The descriptor points to one readable UI resource, the resource carries the correct HTML profile, and every requested origin or permission is both declared and necessary.
Validate the MCP App contract →