Repository navigation
feat(apps): render show_attention as an MCP App panel and sidebar entry - #282
Open
acoyfellow wants to merge 3 commits into
Open
acoyfellow wants to merge 3 commits into
acoyfellow wants to merge 3 commits into
Conversation
acoyfellow
force-pushed
the
jcoeyman/attention-panel
branch
2 times, most recently
from
October 12, 2026 21:02
34431df to
be0230d
Compare
acoyfellow
changed the title
acoyfellow
force-pushed
the
jcoeyman/attention-panel
branch
from
October 13, 2026 00:03
be0230d to
cf57a36
Compare
…n an account show_attention lists notifications that fired in the last 7 days, open Security Center insights and active Workers Observability issues, most severe first, as text and structuredContent. It is registered in both tool modes. - Feeds are read with the caller's token. A refused feed names the missing permission, a 5xx is retried, and a feed that fails is reported instead of shown as empty. - An account_id the session cannot reach is rejected before any feed call. Only https://dash.cloudflare.com links are kept.
acoyfellow
force-pushed
the
jcoeyman/attention-panel
branch
from
October 14, 2026 12:56
cf57a36 to
aa6d74c
Compare
acoyfellow
changed the title
…rd links Security Center returns dashboard translation keys in resolve_text and relative paths such as /:account_id/turnstile in resolve_link. Fall back to the insight class for keys, and resolve relative paths on dash.cloudflare.com.
Builds on the show_attention report. MCP Apps clients render it as a panel (ui://cloudflare/attention-panel.html) with a "Look into this" button per item; hosts with the openai/ui global entrypoint also list it in the sidebar. Other clients still get the text report. - The panel is React on @openai/apps-sdk-ui, bundled into one HTML file by npm run build:attention-panel and committed as panel-html.ts, which oxfmt ignores. - The panel resource is served by the same resources/list and resources/read handlers as skills. - The UI packages are devDependencies, so the lockfile grows but the Worker ships no new runtime dependency.
acoyfellow
force-pushed
the
jcoeyman/attention-panel
branch
from
October 14, 2026 13:54
aa6d74c to
729e44d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Builds on #287. Review #287 first. Until #287 merges, this PR also shows #287's commit.
This PR renders the
show_attentionreport from #287 as an MCP App panel atui://cloudflare/attention-panel.html. Each item has a Look into this button. The button sends the agent a follow-up about that item. Hosts that support theopenai/uiglobal entrypoint, such as Codex desktop, also list the panel in the sidebar. Clients without MCP Apps still get the text report from #287.How it is built:
@openai/apps-sdk-ui.npm run build:attention-panelbundles it into one HTML file and writessrc/apps/attention/panel-html.ts. The generated file is committed, and oxfmt ignores it.resources/listandresources/readhandlers that serve skills also serve the panel.https://dash.cloudflare.comlinks.The UI packages are devDependencies.
package-lock.jsongrows by about 260 packages, and the Worker gets no new runtime dependency. The lockfile change only adds and re-sorts entries, all from registry.npmjs.org.npm run checkpasses (500 tests). I ran the panel in Codex CLI and Codex desktop againstwrangler dev, with a real token on an internal account. It showed live Workers issues. A test Worker that threw errors appeared as an issue, and then I deleted the Worker. I also checked the panel in the MCP Apps reference host, in light and dark themes. I have not seen it inside ChatGPT.The sidebar entry in Codex desktop and the panel it opens. Account and Worker names are blurred. These screenshots are from before two changes: the permission now reads "Account Security Center Insights Read", and counts have commas ("Seen 527,069 times").
Open questions:
observability.issueson (fix(config): turn on Workers Issues with observability.issues #281).