diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 7210aa37488..b65e231bebc 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -214,6 +214,39 @@ jobs:
           if-no-files-found: ignore
           retention-days: 7
 
+  mcp-app:
+    name: mcp-app (${{ matrix.browser }})
+    runs-on: *runner-4vcpu
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        browser: [chromium, webkit]
+    steps:
+      - *checkout-mirror
+      - *checkout-plain
+      - name: Setup workspace
+        uses: ./.github/actions/setup
+        with:
+          provider: ${{ vars.CI_PROVIDER }}
+      - name: Install browser
+        working-directory: apps/sim
+        run: bunx playwright install --with-deps ${{ matrix.browser }}
+      - name: Exercise MCP App sandbox
+        working-directory: apps/sim
+        env:
+          MCP_APP_E2E_BROWSER: ${{ matrix.browser }}
+          MCP_APP_E2E_REPORT_PATH: ${{ runner.temp }}/mcp-app.json
+        run: bun run test:mcp-app:e2e
+      - name: Upload MCP App report
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: mcp-app-report-${{ matrix.browser }}
+          path: ${{ runner.temp }}/mcp-app.json*
+          if-no-files-found: warn
+          retention-days: 7
+
   # Pull requests skip the live desktop suite only when every change is clearly unrelated to the
   # app it drives (docs, other apps, published content). Anything else, and any failure to work
   # out the diff, runs it: a pull request that skipped it wrongly would first fail on staging.
@@ -719,7 +752,7 @@ jobs:
   # on a cancelled run would report a cancelled head commit as passing.
   ci:
     name: ci
-    needs: [integration, e2e, desktop-changes, desktop-live, lint, test, build]
+    needs: [integration, e2e, mcp-app, desktop-changes, desktop-live, lint, test, build]
     if: ${{ always() }}
     runs-on: *runner-2vcpu
     timeout-minutes: 5
diff --git a/apps/sim/app/api/files/authorization.ts b/apps/sim/app/api/files/authorization.ts
index ab28084e50c..d4950d18c56 100644
--- a/apps/sim/app/api/files/authorization.ts
+++ b/apps/sim/app/api/files/authorization.ts
@@ -122,7 +122,12 @@ export async function verifyFileAccess(
   options?: { requireWrite?: boolean; knowledgeAccess?: KnowledgeFileAccess }
 ): Promise<boolean> {
   /** Organization images require the Principal-aware Assistant application resolver. */
-  if (cloudKey.startsWith('assistant/') || cloudKey.startsWith('chat-images/')) return false
+  if (
+    cloudKey.startsWith('assistant/') ||
+    cloudKey.startsWith('chat-images/') ||
+    cloudKey.startsWith('chat-mcp/')
+  )
+    return false
   const requireWrite = options?.requireWrite ?? false
   try {
     const keyContext = inferContextFromKey(cloudKey)
diff --git a/apps/sim/app/api/files/serve/[...path]/route.ts b/apps/sim/app/api/files/serve/[...path]/route.ts
index eeff30cd6d7..ad5acc45b7f 100644
--- a/apps/sim/app/api/files/serve/[...path]/route.ts
+++ b/apps/sim/app/api/files/serve/[...path]/route.ts
@@ -278,7 +278,8 @@ export const GET = withRouteHandler(
       const cloudKey = isCloudPath ? path.slice(1).join('/') : fullPath
 
       /** Chat images are served only through the current private-chat owner boundary. */
-      if (cloudKey.startsWith('chat-images/')) throw new FileNotFoundError('File not found')
+      if (cloudKey.startsWith('chat-images/') || cloudKey.startsWith('chat-mcp/'))
+        throw new FileNotFoundError('File not found')
 
       if (cloudKey.startsWith('assistant/')) {
         const principal = await internalSessionAuth.authenticate()
diff --git a/apps/sim/app/api/mothership/chats/[chatId]/mcp-results/[id]/assets/[index]/route.ts b/apps/sim/app/api/mothership/chats/[chatId]/mcp-results/[id]/assets/[index]/route.ts
new file mode 100644
index 00000000000..829ff8f39ba
--- /dev/null
+++ b/apps/sim/app/api/mothership/chats/[chatId]/mcp-results/[id]/assets/[index]/route.ts
@@ -0,0 +1,30 @@
+import { getMcpPresentationAssetContract } from '@/lib/api/contracts/mcp-presentations'
+import {
+  defineInternalBinaryRoute,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { internalOrchestrationErrorPolicy } from '@/lib/api/server/routes/internal-json-route'
+import { readMcpResultAsset } from '@/lib/mothership/chat/application/mcp-results'
+
+export const dynamic = 'force-dynamic'
+export const GET = defineInternalBinaryRoute({
+  contract: getMcpPresentationAssetContract,
+  auth: internalSessionAuth,
+  operation: readMcpResultAsset.operation,
+  rateLimit: internalRateLimits.user({ bucketName: 'mcp-apps' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ params }) => params,
+  useCase: readMcpResultAsset,
+  present: ({ buffer, contentType, disposition }) => ({
+    body: new Uint8Array(buffer),
+    contentType,
+    contentLength: buffer.length,
+    contentDisposition: disposition,
+    headers: {
+      'Cache-Control': 'private, no-store',
+      'X-Content-Type-Options': 'nosniff',
+      'Content-Security-Policy': "sandbox; default-src 'none'",
+    },
+  }),
+})
diff --git a/apps/sim/app/api/mothership/chats/[chatId]/mcp-results/[id]/frame/route.ts b/apps/sim/app/api/mothership/chats/[chatId]/mcp-results/[id]/frame/route.ts
new file mode 100644
index 00000000000..be527a67c94
--- /dev/null
+++ b/apps/sim/app/api/mothership/chats/[chatId]/mcp-results/[id]/frame/route.ts
@@ -0,0 +1,30 @@
+import { getMcpAppFrameContract } from '@/lib/api/contracts/mcp-presentations'
+import {
+  defineInternalBinaryRoute,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { internalOrchestrationErrorPolicy } from '@/lib/api/server/routes/internal-json-route'
+import { readMcpAppFrame } from '@/lib/mothership/chat/application/mcp-results'
+
+export const dynamic = 'force-dynamic'
+export const GET = defineInternalBinaryRoute({
+  contract: getMcpAppFrameContract,
+  auth: internalSessionAuth,
+  operation: readMcpAppFrame.operation,
+  rateLimit: internalRateLimits.user({ bucketName: 'mcp-apps' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ params }) => params,
+  useCase: readMcpAppFrame,
+  present: ({ buffer, contentType, policy }) => ({
+    body: new Uint8Array(buffer),
+    contentType,
+    contentLength: buffer.length,
+    headers: {
+      'Content-Security-Policy': policy,
+      'Cache-Control': 'private, no-store',
+      'Referrer-Policy': 'no-referrer',
+      'X-Content-Type-Options': 'nosniff',
+    },
+  }),
+})
diff --git a/apps/sim/app/api/mothership/chats/[chatId]/mcp-results/[id]/metadata/route.ts b/apps/sim/app/api/mothership/chats/[chatId]/mcp-results/[id]/metadata/route.ts
new file mode 100644
index 00000000000..9306c0d7af3
--- /dev/null
+++ b/apps/sim/app/api/mothership/chats/[chatId]/mcp-results/[id]/metadata/route.ts
@@ -0,0 +1,20 @@
+import { getMcpPresentationMetadataContract } from '@/lib/api/contracts/mcp-presentations'
+import {
+  defineInternalJsonRoute,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { internalOrchestrationErrorPolicy } from '@/lib/api/server/routes/internal-json-route'
+import { readMcpResultMetadata } from '@/lib/mothership/chat/application/mcp-results'
+
+export const dynamic = 'force-dynamic'
+export const GET = defineInternalJsonRoute({
+  contract: getMcpPresentationMetadataContract,
+  auth: internalSessionAuth,
+  operation: readMcpResultMetadata.operation,
+  rateLimit: internalRateLimits.user({ bucketName: 'mcp-apps' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ params }) => params,
+  useCase: readMcpResultMetadata,
+  staticResponseHeaders: { 'Cache-Control': 'private, no-store' },
+})
diff --git a/apps/sim/app/api/mothership/chats/[chatId]/mcp-results/[id]/resources/route.ts b/apps/sim/app/api/mothership/chats/[chatId]/mcp-results/[id]/resources/route.ts
new file mode 100644
index 00000000000..bc01354de42
--- /dev/null
+++ b/apps/sim/app/api/mothership/chats/[chatId]/mcp-results/[id]/resources/route.ts
@@ -0,0 +1,21 @@
+import { readMcpAppResourceContract } from '@/lib/api/contracts/mcp-presentations'
+import {
+  defineInternalJsonRoute,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { internalOrchestrationErrorPolicy } from '@/lib/api/server/routes/internal-json-route'
+import { readMcpAppResource } from '@/lib/mothership/chat/application/mcp-results'
+
+export const dynamic = 'force-dynamic'
+export const POST = defineInternalJsonRoute({
+  contract: readMcpAppResourceContract,
+  auth: internalSessionAuth,
+  operation: readMcpAppResource.operation,
+  rateLimit: internalRateLimits.user({ bucketName: 'mcp-apps' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ params, body }, { request }) => ({ ...params, ...body, signal: request.signal }),
+  parseOptions: { maxBodyBytes: 256 * 1024 },
+  useCase: readMcpAppResource,
+  staticResponseHeaders: { 'Cache-Control': 'private, no-store' },
+})
diff --git a/apps/sim/app/api/mothership/chats/[chatId]/mcp-results/[id]/route.ts b/apps/sim/app/api/mothership/chats/[chatId]/mcp-results/[id]/route.ts
new file mode 100644
index 00000000000..150b2fe0ff6
--- /dev/null
+++ b/apps/sim/app/api/mothership/chats/[chatId]/mcp-results/[id]/route.ts
@@ -0,0 +1,20 @@
+import { getMcpPresentationContract } from '@/lib/api/contracts/mcp-presentations'
+import {
+  defineInternalJsonRoute,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { internalOrchestrationErrorPolicy } from '@/lib/api/server/routes/internal-json-route'
+import { readMcpResult } from '@/lib/mothership/chat/application/mcp-results'
+
+export const dynamic = 'force-dynamic'
+export const GET = defineInternalJsonRoute({
+  contract: getMcpPresentationContract,
+  auth: internalSessionAuth,
+  operation: readMcpResult.operation,
+  rateLimit: internalRateLimits.user({ bucketName: 'mcp-apps' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ params }) => params,
+  useCase: readMcpResult,
+  staticResponseHeaders: { 'Cache-Control': 'private, no-store' },
+})
diff --git a/apps/sim/app/api/mothership/chats/[chatId]/mcp-results/[id]/tools/route.ts b/apps/sim/app/api/mothership/chats/[chatId]/mcp-results/[id]/tools/route.ts
new file mode 100644
index 00000000000..c351275205f
--- /dev/null
+++ b/apps/sim/app/api/mothership/chats/[chatId]/mcp-results/[id]/tools/route.ts
@@ -0,0 +1,21 @@
+import { callMcpAppToolContract } from '@/lib/api/contracts/mcp-presentations'
+import {
+  defineInternalJsonRoute,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { internalOrchestrationErrorPolicy } from '@/lib/api/server/routes/internal-json-route'
+import { callMcpAppTool } from '@/lib/mothership/chat/application/mcp-results'
+
+export const dynamic = 'force-dynamic'
+export const POST = defineInternalJsonRoute({
+  contract: callMcpAppToolContract,
+  auth: internalSessionAuth,
+  operation: callMcpAppTool.operation,
+  rateLimit: internalRateLimits.user({ bucketName: 'mcp-apps' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ params, body }, { request }) => ({ ...params, ...body, signal: request.signal }),
+  parseOptions: { maxBodyBytes: 256 * 1024 },
+  useCase: callMcpAppTool,
+  staticResponseHeaders: { 'Cache-Control': 'private, no-store' },
+})
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/file-category.test.ts b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/file-category.test.ts
index e916f00c85f..d7ae71ef088 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/file-category.test.ts
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/file-category.test.ts
@@ -7,7 +7,7 @@ vi.mock('@/lib/uploads/utils/validation', () => ({
 
 vi.mock('@/lib/uploads/utils/file-utils', () => fileUtilsMock)
 
-import { resolveFileCategory } from './file-category'
+import { resolveFileCategory } from '@/lib/uploads/utils/file-category'
 
 describe('resolveFileCategory — MIME priority', () => {
   it('text/plain MIME + .pdf extension → text-editable (MIME wins)', () => {
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/file-viewer.tsx b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/file-viewer.tsx
index b1106cbf4cd..b8a5a3e08d8 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/file-viewer.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/file-viewer.tsx
@@ -9,6 +9,7 @@ import {
   TEXT_PREVIEW_SIZE_MESSAGE,
 } from '@/lib/uploads/client/text-content'
 import type { WorkspaceFileRecord } from '@/lib/uploads/contexts/workspace'
+import { resolveFileCategory } from '@/lib/uploads/utils/file-category'
 import { resolveMediaMimeType } from '@/lib/uploads/utils/file-utils'
 import {
   useWorkspaceFileBinary,
@@ -22,7 +23,6 @@ import {
 } from '@/hooks/use-file-content-source'
 import { CsvTablePreview } from './csv-table-preview'
 import { DocxPreview } from './docx-preview'
-import { resolveFileCategory } from './file-category'
 import { ImagePreview } from './image-preview'
 import type { PdfDocumentSource } from './pdf-viewer'
 import { PptxPreview } from './pptx-preview'
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/index.ts b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/index.ts
index 5230f8c9560..f1f6e4a9b8e 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/index.ts
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/index.ts
@@ -1,4 +1,4 @@
-export { resolveFileCategory } from './file-category'
+export { resolveFileCategory } from '@/lib/uploads/utils/file-category'
 export type { PreviewMode } from './file-viewer'
 export {
   FileViewer,
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/use-doc-preview-binary.ts b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/use-doc-preview-binary.ts
index 5819182db44..d6e3573b1db 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/use-doc-preview-binary.ts
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/use-doc-preview-binary.ts
@@ -3,6 +3,7 @@
 import { useRef } from 'react'
 import type { WorkspaceFileRecord } from '@/lib/uploads/contexts/workspace'
 import { useWorkspaceFileBinary } from '@/hooks/queries/workspace-files'
+import { useFileContentSource } from '@/hooks/use-file-content-source'
 
 export type DocPreviewState = 'empty' | 'loading' | 'ready' | 'stale'
 
@@ -127,8 +128,10 @@ export function stepDocPreviewBinary({
  * binary resolves for the new file, so one viewer never renders another file's content.
  */
 export function useDocPreviewBinary(workspaceId: string, file: DocPreviewFile): DocPreviewBinary {
+  const source = useFileContentSource()
+  const hasCommittedContent = source.hasCommittedContent ?? (file.size ?? 0) > 0
   const query = useWorkspaceFileBinary(workspaceId, file.id, file.key, {
-    enabled: (file.size ?? 0) > 0,
+    enabled: hasCommittedContent,
     version: Number(new Date(file.updatedAt)) || file.size,
   })
 
@@ -145,7 +148,7 @@ export function useDocPreviewBinary(workspaceId: string, file: DocPreviewFile):
     data: query.data,
     isPlaceholderData: query.isPlaceholderData,
     error: (query.error as Error | null) ?? null,
-    hasCommittedContent: (file.size ?? 0) > 0,
+    hasCommittedContent,
     prevHasResolvedForFile: hasResolvedForFileRef.current,
     prevLastGood: lastGoodRef.current,
   })
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/chat-resource-panel.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/chat-resource-panel.tsx
index 0b93d1793e3..1e7de51646c 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/chat-resource-panel.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/chat-resource-panel.tsx
@@ -70,22 +70,22 @@ export function ChatResourcePanel({
     [onSummarize, chat.sendMessage]
   )
   return (
-    <ChatPanelLayout
-      collapsed={isResourceCollapsed}
-      label='resource view'
-      activityCount={resourceActivityIds.size}
-      onToggle={isResourceCollapsed ? expandResource : collapseResource}
-      onResize={handleResourceResizePointerDown}
-      onResizeKeyDown={handleResourceResizeKeyDown}
-      onResizeFocus={handleResourceResizeFocus}
-      panel={
-        <MothershipResourcesProvider
-          selectResource={selectResourceFromUser}
-          addResource={addResourceFromUser}
-          removeResource={removeResource}
-          reorderResources={reorderResources}
-          collapseResource={collapseResource}
-        >
+    <MothershipResourcesProvider
+      selectResource={selectResourceFromUser}
+      addResource={addResourceFromUser}
+      removeResource={removeResource}
+      reorderResources={reorderResources}
+      collapseResource={collapseResource}
+    >
+      <ChatPanelLayout
+        collapsed={isResourceCollapsed}
+        label='resource view'
+        activityCount={resourceActivityIds.size}
+        onToggle={isResourceCollapsed ? expandResource : collapseResource}
+        onResize={handleResourceResizePointerDown}
+        onResizeKeyDown={handleResourceResizeKeyDown}
+        onResizeFocus={handleResourceResizeFocus}
+        panel={
           <Suspense fallback={null}>
             <MothershipView
               ref={mothershipRef}
@@ -106,10 +106,10 @@ export function ChatResourcePanel({
               className={skipResourceTransition ? 'transition-none!' : undefined}
             />
           </Suspense>
-        </MothershipResourcesProvider>
-      }
-    >
-      {children}
-    </ChatPanelLayout>
+        }
+      >
+        {children}
+      </ChatPanelLayout>
+    </MothershipResourcesProvider>
   )
 }
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/lane-activity.ts b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/lane-activity.ts
index 1d40da46ba6..c47833fab83 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/lane-activity.ts
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/lane-activity.ts
@@ -1,3 +1,4 @@
+import { compactMcpPresentation } from '@/lib/mcp/presentation'
 import { RETIRED_BROWSER_REQUEST_TAKEOVER_ID } from '@/lib/mothership/tools/retired-tools'
 import {
   collectGroupTools,
@@ -17,6 +18,7 @@ function isStandaloneItem(item: AgentGroupItem): boolean {
   return (
     item.type !== 'tool' ||
     needsToolInput(item.data) ||
+    !!compactMcpPresentation(item.data.result?.output) ||
     item.data.toolName === RETIRED_BROWSER_REQUEST_TAKEOVER_ID
   )
 }
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-item.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-item.tsx
index 0f7a92f3378..e7edc49ad59 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-item.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-item.tsx
@@ -1,6 +1,7 @@
 import { type ReactNode, useMemo } from 'react'
 import { isPlainRecord } from '@sim/utils/object'
 import { ActivityStatus, type ActivityStatusProps } from '@/components/ui/activity-status'
+import { compactMcpPresentation } from '@/lib/mcp/presentation'
 import {
   CallIntegrationTool,
   Read as ReadTool,
@@ -11,6 +12,7 @@ import { RETIRED_BROWSER_REQUEST_TAKEOVER_ID } from '@/lib/mothership/tools/reti
 import { extractStreamingStringArgument } from '@/lib/mothership/tools/streaming-args'
 import { useToolCallTitle } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-title'
 import { ToolPermissionCard } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-permission-card'
+import { McpResult } from '@/app/workspace/[workspaceId]/home/components/message-content/components/mcp-result/mcp-result'
 import {
   BrowserTakeoverQuestion,
   CredentialDisplay,
@@ -181,5 +183,13 @@ export function ToolCallItem({
       <ToolIcon className='size-full' />
     ),
   }
+  const presentation = compactMcpPresentation(result?.output)
+  if (presentation && !renderStatus)
+    return (
+      <div>
+        <ActivityStatus {...activity} />
+        <McpResult receipt={presentation.mcpPresentation} />
+      </div>
+    )
   return renderStatus ? renderStatus(activity) : <ActivityStatus {...activity} />
 }
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/mcp-result/mcp-app.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/mcp-result/mcp-app.tsx
new file mode 100644
index 00000000000..4a3183084b1
--- /dev/null
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/mcp-result/mcp-app.tsx
@@ -0,0 +1,198 @@
+'use client'
+
+import { useEffect, useRef, useState } from 'react'
+import { AppBridge, PostMessageTransport } from '@modelcontextprotocol/ext-apps/app-bridge'
+import { Chip } from '@sim/emcn'
+import { getErrorMessage } from '@sim/utils/errors'
+import { useTheme } from 'next-themes'
+import type { McpPresentationResponse } from '@/lib/api/contracts/mcp-presentations'
+import {
+  useMcpAppResource,
+  useMcpAppTool,
+  useMcpPresentation,
+} from '@/hooks/queries/mcp-presentations'
+
+interface McpAppProps {
+  chatId: string
+  id: string
+  onClose: () => void
+}
+interface McpAppFrameProps extends McpAppProps {
+  data: McpPresentationResponse
+}
+
+function McpAppFrame({ chatId, id, data, onClose }: McpAppFrameProps) {
+  const { mutateAsync: callTool } = useMcpAppTool(chatId, id)
+  const { mutateAsync: readResource } = useMcpAppResource(chatId, id)
+  const frameRef = useRef<HTMLIFrameElement>(null)
+  const bridgeRef = useRef<AppBridge | null>(null)
+  const { resolvedTheme } = useTheme()
+  const theme = resolvedTheme === 'dark' ? 'dark' : 'light'
+  const themeRef = useRef<'dark' | 'light'>(theme)
+  const [height, setHeight] = useState(400)
+  const [error, setError] = useState<string>()
+  const [closing, setClosing] = useState(false)
+
+  useEffect(() => {
+    themeRef.current = theme
+    bridgeRef.current?.setHostContext({
+      theme,
+      displayMode: 'inline',
+      availableDisplayModes: ['inline'],
+    })
+  }, [theme])
+
+  useEffect(() => {
+    const frame = frameRef.current
+    if (!frame?.contentWindow) return
+    const lifecycle = new AbortController()
+    const bridge = new AppBridge(
+      null,
+      { name: 'Sim', version: '1.0.0' },
+      { serverTools: {}, serverResources: {} },
+      {
+        hostContext: {
+          theme: themeRef.current,
+          displayMode: 'inline',
+          availableDisplayModes: ['inline'],
+        },
+      }
+    )
+    const reportError = (cause: unknown) => {
+      if (!lifecycle.signal.aborted) setError(getErrorMessage(cause))
+    }
+    const initializationTimer = window.setTimeout(() => {
+      reportError(new Error('The app did not finish opening. Close it and try again.'))
+      frame.src = 'about:blank'
+      lifecycle.abort()
+      void bridge.close()
+    }, 15_000)
+    let initialized = false
+    let activeRequests = 0
+    const invoke = async <T,>(
+      signal: AbortSignal,
+      operation: (signal: AbortSignal) => Promise<T>
+    ) => {
+      if (activeRequests >= 4) throw new Error('Too many concurrent App requests')
+      activeRequests++
+      try {
+        return await operation(AbortSignal.any([signal, lifecycle.signal]))
+      } finally {
+        activeRequests--
+      }
+    }
+    bridge.onsandboxready = () => {
+      if (lifecycle.signal.aborted) return
+      void bridge
+        .sendSandboxResourceReady({ html: '', sandbox: 'allow-scripts' })
+        .catch(reportError)
+    }
+    bridge.oninitialized = () => {
+      if (initialized || lifecycle.signal.aborted) return
+      window.clearTimeout(initializationTimer)
+      initialized = true
+      bridgeRef.current = bridge
+      bridge.setHostContext({
+        theme: themeRef.current,
+        displayMode: 'inline',
+        availableDisplayModes: ['inline'],
+      })
+      void (async () => {
+        await bridge.sendToolInput({ arguments: data.arguments })
+        if (!lifecycle.signal.aborted) await bridge.sendToolResult(data.result)
+      })().catch(reportError)
+    }
+    bridge.onsizechange = ({ height: nextHeight }) => {
+      if (lifecycle.signal.aborted) return
+      if (typeof nextHeight === 'number' && Number.isFinite(nextHeight))
+        setHeight(Math.max(160, Math.min(900, nextHeight)))
+    }
+    bridge.oncalltool = (params, extra) =>
+      invoke(extra.signal, (signal) =>
+        callTool({
+          body: { name: params.name, arguments: params.arguments },
+          signal,
+        })
+      )
+    bridge.onreadresource = (params, extra) =>
+      invoke(extra.signal, (signal) =>
+        readResource({
+          body: { uri: params.uri },
+          signal,
+        })
+      )
+    void bridge
+      .connect(new PostMessageTransport(frame.contentWindow, frame.contentWindow))
+      .then(() => {
+        if (!lifecycle.signal.aborted)
+          frame.src = `/api/mothership/chats/${encodeURIComponent(chatId)}/mcp-results/${encodeURIComponent(id)}/frame`
+      })
+      .catch(reportError)
+    return () => {
+      bridgeRef.current = null
+      lifecycle.abort()
+      window.clearTimeout(initializationTimer)
+      void bridge.close()
+    }
+  }, [chatId, id, data, callTool, readResource])
+
+  const close = async () => {
+    if (closing) return
+    setClosing(true)
+    try {
+      await bridgeRef.current?.teardownResource({}, { timeout: 500 })
+    } catch {
+      /* The view can still close when an App does not acknowledge teardown. */
+    } finally {
+      onClose()
+    }
+  }
+
+  return (
+    <div className='overflow-hidden rounded-lg border border-[var(--border)]'>
+      <div className='p-2'>
+        <Chip variant='border' disabled={closing} onClick={close}>
+          Close app
+        </Chip>
+      </div>
+      {error && (
+        <p className='p-3 text-[var(--text-error)] text-small' role='alert'>
+          {error}
+        </p>
+      )}
+      <iframe
+        ref={frameRef}
+        title={data.receipt.title}
+        sandbox='allow-scripts allow-same-origin'
+        referrerPolicy='no-referrer'
+        className='w-full border-0'
+        style={{ height }}
+      />
+    </div>
+  )
+}
+
+export function McpApp({ chatId, id, onClose }: McpAppProps) {
+  const { data, isPending, error } = useMcpPresentation(chatId, id)
+  if (isPending)
+    return (
+      <div>
+        <Chip variant='border' onClick={onClose}>
+          Close app
+        </Chip>
+        <p className='text-[var(--text-muted)] text-small'>Opening app…</p>
+      </div>
+    )
+  if (error)
+    return (
+      <div>
+        <Chip variant='border' onClick={onClose}>
+          Close app
+        </Chip>
+        <p className='text-[var(--text-error)] text-small' role='alert'>
+          {getErrorMessage(error, 'Unable to open app')}
+        </p>
+      </div>
+    )
+  return <McpAppFrame chatId={chatId} id={id} data={data} onClose={onClose} />
+}
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/mcp-result/mcp-result.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/mcp-result/mcp-result.tsx
new file mode 100644
index 00000000000..f0e623cb95b
--- /dev/null
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/mcp-result/mcp-result.tsx
@@ -0,0 +1,98 @@
+'use client'
+
+import { useRef, useState } from 'react'
+import { Chip, ChipLink } from '@sim/emcn'
+import { type McpPresentationReceipt, mcpPresentationAssetUrl } from '@/lib/mcp/presentation'
+import { resolveFileCategory } from '@/lib/uploads/utils/file-category'
+import { useChatSurface } from '@/app/workspace/[workspaceId]/home/components/chat-surface-context'
+import { McpApp } from '@/app/workspace/[workspaceId]/home/components/message-content/components/mcp-result/mcp-app'
+import { useOptionalMothershipResources } from '@/app/workspace/[workspaceId]/home/components/mothership-resources-context'
+
+interface McpResultProps {
+  receipt: McpPresentationReceipt
+}
+
+export function McpResult({ receipt }: McpResultProps) {
+  const { chatId } = useChatSurface()
+  const resources = useOptionalMothershipResources()
+  const [appOpen, setAppOpen] = useState(false)
+  const openButtonRef = useRef<HTMLButtonElement>(null)
+  if (!chatId) return null
+  return (
+    <div className='flex min-w-0 flex-col gap-3 py-2'>
+      {receipt.hasApp && (
+        <div className='flex items-center gap-2'>
+          <Chip
+            ref={openButtonRef}
+            variant='border'
+            active={appOpen}
+            onClick={() => setAppOpen(true)}
+            aria-expanded={appOpen}
+          >
+            {`Open ${receipt.title}`}
+          </Chip>
+        </div>
+      )}
+      {appOpen && (
+        <McpApp
+          key={`${chatId}:${receipt.id}`}
+          chatId={chatId}
+          id={receipt.id}
+          onClose={() => {
+            setAppOpen(false)
+            openButtonRef.current?.focus()
+          }}
+        />
+      )}
+      {receipt.items.map((item) => {
+        const url = mcpPresentationAssetUrl(chatId, receipt.id, item.index)
+        return (
+          <div
+            key={`${item.identity}:${item.index}`}
+            className='flex min-w-0 flex-col items-start gap-2'
+          >
+            {item.kind === 'image' &&
+              resolveFileCategory(item.mimeType, '') === 'image-previewable' && (
+                <img
+                  src={url}
+                  alt={item.title}
+                  loading='lazy'
+                  className='max-h-[400px] max-w-full rounded-lg object-contain'
+                />
+              )}
+            {item.kind === 'audio' &&
+              resolveFileCategory(item.mimeType, '') === 'audio-previewable' && (
+                // biome-ignore lint/a11y/useMediaCaption: MCP audio results do not include a caption track.
+                <audio src={url} controls preload='none' aria-label={item.title} />
+              )}
+            {resources ? (
+              <Chip
+                variant='border'
+                onClick={() =>
+                  resources?.addResource({
+                    type: 'mcp',
+                    id: item.identity,
+                    title: item.title,
+                    mcp: { presentationId: receipt.id, index: item.index },
+                  })
+                }
+              >
+                {item.title}
+              </Chip>
+            ) : (
+              <ChipLink
+                href={url}
+                target='_blank'
+                rel='noopener noreferrer'
+                prefetch={false}
+                variant='border'
+              >
+                {item.title}
+              </ChipLink>
+            )}
+          </div>
+        )
+      })}
+    </div>
+  )
+}
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/mothership-resources-context/index.ts b/apps/sim/app/workspace/[workspaceId]/home/components/mothership-resources-context/index.ts
index aa545330a59..654660f9f7d 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/mothership-resources-context/index.ts
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/mothership-resources-context/index.ts
@@ -1,4 +1,5 @@
 export {
   MothershipResourcesProvider,
   useMothershipResources,
+  useOptionalMothershipResources,
 } from './mothership-resources-context'
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/mothership-resources-context/mothership-resources-context.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/mothership-resources-context/mothership-resources-context.tsx
index ddc208f17ef..2d6bb91d661 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/mothership-resources-context/mothership-resources-context.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/mothership-resources-context/mothership-resources-context.tsx
@@ -71,3 +71,8 @@ export function useMothershipResources(): MothershipResourcesContextValue {
   }
   return value
 }
+
+/** Workflow Copilot and shared transcripts do not host a resource panel. */
+export function useOptionalMothershipResources() {
+  return useContext(MothershipResourcesContext)
+}
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-content/components/mcp-resource-content.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-content/components/mcp-resource-content.tsx
new file mode 100644
index 00000000000..a0808f701aa
--- /dev/null
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-content/components/mcp-resource-content.tsx
@@ -0,0 +1,108 @@
+'use client'
+
+import { ChipLink } from '@sim/emcn'
+import { getErrorMessage } from '@sim/utils/errors'
+import { mcpPresentationAssetUrl } from '@/lib/mcp/presentation'
+import type { MothershipResource } from '@/lib/mothership/resources/types'
+import type { WorkspaceFileRecord } from '@/lib/uploads/contexts/workspace'
+import { resolveFileCategory } from '@/lib/uploads/utils/file-category'
+import { FileViewer } from '@/app/workspace/[workspaceId]/files/components/file-viewer/file-viewer'
+import { useMcpPresentationMetadata } from '@/hooks/queries/mcp-presentations'
+import type { FileContentSource } from '@/hooks/use-file-content-source'
+
+interface McpResourceContentProps {
+  resource: MothershipResource
+  chatId?: string | null
+}
+
+interface McpArtifactPreviewProps {
+  chatId: string
+  presentationId: string
+  index: number
+}
+
+const SNAPSHOT_DATE = new Date(0)
+
+function McpArtifactPreview({ chatId, presentationId, index }: McpArtifactPreviewProps) {
+  const { data, error, isPending } = useMcpPresentationMetadata(chatId, presentationId)
+  if (isPending) return <p className='p-4 text-[var(--text-muted)] text-small'>Opening result…</p>
+  if (error)
+    return (
+      <p className='p-4 text-[var(--text-error)] text-small' role='alert'>
+        {getErrorMessage(error, 'Unable to open result')}
+      </p>
+    )
+  const workspaceId = data.workspaceId
+  const item = data.receipt.items.find((candidate) => candidate.index === index)
+  if (!item) return <p className='p-4 text-[var(--text-muted)] text-small'>Result unavailable</p>
+  const url = mcpPresentationAssetUrl(chatId, presentationId, index)
+  const plainText =
+    item.mimeType.startsWith('text/') ||
+    ['application/json', 'application/xml'].includes(item.mimeType)
+  const category = resolveFileCategory(item.mimeType, '')
+  const previewable =
+    plainText ||
+    (item.kind === 'image' && category === 'image-previewable') ||
+    (item.kind === 'audio' && category === 'audio-previewable') ||
+    [
+      'iframe-previewable',
+      'video-previewable',
+      'docx-previewable',
+      'pptx-previewable',
+      'xlsx-previewable',
+    ].includes(category)
+  if (!previewable)
+    return (
+      <div className='p-4'>
+        <ChipLink
+          href={url}
+          target='_blank'
+          rel='noopener noreferrer'
+          prefetch={false}
+          variant='border'
+        >
+          Download {item.title}
+        </ChipLink>
+      </div>
+    )
+  const contentSource: FileContentSource = {
+    buildUrl: () => url,
+    resolveImageSrc: () => undefined,
+    hasCommittedContent: true,
+  }
+  const file: WorkspaceFileRecord = {
+    id: item.identity,
+    workspaceId,
+    name: plainText ? `${item.title}.txt` : item.title,
+    key: `${chatId}/${presentationId}/${index}`,
+    path: url,
+    size: 0,
+    type: plainText ? 'text/plain' : item.mimeType,
+    uploadedBy: '',
+    uploadedAt: SNAPSHOT_DATE,
+    updatedAt: SNAPSHOT_DATE,
+  }
+  return (
+    <div className='flex h-full flex-col overflow-hidden'>
+      <FileViewer
+        key={file.key}
+        file={file}
+        workspaceId={workspaceId}
+        contentSource={contentSource}
+        canEdit={false}
+        readOnly
+      />
+    </div>
+  )
+}
+
+export function McpResourceContent({ resource, chatId }: McpResourceContentProps) {
+  if (!chatId || !resource.mcp) return null
+  return (
+    <McpArtifactPreview
+      chatId={chatId}
+      presentationId={resource.mcp.presentationId}
+      index={resource.mcp.index}
+    />
+  )
+}
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-registry/resource-invalidation.ts b/apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-registry/resource-invalidation.ts
index 6962cdab5f8..a7f51ce75fe 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-registry/resource-invalidation.ts
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-registry/resource-invalidation.ts
@@ -16,7 +16,10 @@ function invalidate(client: QueryClient, key: QueryKey): void {
   void client.invalidateQueries({ queryKey: key })
 }
 
-type CacheableResourceType = Exclude<MothershipResourceType, 'generic' | 'search' | 'sources'>
+type CacheableResourceType = Exclude<
+  MothershipResourceType,
+  'generic' | 'search' | 'sources' | 'mcp'
+>
 
 const RESOURCE_INVALIDATORS: Record<
   CacheableResourceType,
@@ -92,6 +95,12 @@ export function invalidateResourceQueries(
   resourceType: MothershipResourceType,
   resourceId?: string
 ): void {
-  if (resourceType === 'generic' || resourceType === 'search' || resourceType === 'sources') return
+  if (
+    resourceType === 'generic' ||
+    resourceType === 'search' ||
+    resourceType === 'sources' ||
+    resourceType === 'mcp'
+  )
+    return
   RESOURCE_INVALIDATORS[resourceType](queryClient, workspaceId, resourceId)
 }
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-registry/resource-registry.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-registry/resource-registry.tsx
index 1a9de189f0d..6174d64ba2a 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-registry/resource-registry.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-registry/resource-registry.tsx
@@ -139,6 +139,13 @@ function LogDropdownItem({ item }: DropdownItemRenderProps) {
 }
 
 export const RESOURCE_REGISTRY: Record<MothershipResourceType, ResourceTypeConfig> = {
+  mcp: {
+    type: 'mcp',
+    label: 'MCP result',
+    icon: FileIcon,
+    renderTabIcon: (_resource, className) => <FileIcon className={className} />,
+    renderDropdownItem: (props) => <DefaultDropdownItem {...props} />,
+  },
   sources: {
     type: 'sources',
     label: 'Sources',
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/mothership-view.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/mothership-view.tsx
index 9fb538d0330..cb61fe7e652 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/mothership-view.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/mothership-view.tsx
@@ -21,6 +21,7 @@ import { useMothershipResources } from '@/app/workspace/[workspaceId]/home/compo
 import type { BrowserPanelOverlayController } from '@/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-content/components/browser-session/browser-panel-occlusion'
 import { BrowserSession } from '@/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-content/components/browser-session/browser-session'
 import { GenericResourceContent } from '@/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-content/components/generic-resource-content'
+import { McpResourceContent } from '@/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-content/components/mcp-resource-content'
 import { SearchResourceContent } from '@/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-content/components/search-resource-content'
 import { SourcesResourceContent } from '@/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-content/components/sources-resource-content'
 import { TerminalSession } from '@/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-content/components/terminal-session/terminal-session'
@@ -287,6 +288,7 @@ export const MothershipView = memo(
                   those down while hidden.
                 */}
                   <ScopedResourceContent
+                    chatId={chatId}
                     workspaceId={resource.workspaceId ?? workspaceId}
                     organizationId={organizationId}
                     desktopScopeId={desktopScopeId}
@@ -303,6 +305,7 @@ export const MothershipView = memo(
             )}
             {active && active.type !== 'sources' && !isPersistentPanel(active) && (
               <ScopedResourceContent
+                chatId={chatId}
                 workspaceId={activeWorkspaceId}
                 organizationId={organizationId}
                 desktopScopeId={desktopScopeId}
@@ -332,15 +335,19 @@ export const MothershipView = memo(
 )
 
 function ScopedResourceContent({
+  chatId,
   workspaceId,
   organizationId,
   onSummarize,
   ...props
 }: Omit<ComponentProps<typeof ResourceContent>, 'workspaceId'> & {
+  chatId?: string | null
   workspaceId?: string
   organizationId?: string
   onSummarize: (message: string, filters: WorkspaceSearchFilters) => void
 }) {
+  if (props.resource.type === 'mcp')
+    return <McpResourceContent resource={props.resource} chatId={chatId} />
   if (props.resource.type === 'search')
     return <SearchResourceContent resource={props.resource} onSummarize={onSummarize} />
   if (!workspaceId) {
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/user-input/components/constants.ts b/apps/sim/app/workspace/[workspaceId]/home/components/user-input/components/constants.ts
index 4bb8d632e97..6d386112e63 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/user-input/components/constants.ts
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/user-input/components/constants.ts
@@ -118,6 +118,7 @@ const RESOURCE_TO_CONTEXT: Record<
   /** A saved query is panel state, not document evidence or an attachable resource. */
   search: () => null,
   sources: () => null,
+  mcp: () => null,
   browser: (r) => ({ kind: 'browser_tab', tabId: r.id, label: r.title }),
   terminal: (r) => ({
     kind: 'terminal_tab',
diff --git a/apps/sim/app/workspace/[workspaceId]/home/hooks/stream/handle-tool-event.ts b/apps/sim/app/workspace/[workspaceId]/home/hooks/stream/handle-tool-event.ts
index 9e8e50663b0..2537031c5c8 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/hooks/stream/handle-tool-event.ts
+++ b/apps/sim/app/workspace/[workspaceId]/home/hooks/stream/handle-tool-event.ts
@@ -35,6 +35,7 @@ import {
 } from '@/app/workspace/[workspaceId]/home/hooks/stream/turn-model'
 import { resolveFileResourceSelectionId } from '@/app/workspace/[workspaceId]/home/resource-view-policy'
 import { deploymentKeys } from '@/hooks/queries/deployments'
+import { mothershipChatKeys } from '@/hooks/queries/mothership-chats'
 import { oauthCredentialKeys } from '@/hooks/queries/oauth/oauth-credentials'
 import { workspaceCredentialKeys } from '@/hooks/queries/utils/credential-keys'
 import { folderKeys } from '@/hooks/queries/utils/folder-keys'
@@ -58,11 +59,21 @@ function agentIdForSpan(ctx: StreamLoopContext, spanId: string): string | undefi
  */
 function runToolResultSideEffects(ctx: StreamLoopContext, node: ToolNode, replay: boolean): void {
   const { deps } = ctx
-  if (!deps.workspaceId) return
   const name = node.name
   const output = node.result?.output
   const isSuccess = node.status === 'success'
   const params = node.args
+  const extractedResources =
+    isSuccess && isResourceToolName(name)
+      ? extractResourcesFromToolResult(name, params, output)
+      : []
+  const mcpResources = extractedResources.filter((resource) => resource.type === 'mcp')
+  if (mcpResources.length) {
+    const chatId = deps.chatIdRef.current
+    if (chatId)
+      void deps.queryClient.invalidateQueries({ queryKey: mothershipChatKeys.detail(chatId) })
+  }
+  if (!deps.workspaceId) return
   const calledBy = agentIdForSpan(ctx, node.spanId)
 
   if (DEPLOY_TOOL_NAMES.has(name) && isSuccess) {
@@ -89,10 +100,6 @@ function runToolResultSideEffects(ctx: StreamLoopContext, node: ToolNode, replay
     void invalidateWorkflowLists(deps.queryClient, deps.workspaceId, ['active', 'archived'])
   }
 
-  const extractedResources =
-    isSuccess && isResourceToolName(name)
-      ? extractResourcesFromToolResult(name, params, output)
-      : []
   for (const resource of extractedResources) {
     invalidateResourceQueries(deps.queryClient, deps.workspaceId, resource.type, resource.id)
   }
diff --git a/apps/sim/hooks/queries/mcp-presentations.ts b/apps/sim/hooks/queries/mcp-presentations.ts
new file mode 100644
index 00000000000..2db246acc8a
--- /dev/null
+++ b/apps/sim/hooks/queries/mcp-presentations.ts
@@ -0,0 +1,70 @@
+import { useMutation, useQuery } from '@tanstack/react-query'
+import { requestJson } from '@/lib/api/client/request'
+import {
+  callMcpAppToolContract,
+  getMcpPresentationContract,
+  getMcpPresentationMetadataContract,
+  type McpAppResourceBody,
+  type McpAppResourceResponse,
+  type McpAppToolBody,
+  type McpAppToolResponse,
+  type McpPresentationMetadataResponse,
+  readMcpAppResourceContract,
+} from '@/lib/api/contracts/mcp-presentations'
+import { mcpKeys } from '@/hooks/queries/utils/mcp-keys'
+
+const MCP_PRESENTATION_STALE_TIME = 0
+
+export function useMcpPresentation(chatId: string, id: string) {
+  return useQuery({
+    queryKey: mcpKeys.presentation(chatId, id),
+    queryFn: ({ signal }) =>
+      requestJson(getMcpPresentationContract, { params: { chatId, id }, signal }),
+    staleTime: MCP_PRESENTATION_STALE_TIME,
+    gcTime: 0,
+    refetchOnWindowFocus: false,
+    retry: false,
+  })
+}
+
+export function useMcpPresentationMetadata(chatId: string, id: string) {
+  return useQuery({
+    queryKey: mcpKeys.presentationMetadata(chatId, id),
+    queryFn: ({ signal }): Promise<McpPresentationMetadataResponse> =>
+      requestJson(getMcpPresentationMetadataContract, { params: { chatId, id }, signal }),
+    staleTime: MCP_PRESENTATION_STALE_TIME,
+    gcTime: 0,
+    refetchOnWindowFocus: false,
+    retry: false,
+  })
+}
+
+export function useMcpAppTool(chatId: string, id: string) {
+  return useMutation({
+    mutationFn: ({
+      body,
+      signal,
+    }: {
+      body: McpAppToolBody
+      signal: AbortSignal
+    }): Promise<McpAppToolResponse> =>
+      requestJson(callMcpAppToolContract, { params: { chatId, id }, body, signal }),
+    gcTime: 0,
+    retry: false,
+  })
+}
+
+export function useMcpAppResource(chatId: string, id: string) {
+  return useMutation({
+    mutationFn: ({
+      body,
+      signal,
+    }: {
+      body: McpAppResourceBody
+      signal: AbortSignal
+    }): Promise<McpAppResourceResponse> =>
+      requestJson(readMcpAppResourceContract, { params: { chatId, id }, body, signal }),
+    gcTime: 0,
+    retry: false,
+  })
+}
diff --git a/apps/sim/hooks/queries/utils/mcp-keys.ts b/apps/sim/hooks/queries/utils/mcp-keys.ts
index d4f3956121e..d65f2a153c0 100644
--- a/apps/sim/hooks/queries/utils/mcp-keys.ts
+++ b/apps/sim/hooks/queries/utils/mcp-keys.ts
@@ -1,5 +1,9 @@
 export const mcpKeys = {
   all: ['mcp'] as const,
+  presentations: () => [...mcpKeys.all, 'presentation'] as const,
+  presentation: (chatId: string, id: string) => [...mcpKeys.presentations(), chatId, id] as const,
+  presentationMetadata: (chatId: string, id: string) =>
+    [...mcpKeys.presentation(chatId, id), 'metadata'] as const,
   servers: () => [...mcpKeys.all, 'servers'] as const,
   serversList: (workspaceId?: string) => [...mcpKeys.servers(), workspaceId ?? ''] as const,
   managedCatalog: () => [...mcpKeys.all, 'managedCatalog'] as const,
diff --git a/apps/sim/hooks/use-file-content-source.tsx b/apps/sim/hooks/use-file-content-source.tsx
index 4c342369166..cef4dc5ca2d 100644
--- a/apps/sim/hooks/use-file-content-source.tsx
+++ b/apps/sim/hooks/use-file-content-source.tsx
@@ -57,6 +57,8 @@ export interface ImageDimensionsSource {
  */
 export interface FileContentSource {
   buildUrl: (key: string, opts?: FileContentUrlOptions) => string
+  /** Immutable external results are ready even when the source does not report a byte size. */
+  hasCommittedContent?: boolean
   /**
    * Map an embedded image `src` to a display URL scoped to the current context: the in-app source
    * points at the workspace-scoped inline route, the public source at the token-scoped cascade route.
diff --git a/apps/sim/lib/api/contracts/mcp-presentations/contracts.ts b/apps/sim/lib/api/contracts/mcp-presentations/contracts.ts
new file mode 100644
index 00000000000..6cf17533a34
--- /dev/null
+++ b/apps/sim/lib/api/contracts/mcp-presentations/contracts.ts
@@ -0,0 +1,55 @@
+import {
+  mcpAppResourceBodySchema,
+  mcpAppResourceResponseSchema,
+  mcpAppToolBodySchema,
+  mcpAppToolResponseSchema,
+  mcpPresentationAssetParamsSchema,
+  mcpPresentationMetadataResponseSchema,
+  mcpPresentationParamsSchema,
+  mcpPresentationResponseSchema,
+} from '@/lib/api/contracts/mcp-presentations/schemas'
+import { defineRouteContract } from '@/lib/api/contracts/types'
+
+export const getMcpPresentationContract = defineRouteContract({
+  method: 'GET',
+  path: '/api/mothership/chats/[chatId]/mcp-results/[id]',
+  params: mcpPresentationParamsSchema,
+  response: { mode: 'json', schema: mcpPresentationResponseSchema },
+})
+
+export const getMcpPresentationMetadataContract = defineRouteContract({
+  method: 'GET',
+  path: '/api/mothership/chats/[chatId]/mcp-results/[id]/metadata',
+  params: mcpPresentationParamsSchema,
+  response: { mode: 'json', schema: mcpPresentationMetadataResponseSchema },
+})
+
+export const getMcpAppFrameContract = defineRouteContract({
+  method: 'GET',
+  path: '/api/mothership/chats/[chatId]/mcp-results/[id]/frame',
+  params: mcpPresentationParamsSchema,
+  response: { mode: 'binary' },
+})
+
+export const getMcpPresentationAssetContract = defineRouteContract({
+  method: 'GET',
+  path: '/api/mothership/chats/[chatId]/mcp-results/[id]/assets/[index]',
+  params: mcpPresentationAssetParamsSchema,
+  response: { mode: 'binary' },
+})
+
+export const callMcpAppToolContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/mothership/chats/[chatId]/mcp-results/[id]/tools',
+  params: mcpPresentationParamsSchema,
+  body: mcpAppToolBodySchema,
+  response: { mode: 'json', schema: mcpAppToolResponseSchema },
+})
+
+export const readMcpAppResourceContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/mothership/chats/[chatId]/mcp-results/[id]/resources',
+  params: mcpPresentationParamsSchema,
+  body: mcpAppResourceBodySchema,
+  response: { mode: 'json', schema: mcpAppResourceResponseSchema },
+})
diff --git a/apps/sim/lib/api/contracts/mcp-presentations/index.ts b/apps/sim/lib/api/contracts/mcp-presentations/index.ts
new file mode 100644
index 00000000000..1156d4121e3
--- /dev/null
+++ b/apps/sim/lib/api/contracts/mcp-presentations/index.ts
@@ -0,0 +1,2 @@
+export * from './contracts'
+export * from './schemas'
diff --git a/apps/sim/lib/api/contracts/mcp-presentations/schemas.ts b/apps/sim/lib/api/contracts/mcp-presentations/schemas.ts
new file mode 100644
index 00000000000..5aad954c54f
--- /dev/null
+++ b/apps/sim/lib/api/contracts/mcp-presentations/schemas.ts
@@ -0,0 +1,45 @@
+import { CallToolResultSchema, ReadResourceResultSchema } from '@modelcontextprotocol/sdk/types.js'
+import { z } from 'zod'
+import {
+  MCP_PRESENTATION_MAX_ITEMS,
+  mcpPresentationIdSchema,
+  mcpPresentationReceiptSchema,
+} from '@/lib/mcp/presentation'
+import { inlineImageRequestIdSchema } from '@/lib/mothership/chat/inline-image-reference'
+
+export const mcpPresentationParamsSchema = z.object({
+  chatId: inlineImageRequestIdSchema,
+  id: mcpPresentationIdSchema,
+})
+export const mcpPresentationResponseSchema = z.object({
+  workspaceId: z.string().min(1),
+  receipt: mcpPresentationReceiptSchema,
+  arguments: z.record(z.string(), z.unknown()),
+  result: CallToolResultSchema,
+})
+export type McpPresentationResponse = z.output<typeof mcpPresentationResponseSchema>
+export const mcpPresentationMetadataResponseSchema = mcpPresentationResponseSchema.pick({
+  workspaceId: true,
+  receipt: true,
+})
+export type McpPresentationMetadataResponse = z.output<typeof mcpPresentationMetadataResponseSchema>
+export const mcpPresentationAssetParamsSchema = mcpPresentationParamsSchema.extend({
+  index: z.coerce
+    .number()
+    .int()
+    .min(0)
+    .max(MCP_PRESENTATION_MAX_ITEMS - 1),
+})
+export const mcpAppToolBodySchema = z
+  .object({
+    name: z.string().min(1).max(256),
+    arguments: z.record(z.string(), z.unknown()).optional(),
+  })
+  .strict()
+export type McpAppToolBody = z.output<typeof mcpAppToolBodySchema>
+export const mcpAppToolResponseSchema = CallToolResultSchema
+export type McpAppToolResponse = z.output<typeof mcpAppToolResponseSchema>
+export const mcpAppResourceBodySchema = z.object({ uri: z.string().min(1).max(2048) }).strict()
+export type McpAppResourceBody = z.output<typeof mcpAppResourceBodySchema>
+export const mcpAppResourceResponseSchema = ReadResourceResultSchema
+export type McpAppResourceResponse = z.output<typeof mcpAppResourceResponseSchema>
diff --git a/apps/sim/lib/api/contracts/mcp.ts b/apps/sim/lib/api/contracts/mcp.ts
index 2961a580e9e..7bf70b48cd4 100644
--- a/apps/sim/lib/api/contracts/mcp.ts
+++ b/apps/sim/lib/api/contracts/mcp.ts
@@ -95,7 +95,24 @@ export const mcpToolInputSchema: z.ZodType<McpToolSchema> = z
 
 export const mcpToolSchema = z.object({
   name: z.string(),
+  title: z.string().optional(),
   description: z.string().optional(),
+  annotations: z.record(z.string(), z.unknown()).optional(),
+  _meta: z.record(z.string(), z.unknown()).optional(),
+  outputSchema: z
+    .object({ type: z.literal('object') })
+    .passthrough()
+    .optional(),
+  icons: z
+    .array(
+      z.object({
+        src: z.string(),
+        mimeType: z.string().optional(),
+        sizes: z.array(z.string()).optional(),
+        theme: z.enum(['light', 'dark']).optional(),
+      })
+    )
+    .optional(),
   inputSchema: mcpToolInputSchema,
   serverId: z.string(),
   canonicalServerId: z.string().optional(),
diff --git a/apps/sim/lib/api/contracts/mothership-resources.ts b/apps/sim/lib/api/contracts/mothership-resources.ts
index 65c9add4770..b31347dab61 100644
--- a/apps/sim/lib/api/contracts/mothership-resources.ts
+++ b/apps/sim/lib/api/contracts/mothership-resources.ts
@@ -1,6 +1,7 @@
 import { z } from 'zod'
 import { requiredFieldSchema, workspaceIdSchema } from '@/lib/api/contracts/primitives'
 import { predicateInputSchema, sortSpecSchema } from '@/lib/api/contracts/tables'
+import { MCP_PRESENTATION_MAX_ITEMS, mcpPresentationIdSchema } from '@/lib/mcp/presentation'
 import { ResourceAddress, SearchResource } from '@/lib/mothership/generated/resources'
 import {
   type MothershipResource,
@@ -20,8 +21,24 @@ const resourceAddressSchema = z
     executionId: z.string().optional(),
     search: SearchResource.optional(),
     sources: ResourceAddress.shape.sources,
+    mcp: z
+      .object({
+        presentationId: mcpPresentationIdSchema,
+        index: z
+          .number()
+          .int()
+          .min(0)
+          .max(MCP_PRESENTATION_MAX_ITEMS - 1),
+      })
+      .optional(),
   })
   .superRefine((resource, ctx) => {
+    if ((resource.type === 'mcp') !== (resource.mcp !== undefined))
+      ctx.addIssue({
+        code: 'custom',
+        path: ['mcp'],
+        message: 'MCP result address is required only for MCP resources',
+      })
     if ((resource.type === 'sources') !== (resource.sources !== undefined))
       ctx.addIssue({
         code: 'custom',
diff --git a/apps/sim/lib/api/server/routes/internal-binary-route.ts b/apps/sim/lib/api/server/routes/internal-binary-route.ts
index 44ed6713897..d8b846faa77 100644
--- a/apps/sim/lib/api/server/routes/internal-binary-route.ts
+++ b/apps/sim/lib/api/server/routes/internal-binary-route.ts
@@ -1,6 +1,5 @@
-import { describePrincipalAuth, type Principal, type SessionPrincipal } from '@sim/auth/principal'
+import { describePrincipalAuth, type SessionPrincipal } from '@sim/auth/principal'
 import { setRequestAuth } from '@sim/logger'
-import type { NextRequest } from 'next/server'
 import { NextResponse } from 'next/server'
 import {
   methodMatchesContract,
@@ -8,6 +7,7 @@ import {
 } from '@/lib/api/server/routes/definition'
 import {
   type InternalErrorPolicy,
+  type InternalRateLimitPolicy,
   InternalUnauthenticatedError,
   internalErrorResponse,
   type internalSessionAuth,
@@ -25,12 +25,6 @@ import { parseRequest } from '@/lib/api/server/validation'
 import type { ApplicationOperation, OperationUseCase } from '@/lib/core/application'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 
-interface InternalBinaryRateLimitPolicy {
-  readonly kind: 'none'
-  readonly reason: string
-  enforce(request: NextRequest, principal: Principal): Promise<void>
-}
-
 interface InternalBinaryRouteDefinition<
   C extends BinaryApiRouteContract,
   O extends ApplicationOperation,
@@ -51,7 +45,7 @@ interface InternalBinaryRouteOptions<
   R,
 > extends InternalBinaryRouteDefinition<C, O, I, R> {
   auth: typeof internalSessionAuth
-  rateLimit: InternalBinaryRateLimitPolicy
+  rateLimit: InternalRateLimitPolicy
   errorPolicy: InternalErrorPolicy
   onSuccess?(args: { principal: SessionPrincipal; input: I; result: R }): void | Promise<void>
 }
@@ -93,7 +87,8 @@ export function defineInternalBinaryRoute<
       }
       setRequestAuth(describePrincipalAuth(principal))
 
-      await options.rateLimit.enforce(request, principal)
+      const rateLimitResponse = await options.rateLimit.enforce(request, principal)
+      if (rateLimitResponse) return responseWithRequestId(rateLimitResponse)
       const parsed = await parseRequest(options.contract, request, context ?? {})
       if (!parsed.success) return responseWithRequestId(parsed.response)
 
diff --git a/apps/sim/lib/api/server/routes/internal-json-route.ts b/apps/sim/lib/api/server/routes/internal-json-route.ts
index a3890a53fde..c42aaaf6ef1 100644
--- a/apps/sim/lib/api/server/routes/internal-json-route.ts
+++ b/apps/sim/lib/api/server/routes/internal-json-route.ts
@@ -119,7 +119,7 @@ interface InternalUserRateLimitPolicy {
   enforce(request: NextRequest, principal: Principal): Promise<NextResponse | null>
 }
 
-type InternalRateLimitPolicy = InternalNoRateLimitPolicy | InternalUserRateLimitPolicy
+export type InternalRateLimitPolicy = InternalNoRateLimitPolicy | InternalUserRateLimitPolicy
 
 export const internalRateLimits = {
   none({ reason }: { reason: string }): InternalNoRateLimitPolicy {
diff --git a/apps/sim/lib/browser-agent/attachments.ts b/apps/sim/lib/browser-agent/attachments.ts
index c741f9a74ee..c51f0b7b2c7 100644
--- a/apps/sim/lib/browser-agent/attachments.ts
+++ b/apps/sim/lib/browser-agent/attachments.ts
@@ -31,7 +31,8 @@ export function buildResourceAttachments(
     // The terminal panel is not addressable context: unlike a browser tab it
     // carries no URL to reference, and the shell's state reaches the model
     // through the terminal tools instead.
-    if (resource.type === 'terminal' || resource.type === 'sources') return []
+    if (resource.type === 'terminal' || resource.type === 'sources' || resource.type === 'mcp')
+      return []
 
     if (resource.type !== 'browser') {
       return [
diff --git a/apps/sim/lib/cleanup/chat-cleanup.ts b/apps/sim/lib/cleanup/chat-cleanup.ts
index ab9745dd093..312909f05b6 100644
--- a/apps/sim/lib/cleanup/chat-cleanup.ts
+++ b/apps/sim/lib/cleanup/chat-cleanup.ts
@@ -5,6 +5,7 @@ import { chunkArray } from '@sim/utils/helpers'
 import { isRecordLike } from '@sim/utils/object'
 import { and, eq, inArray, isNull, or, sql } from 'drizzle-orm'
 import { env } from '@/lib/core/config/env'
+import { mcpPresentationCleanupKeys } from '@/lib/mcp/presentation-lifecycle'
 import {
   inlineChatImageKey,
   inlineChatImageReferences,
@@ -134,7 +135,10 @@ export async function collectChatFiles(chatIds: string[]): Promise<FileRef[]> {
     for (const row of messageRows) {
       const msg = row.content
       if (!msg || typeof msg !== 'object') continue
-      for (const key of inlineChatImageKeys(row.chatId, msg as Record<string, unknown>)) {
+      for (const key of [
+        ...inlineChatImageKeys(row.chatId, msg as Record<string, unknown>),
+        ...mcpPresentationCleanupKeys(row.chatId, msg),
+      ]) {
         if (!seen.has(key)) {
           seen.add(key)
           files.push({ key, context: 'mothership', chatId: row.chatId })
diff --git a/apps/sim/lib/credential-groups/application/authorization.ts b/apps/sim/lib/credential-groups/application/authorization.ts
index 2d6b92d3379..5321ca84840 100644
--- a/apps/sim/lib/credential-groups/application/authorization.ts
+++ b/apps/sim/lib/credential-groups/application/authorization.ts
@@ -19,10 +19,7 @@ import {
   isOrganizationCredentialType,
   type OrganizationCredentialType,
 } from '@/lib/credential-groups/credential-types'
-import type {
-  CredentialGroupCredentialListContext,
-  ManagedCredentialGroupBinding,
-} from '@/lib/credential-groups/credentials'
+import type { CredentialGroupCredentialListContext } from '@/lib/credential-groups/credentials'
 import {
   isManagedCredentialGroupBindingLive,
   loadCredentialGroupEnrollmentAccessForSubject,
@@ -108,26 +105,21 @@ export function requireCredentialGroupWorkflowActor(principal: Principal): Princ
 }
 
 /**
- * Authorizes a person using their own Credential Group credential from Chat.
- * The copilot delegation names the signed-in user and no workflow, so only the
+ * Authorizes a person using their own Credential Group credential from Chat or an App.
+ * The session or copilot delegation names the signed-in user and no workflow, so only the
  * actor statement is evaluated: the credential must be the one collected under
  * that user's own live enrollment. Nothing the model passes can widen this;
  * the acting user is the delegation's subject, not a tool argument.
  */
 async function requireCredentialGroupActorCredentialAccess(
-  principal: Extract<Principal, { kind: 'delegated' }>,
+  principal: Principal,
   context: CredentialGroupAuthorizationContext & { credentialGroupEnrollmentId: string },
-  binding: ManagedCredentialGroupBinding | null,
   resourcePolicy: ResourcePolicyBindingFor<'credential_group'>
 ): Promise<void> {
   const subject = resolvePrincipalSubject(principal)
   if (subject?.kind !== 'sim_user' || !subject.userId) {
     throw new OrchestrationError('forbidden', 'Credential Group actor access required')
   }
-  /** Chat mints OAuth credentials only; a credential with no OAuth binding is not its to use. */
-  if (!binding) {
-    throw new OrchestrationError('forbidden', 'Credential Group credential access denied')
-  }
   if (context.organizationId) {
     const actorAccess = await loadCredentialGroupEnrollmentAccessForSubject(
       context.credentialGroupId,
@@ -174,7 +166,11 @@ export async function requireCredentialGroupCredentialAccess(
   },
   resourcePolicy: ResourcePolicyBindingFor<'credential_group'>
 ): Promise<void> {
-  if (principal.kind === 'delegated' && principal.serviceId === 'copilot') {
+  const managedMcp = context.credentialType.startsWith('mcp:')
+  const actorAccess =
+    (principal.kind === 'session' && managedMcp) ||
+    (principal.kind === 'delegated' && principal.serviceId === 'copilot')
+  if (actorAccess) {
     const subject = resolvePrincipalSubject(principal)
     if (subject?.kind !== 'sim_user' || !subject.userId) {
       throw new OrchestrationError('forbidden', 'Credential Group actor access required')
@@ -192,6 +188,9 @@ export async function requireCredentialGroupCredentialAccess(
   if (binding && !isManagedCredentialGroupBindingLive(binding)) {
     throw new OrchestrationError('forbidden', 'Credential Group credential access denied')
   }
+  if (actorAccess && !binding && (!managedMcp || !context.organizationId)) {
+    throw new OrchestrationError('forbidden', 'Credential Group credential access denied')
+  }
   if (context.organizationId) {
     if (!isOrganizationCredentialType(context.credentialType))
       throw new Error('Organization credential access requires a canonical credential type')
@@ -200,8 +199,8 @@ export async function requireCredentialGroupCredentialAccess(
       context.credentialType
     )
   }
-  if (principal.kind === 'delegated' && principal.serviceId === 'copilot') {
-    return requireCredentialGroupActorCredentialAccess(principal, context, binding, resourcePolicy)
+  if (actorAccess) {
+    return requireCredentialGroupActorCredentialAccess(principal, context, resourcePolicy)
   }
   if (!context.organizationId) {
     throw new OrchestrationError(
diff --git a/apps/sim/lib/credentials/application/discover-managed-mcp-tools.ts b/apps/sim/lib/credentials/application/discover-managed-mcp-tools.ts
index d8527c17c16..e299e904fdb 100644
--- a/apps/sim/lib/credentials/application/discover-managed-mcp-tools.ts
+++ b/apps/sim/lib/credentials/application/discover-managed-mcp-tools.ts
@@ -1,5 +1,5 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
-import { resolvePrincipalSubject } from '@sim/auth/principal'
+import { resolvePrincipalSubject, resolvePrincipalSubjectUserId } from '@sim/auth/principal'
 import { defineAuthorizedWorkspaceUseCase } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { requireCredentialGroupCredentialAccess } from '@/lib/credential-groups/application/authorization'
@@ -12,15 +12,18 @@ import {
 } from '@/lib/credentials/managed-mcp'
 import { loadManagedMcpAuthProvider } from '@/lib/mcp/application/managed-auth-provider'
 import { loadMcpOperationAccess } from '@/lib/mcp/application/operation-access'
+import { snapshotMcpTool } from '@/lib/mcp/presentation-metadata'
 import { mcpService } from '@/lib/mcp/service'
 import { compileMcpToolSchema } from '@/lib/mcp/tool-schema'
 import { assertWorkspaceCapability } from '@/lib/permission-groups/capability-assertions'
+import type { ResolvedSecretTraceProvenanceV1 } from '@/executor/utils/resolved-secret-trace-registry'
 
 export interface DiscoverManagedMcpToolsInput {
   workspaceId: string
   credentialId: string
   assertedServerId?: string
   signal?: AbortSignal
+  onResolvedSecretTraceProvenance?: (provenance: ResolvedSecretTraceProvenanceV1) => void
 }
 
 export const discoverManagedMcpToolsUseCase = defineAuthorizedWorkspaceUseCase({
@@ -49,6 +52,7 @@ export const discoverManagedMcpToolsUseCase = defineAuthorizedWorkspaceUseCase({
   },
   async execute({ principal, input, context }) {
     input.signal?.throwIfAborted()
+    const userId = resolvePrincipalSubjectUserId(principal)
     const runtime = await loadManagedMcpRuntimeCredential(context.credentialId, context.workspaceId)
     if (
       runtime.mcpServerId !== context.mcpServerId ||
@@ -69,15 +73,15 @@ export const discoverManagedMcpToolsUseCase = defineAuthorizedWorkspaceUseCase({
         loadProvider: () => loadManagedMcpAuthProvider(runtime.credentialId, runtime.workspaceId),
       },
       input.signal,
-      { requireComplete: true }
+      {
+        requireComplete: true,
+        provenanceScope: userId ? { userId, workspaceId: context.workspaceId } : undefined,
+        onResolvedSecretTraceProvenance: input.onResolvedSecretTraceProvenance,
+      }
     )
     await saveManagedMcpToolSnapshot(
       runtime.credentialId,
-      tools.map((tool) => ({
-        name: tool.name,
-        ...(tool.description ? { description: tool.description } : {}),
-        inputSchema: tool.inputSchema,
-      })),
+      tools.map(snapshotMcpTool),
       runtime.oauthConfigVersion,
       runtime.grantedAt
     )
diff --git a/apps/sim/lib/credentials/application/operations.ts b/apps/sim/lib/credentials/application/operations.ts
index 3d45db277f4..4dcc4889d42 100644
--- a/apps/sim/lib/credentials/application/operations.ts
+++ b/apps/sim/lib/credentials/application/operations.ts
@@ -251,13 +251,24 @@ export const credentialOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'mcp_tools.use',
-    principalKinds: ['delegated'],
+    principalKinds: ['session', 'delegated'],
     delegatedServices: ['executor', 'copilot'],
     resourcePolicy: {
       resourceType: 'credential_group',
       action: CREDENTIAL_GROUP_CREDENTIAL_USE_ACTION,
     },
   }),
+  readManagedMcpResource: defineWorkspaceOperation({
+    id: 'credentials.managed_mcp.read_resource',
+    minimumRole: 'read',
+    workspaceApiKey: 'deny',
+    capability: 'mcp_tools.use',
+    principalKinds: ['session'],
+    resourcePolicy: {
+      resourceType: 'credential_group',
+      action: CREDENTIAL_GROUP_CREDENTIAL_USE_ACTION,
+    },
+  }),
 } as const
 
 /**
diff --git a/apps/sim/lib/credentials/managed-mcp.ts b/apps/sim/lib/credentials/managed-mcp.ts
index 54ca13c9c88..f15ff32816d 100644
--- a/apps/sim/lib/credentials/managed-mcp.ts
+++ b/apps/sim/lib/credentials/managed-mcp.ts
@@ -323,7 +323,7 @@ export async function persistManagedMcpCredential(params: {
   mcpServerId: string
   mcpServerName: string
   tokens: OAuthTokens
-  tools: Array<{ name: string; description?: string; inputSchema: Record<string, unknown> }>
+  tools: ManagedMcpToolSnapshot[]
 }): Promise<{
   connectionId: string
   created: boolean
diff --git a/apps/sim/lib/internal/mcp/execute-tool.ts b/apps/sim/lib/internal/mcp/execute-tool.ts
index 22c733328bb..1d258b1cc41 100644
--- a/apps/sim/lib/internal/mcp/execute-tool.ts
+++ b/apps/sim/lib/internal/mcp/execute-tool.ts
@@ -11,6 +11,7 @@ import {
 import { asOrchestrationError, statusForOrchestrationError } from '@/lib/core/orchestration/types'
 import { MANAGED_MCP_DELEGATION_AUDIENCE } from '@/lib/credentials/application/authorization'
 import { ManagedMcpCredentialError } from '@/lib/credentials/managed-mcp'
+import { presentMcpToolResult } from '@/lib/internal/mcp/presentation'
 import { createExecutorPrincipalFromExecutionContext } from '@/lib/internal/principals/executor'
 import {
   classifyInternalToolIdentityFault,
@@ -205,21 +206,28 @@ export const executeMcpTool: InternalToolOperationHandler = async (request) => {
       getRemainingExecutionMs(request.signal)
     )
     const commonInput = {
+      onResolvedSecretTraceProvenance: provenance
+        ? (value: Parameters<ResolvedSecretTraceProvenanceAccumulator['record']>[0]) =>
+            provenance?.record(value)
+        : undefined,
       workspaceId: request.context.workspaceId,
       toolName,
       arguments: args,
       callChain: request.context.callChain,
       timeoutMs,
       signal: request.signal,
+      presentation:
+        request.context.copilotToolExecution &&
+        request.context.chatId &&
+        !request.context.mcpBlockId
+          ? ('snapshot' as const)
+          : undefined,
     }
     let result: ExecuteMcpToolResult
     if (target.kind === 'shared_server') {
       const input: ExecuteMcpToolInput = {
         ...commonInput,
         serverId: target.serverId,
-        onResolvedSecretTraceProvenance: provenance
-          ? (value) => provenance?.record(value)
-          : undefined,
       }
       result = await executeMcpToolUseCase.execute({ principal, input })
     } else {
@@ -230,12 +238,32 @@ export const executeMcpTool: InternalToolOperationHandler = async (request) => {
       result = await executeManagedMcpToolUseCase.execute({ principal, input })
     }
     request.signal?.throwIfAborted()
+    if (result.presentation) {
+      const registry = request.context.resolvedSecretTraceRegistry?.forkForToolCall()
+      if (provenance && registry) {
+        const imported = await registry.importProvenance(provenance.exportProvenance(), {
+          trusted: true,
+          origin: `tool.${request.toolId}`,
+        })
+        if (!imported) throw new Error('MCP presentation provenance could not be verified')
+      }
+      result = await presentMcpToolResult(
+        { ...request.context, resolvedSecretTraceRegistry: registry },
+        targetId,
+        result,
+        request.signal
+      )
+    }
     const body =
       request.toolId === 'mcp_run_operation'
         ? result
         : result.success
           ? { success: true, data: { success: true, output: result.output } }
-          : { success: false, error: result.error }
+          : {
+              success: false,
+              error: result.error,
+              ...(result.output ? { output: result.output } : {}),
+            }
     return createResponse(
       body,
       result.success ? 200 : 400,
diff --git a/apps/sim/lib/internal/mcp/presentation.ts b/apps/sim/lib/internal/mcp/presentation.ts
new file mode 100644
index 00000000000..1aeb3e27f29
--- /dev/null
+++ b/apps/sim/lib/internal/mcp/presentation.ts
@@ -0,0 +1,149 @@
+import {
+  CallToolResultSchema,
+  ReadResourceResultSchema,
+  ToolSchema,
+} from '@modelcontextprotocol/sdk/types.js'
+import { createLogger } from '@sim/logger'
+import { isPlainRecord } from '@sim/utils/object'
+import {
+  bindDurableSecretProvenanceToValue,
+  durableSecretProvenanceFromRegistry,
+} from '@/lib/execution/durable-secret-provenance'
+import type { InternalToolOperationContext } from '@/lib/internal/tool-operations/types'
+import type { ExecuteMcpToolResult } from '@/lib/mcp/application/execute-tool'
+import { projectMcpEncodedContents } from '@/lib/mcp/encoded-content'
+import { MCP_PRESENTATION_MAX_BYTES, type McpPresentationReceipt } from '@/lib/mcp/presentation'
+import { getMcpAppResourceUri } from '@/lib/mcp/presentation-metadata'
+import { createCopilotApplicationAdapter } from '@/lib/mothership/application/application-adapter'
+import {
+  COPILOT_APPLICATION_DELEGATION_TTL_MS,
+  createTrustedOrganizationCopilotPrincipal,
+} from '@/lib/mothership/auth/application-delegation'
+import {
+  MCP_PRESENTATION_AUDIENCE,
+  publishMcpResult,
+} from '@/lib/mothership/chat/application/mcp-results'
+import { projectResolvedSecretModelJsonContent } from '@/executor/utils/resolved-secret-content-projection'
+
+const publish = createCopilotApplicationAdapter({
+  domain: 'MCP presentation',
+  delegation: {
+    audience: MCP_PRESENTATION_AUDIENCE,
+    ttlMs: COPILOT_APPLICATION_DELEGATION_TTL_MS,
+    createDelegationId: (context) => `copilot-tool:${context.toolCallId}`,
+  },
+  operations: { publish: publishMcpResult.operation },
+})
+const logger = createLogger('McpPresentation')
+
+/** Separates private App data from model content while retaining a small, durable display receipt. */
+export async function presentMcpToolResult(
+  context: InternalToolOperationContext,
+  connectionId: string,
+  execution: ExecuteMcpToolResult,
+  signal?: AbortSignal
+): Promise<ExecuteMcpToolResult> {
+  const presentation = execution.presentation
+  if (!presentation || !context.chatId || !context.workspaceId || !context.toolCallId)
+    return execution
+  const { tool, result } = presentation
+  const organizationId = context.chatOrganizationId ?? context.organizationId
+  let receipt: McpPresentationReceipt | undefined
+  try {
+    if (getMcpAppResourceUri(tool) || result.content.some((item) => item.type !== 'text')) {
+      const registry = context.resolvedSecretTraceRegistry?.forkForPropagatedEntries()
+      const value = {
+        arguments: presentation.arguments,
+        result: projectMcpEncodedContents(result, registry, 'omit'),
+        resources: projectMcpEncodedContents(
+          { contents: presentation.resources ?? [] },
+          registry,
+          'omit'
+        ).contents,
+        tool: {
+          name: tool.name,
+          title: tool.title || tool.name,
+          _meta: { ui: { resourceUri: getMcpAppResourceUri(tool) } },
+        },
+      }
+      const projection = projectResolvedSecretModelJsonContent(
+        value,
+        registry,
+        MCP_PRESENTATION_MAX_BYTES
+      )
+      if (
+        projection.safe &&
+        isPlainRecord(projection.value) &&
+        isPlainRecord(projection.value.arguments)
+      ) {
+        const input = {
+          chatId: context.chatId,
+          workspaceId: context.workspaceId,
+          connectionId,
+          toolCallId: context.toolCallId,
+          tool: ToolSchema.pick({ name: true, title: true, _meta: true }).parse(
+            projection.value.tool
+          ),
+          arguments: projection.value.arguments,
+          result: CallToolResultSchema.parse(projection.value.result),
+          resources: ReadResourceResultSchema.shape.contents.parse(projection.value.resources),
+          signal,
+          secretProvenance: bindDurableSecretProvenanceToValue(
+            durableSecretProvenanceFromRegistry(
+              context.resolvedSecretTraceRegistry,
+              projection.value
+            ),
+            projection.value
+          ),
+        }
+        receipt =
+          organizationId && context.userId
+            ? await publishMcpResult.execute({
+                principal: createTrustedOrganizationCopilotPrincipal(
+                  {
+                    userId: context.userId,
+                    organizationId,
+                    chatId: context.chatId,
+                    delegationId: `copilot-tool:${context.toolCallId}`,
+                  },
+                  {
+                    audience: MCP_PRESENTATION_AUDIENCE,
+                    ttlMs: COPILOT_APPLICATION_DELEGATION_TTL_MS,
+                  }
+                ),
+                input,
+              })
+            : await publish(context, publishMcpResult, input)
+      }
+    }
+  } catch {
+    signal?.throwIfAborted()
+    logger.warn('MCP tool completed but its presentation could not be saved', {
+      toolCallId: context.toolCallId,
+    })
+  }
+  const output = {
+    content: result.content.map((item, index) =>
+      item.type === 'text'
+        ? {
+            type: 'text' as const,
+            text: item.text,
+            ...(item.annotations ? { annotations: item.annotations } : {}),
+          }
+        : item.type === 'resource' && 'text' in item.resource
+          ? { type: 'text' as const, text: item.resource.text }
+          : {
+              type: 'text' as const,
+              text: receipt?.items.some((asset) => asset.index === index)
+                ? `Attached result: ${receipt.items.find((asset) => asset.index === index)?.title || 'file'}`
+                : 'MCP file output could not be displayed.',
+            }
+    ),
+    ...(result.structuredContent ? { structuredContent: result.structuredContent } : {}),
+    ...(result.isError ? { isError: true } : {}),
+    ...(receipt ? { mcpPresentation: receipt } : {}),
+  }
+  return execution.success
+    ? { success: true, output }
+    : { success: false, error: execution.error, output }
+}
diff --git a/apps/sim/lib/internal/tool-operations/types.ts b/apps/sim/lib/internal/tool-operations/types.ts
index cb8f6c3efaa..160cc035092 100644
--- a/apps/sim/lib/internal/tool-operations/types.ts
+++ b/apps/sim/lib/internal/tool-operations/types.ts
@@ -17,6 +17,7 @@ export interface InternalToolOperationContext {
   workflowId: string
   workspaceId?: string
   organizationId?: string
+  chatOrganizationId?: string
   executionId?: string
   userId?: string
   executorDelegationOrigin?: ExecutorDelegationOrigin
diff --git a/apps/sim/lib/mcp/app-frame.ts b/apps/sim/lib/mcp/app-frame.ts
new file mode 100644
index 00000000000..a6af7fe7e4f
--- /dev/null
+++ b/apps/sim/lib/mcp/app-frame.ts
@@ -0,0 +1,79 @@
+import { isPlainRecord } from '@sim/utils/object'
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+
+function approvedDomains(value: unknown, allowWebSocket = false): string[] {
+  if (value === undefined) return []
+  if (!Array.isArray(value) || value.length > 32)
+    throw new OrchestrationError('validation', 'Invalid MCP App security policy')
+  return value.map((domain) => {
+    if (
+      typeof domain !== 'string' ||
+      domain.length > 256 ||
+      !/^(?:https|wss):\/\/(?:\*\.)?[a-zA-Z0-9.-]+(?::\d{1,5})?$/.test(domain)
+    )
+      throw new OrchestrationError('validation', 'MCP Apps require explicit HTTPS domains')
+    const url = new URL(domain.replace('://*.', '://'))
+    if (url.protocol === 'wss:' && !allowWebSocket)
+      throw new OrchestrationError('validation', 'Static App resources require HTTPS')
+    const hostname = url.hostname.replace(/\.$/, '')
+    if (hostname === 'localhost' || hostname.endsWith('.localhost') || /^[\d.]+$/.test(hostname))
+      throw new OrchestrationError('validation', 'MCP Apps cannot access local network addresses')
+    return domain
+  })
+}
+
+/** A network document with CSP sandboxing has an opaque origin and its own CSP policy container. */
+export function buildMcpAppFrame(html: string, metadata: unknown) {
+  if (Buffer.byteLength(html, 'utf8') > 1024 * 1024)
+    throw new OrchestrationError('payload_too_large', 'MCP App HTML exceeds 1 MiB')
+  const ui = isPlainRecord(metadata) && isPlainRecord(metadata.ui) ? metadata.ui : {}
+  const csp = isPlainRecord(ui.csp) ? ui.csp : {}
+  const resources = approvedDomains(csp.resourceDomains).join(' ')
+  const connections = approvedDomains(csp.connectDomains, true).join(' ')
+  const policy = [
+    'sandbox allow-scripts',
+    "default-src 'none'",
+    "base-uri 'none'",
+    "form-action 'none'",
+    "object-src 'none'",
+    `script-src 'unsafe-inline' ${resources}`,
+    `style-src 'unsafe-inline' ${resources}`,
+    `img-src data: blob: ${resources}`,
+    `media-src data: blob: ${resources}`,
+    `font-src data: ${resources}`,
+    `connect-src ${connections || "'none'"}`,
+    "frame-src 'none'",
+  ].join('; ')
+  const encodedHtml = Buffer.from(html).toString('base64')
+  const document = `<!doctype html><html><head><meta name="referrer" content="no-referrer"><style>html,body,iframe{margin:0;border:0;width:100%;height:100%;display:block;overflow:hidden}</style></head><body><script>
+const frame = document.createElement('iframe');
+frame.sandbox = 'allow-scripts';
+frame.referrerPolicy = 'no-referrer';
+let started = false;
+let childReady = false;
+const pending = [];
+addEventListener('message', (event) => {
+  const data = event.data;
+  if (!data || typeof data !== 'object' || data.jsonrpc !== '2.0') return;
+  if (event.source === parent) {
+    if (data.method === 'ui/notifications/sandbox-resource-ready') {
+      if (started) return;
+      started = true;
+      const bytes = Uint8Array.from(atob('${encodedHtml}'), char => char.charCodeAt(0));
+      frame.srcdoc = new TextDecoder().decode(bytes);
+      document.body.append(frame);
+      return;
+    }
+    if (childReady) frame.contentWindow.postMessage(data, '*');
+    else if (pending.length < 8) pending.push(data);
+  } else if (event.source === frame.contentWindow) {
+    if (typeof data.method === 'string' && data.method.startsWith('ui/notifications/sandbox-')) return;
+    childReady = true;
+    parent.postMessage(data, '*');
+    for (const message of pending.splice(0)) frame.contentWindow.postMessage(message, '*');
+  }
+});
+parent.postMessage({jsonrpc:'2.0',method:'ui/notifications/sandbox-proxy-ready',params:{}}, '*');
+</script></body></html>`
+  return { buffer: Buffer.from(document), contentType: 'text/html; charset=utf-8', policy }
+}
diff --git a/apps/sim/lib/mcp/application/execute-managed-tool.ts b/apps/sim/lib/mcp/application/execute-managed-tool.ts
index 142874d8d4d..f20ca292226 100644
--- a/apps/sim/lib/mcp/application/execute-managed-tool.ts
+++ b/apps/sim/lib/mcp/application/execute-managed-tool.ts
@@ -1,5 +1,5 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
-import { resolvePrincipalSubject } from '@sim/auth/principal'
+import { resolvePrincipalSubject, resolvePrincipalSubjectUserId } from '@sim/auth/principal'
 import { defineAuthorizedWorkspaceUseCase } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { requireCredentialGroupCredentialAccess } from '@/lib/credential-groups/application/authorization'
@@ -17,14 +17,24 @@ import {
   transformToolResult,
   validateToolArguments,
 } from '@/lib/mcp/application/execute-tool'
-import { loadManagedMcpAuthProvider } from '@/lib/mcp/application/managed-auth-provider'
+import {
+  createManagedMcpAuthProvider,
+  loadManagedMcpAuthProvider,
+} from '@/lib/mcp/application/managed-auth-provider'
 import {
   loadMcpOperationAccess,
   requireMcpOperationAccess,
 } from '@/lib/mcp/application/operation-access'
+import { createMcpToolPresentation } from '@/lib/mcp/application/presentation'
+import {
+  isMcpToolVisible,
+  matchesMcpAppOrigin,
+  snapshotMcpTool,
+} from '@/lib/mcp/presentation-metadata'
 import { mcpService } from '@/lib/mcp/service'
 import type { McpTool, McpToolCall, McpToolSchema } from '@/lib/mcp/types'
 import { assertWorkspaceCapability } from '@/lib/permission-groups/capability-assertions'
+import type { ResolvedSecretTraceProvenanceV1 } from '@/executor/utils/resolved-secret-trace-registry'
 
 export interface ExecuteManagedMcpToolInput {
   workspaceId: string
@@ -35,6 +45,9 @@ export interface ExecuteManagedMcpToolInput {
   callChain?: string[]
   timeoutMs?: number
   signal?: AbortSignal
+  presentation?: 'snapshot' | 'app'
+  appOrigin?: { toolName: string; resourceUri: string }
+  onResolvedSecretTraceProvenance?: (provenance: ResolvedSecretTraceProvenanceV1) => void
 }
 
 function requireToolSchema(value: unknown): McpToolSchema {
@@ -71,6 +84,7 @@ export const executeManagedMcpToolUseCase = defineAuthorizedWorkspaceUseCase({
   },
   async execute({ principal, input, context }): Promise<ExecuteMcpToolResult> {
     input.signal?.throwIfAborted()
+    const userId = resolvePrincipalSubjectUserId(principal)
     const runtime = await loadManagedMcpRuntimeCredential(context.credentialId, context.workspaceId)
     if (
       runtime.mcpServerId !== context.mcpServerId ||
@@ -96,29 +110,32 @@ export const executeManagedMcpToolUseCase = defineAuthorizedWorkspaceUseCase({
         loadProvider: () => loadManagedMcpAuthProvider(runtime.credentialId, runtime.workspaceId),
       },
       input.signal,
-      { requireComplete: true }
+      {
+        requireComplete: true,
+        provenanceScope: userId ? { userId, workspaceId: context.workspaceId } : undefined,
+        onResolvedSecretTraceProvenance: input.onResolvedSecretTraceProvenance,
+      }
     )
     await saveManagedMcpToolSnapshot(
       runtime.credentialId,
-      tools.map((tool) => ({
-        name: tool.name,
-        ...(tool.description ? { description: tool.description } : {}),
-        inputSchema: tool.inputSchema,
-      })),
+      tools.map(snapshotMcpTool),
       runtime.oauthConfigVersion,
       runtime.grantedAt
     )
     const discovered = tools.find((tool) => tool.name === input.toolName)
+    if (principal.kind === 'session' && !matchesMcpAppOrigin(tools, input.appOrigin))
+      throw new OrchestrationError('forbidden', 'The originating MCP App is no longer available')
     if (!discovered) {
       throw new OrchestrationError('not_found', 'Tool not found on the managed MCP connection')
     }
     const tool: McpTool = {
-      name: discovered.name,
-      ...(discovered.description ? { description: discovered.description } : {}),
+      ...discovered,
       inputSchema: requireToolSchema(discovered.inputSchema),
       serverId: runtime.credentialId,
       serverName: runtime.mcpServerName,
     }
+    if (!isMcpToolVisible(tool, principal.kind === 'session' ? 'app' : 'model'))
+      throw new OrchestrationError('forbidden', 'MCP operation is unavailable to this caller')
     const args =
       allowed.argumentsMode === 'generated'
         ? coerceToolArguments(tool, { ...input.arguments })
@@ -154,6 +171,9 @@ export const executeManagedMcpToolUseCase = defineAuthorizedWorkspaceUseCase({
       credentialOperations.useManagedMcp.resourcePolicy
     )
     const providerResult = await mcpService.executeManagedMcpTool({
+      userId,
+      workspaceId: context.workspaceId,
+      onResolvedSecretTraceProvenance: input.onResolvedSecretTraceProvenance,
       connectionId: runtime.credentialId,
       serverId: runtime.mcpServerId,
       scope: runtime.scope,
@@ -164,7 +184,50 @@ export const executeManagedMcpToolUseCase = defineAuthorizedWorkspaceUseCase({
       loadAuthProvider: () => loadManagedMcpAuthProvider(context.credentialId, context.workspaceId),
     })
     input.signal?.throwIfAborted()
-    return transformToolResult(providerResult)
+    const result = transformToolResult(providerResult)
+    if (input.presentation) result.presentation = { tool, result: providerResult, arguments: args }
+    if (input.presentation === 'snapshot' && userId)
+      result.presentation = await createMcpToolPresentation(
+        { tool, result: providerResult, arguments: args },
+        (uri, signal) =>
+          mcpService.readResource({
+            serverId: current.mcpServerId,
+            workspaceId: context.workspaceId,
+            userId,
+            uri,
+            signal,
+            onResolvedSecretTraceProvenance: input.onResolvedSecretTraceProvenance,
+            managed: {
+              connectionId: context.credentialId,
+              scope: current.scope,
+              loadAuthProvider: async () => {
+                const latest = await loadManagedMcpCredentialApplicationContext(
+                  context.credentialId,
+                  context.workspaceId
+                )
+                if (!latest || latest.mcpServerId !== current.mcpServerId)
+                  throw new OrchestrationError('forbidden', 'Managed MCP connection changed')
+                await requireCredentialGroupCredentialAccess(
+                  principal,
+                  latest,
+                  credentialOperations.useManagedMcp.resourcePolicy
+                )
+                const grant = await loadManagedMcpRuntimeCredential(
+                  context.credentialId,
+                  context.workspaceId
+                )
+                if (
+                  grant.oauthConfigVersion !== current.oauthConfigVersion ||
+                  grant.grantedAt.getTime() !== current.grantedAt.getTime()
+                )
+                  throw new OrchestrationError('forbidden', 'Managed MCP grant changed')
+                return createManagedMcpAuthProvider(grant)
+              },
+            },
+          }),
+        input.signal
+      )
+    return result
   },
   projectAudit: ({ input, context }) => ({
     action: AuditAction.CREDENTIAL_ACCESSED,
diff --git a/apps/sim/lib/mcp/application/execute-tool.ts b/apps/sim/lib/mcp/application/execute-tool.ts
index 647917c7968..9973dfe6992 100644
--- a/apps/sim/lib/mcp/application/execute-tool.ts
+++ b/apps/sim/lib/mcp/application/execute-tool.ts
@@ -1,3 +1,4 @@
+import type { ReadResourceResult } from '@modelcontextprotocol/sdk/types.js'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { defineAuthorizedWorkspaceUseCase } from '@/lib/core/application'
@@ -13,6 +14,8 @@ import {
   requireMcpOperationAccess,
 } from '@/lib/mcp/application/operation-access'
 import { mcpServerOperations } from '@/lib/mcp/application/operations'
+import { createMcpToolPresentation } from '@/lib/mcp/application/presentation'
+import { isMcpToolVisible, matchesMcpAppOrigin } from '@/lib/mcp/presentation-metadata'
 import { mcpService } from '@/lib/mcp/service'
 import { compileMcpToolSchema } from '@/lib/mcp/tool-schema'
 import type { McpTool, McpToolCall, McpToolResult } from '@/lib/mcp/types'
@@ -36,12 +39,22 @@ export interface ExecuteMcpToolInput {
   callChain?: string[]
   timeoutMs?: number
   signal?: AbortSignal
+  presentation?: 'snapshot' | 'app'
+  appOrigin?: { toolName: string; resourceUri: string }
   onResolvedSecretTraceProvenance?: (provenance: ResolvedSecretTraceProvenanceV1) => void
 }
 
-export type ExecuteMcpToolResult =
+export type ExecuteMcpToolResult = (
   | { success: true; output: McpToolResult }
-  | { success: false; error: string }
+  | { success: false; error: string; output?: McpToolResult }
+) & {
+  presentation?: {
+    tool: McpTool
+    result: McpToolResult
+    arguments: Record<string, unknown>
+    resources?: ReadResourceResult['contents']
+  }
+}
 
 function hasType(value: unknown): value is SchemaProperty {
   return typeof value === 'object' && value !== null && 'type' in value
@@ -102,7 +115,7 @@ export function transformToolResult(result: McpToolResult): ExecuteMcpToolResult
   if (!result.isError) return { success: true, output: result }
   const firstContent = Array.isArray(result.content) ? result.content[0] : undefined
   const errorText =
-    firstContent && typeof firstContent === 'object' && typeof firstContent.text === 'string'
+    firstContent && firstContent.type === 'text' && typeof firstContent.text === 'string'
       ? firstContent.text.trim()
       : ''
   return { success: false, error: errorText || 'Tool execution failed' }
@@ -149,7 +162,11 @@ export const executeMcpToolUseCase = defineAuthorizedWorkspaceUseCase({
       { signal: input.signal, requireComplete: true }
     )
     const tool = tools.find((candidate) => candidate.name === input.toolName)
+    if (principal.kind === 'session' && !matchesMcpAppOrigin(tools, input.appOrigin))
+      throw new OrchestrationError('forbidden', 'The originating MCP App is no longer available')
     if (!tool) throw new OrchestrationError('not_found', 'Tool not found on the specified server')
+    if (!isMcpToolVisible(tool, principal.kind === 'session' ? 'app' : 'model'))
+      throw new OrchestrationError('forbidden', 'MCP operation is unavailable to this caller')
     const args =
       allowed.argumentsMode === 'generated'
         ? coerceToolArguments(tool, { ...input.arguments })
@@ -183,6 +200,21 @@ export const executeMcpToolUseCase = defineAuthorizedWorkspaceUseCase({
     )
     input.signal?.throwIfAborted()
     const result = transformToolResult(providerResult)
+    if (input.presentation) result.presentation = { tool, result: providerResult, arguments: args }
+    if (input.presentation === 'snapshot')
+      result.presentation = await createMcpToolPresentation(
+        { tool, result: providerResult, arguments: args },
+        (uri, signal) =>
+          mcpService.readResource({
+            serverId: context.server.id,
+            workspaceId: context.workspaceId,
+            userId,
+            uri,
+            signal,
+            onResolvedSecretTraceProvenance: input.onResolvedSecretTraceProvenance,
+          }),
+        input.signal
+      )
     if (!result.success) return result
 
     try {
diff --git a/apps/sim/lib/mcp/application/managed-connections.ts b/apps/sim/lib/mcp/application/managed-connections.ts
index 853bc1f5895..fdf25c646dc 100644
--- a/apps/sim/lib/mcp/application/managed-connections.ts
+++ b/apps/sim/lib/mcp/application/managed-connections.ts
@@ -189,8 +189,7 @@ export const listManagedMcpConnectionsUseCase = defineAuthorizedWorkspaceUseCase
       })),
       tools: rows.flatMap((row) => {
         return row.tools.map((tool) => ({
-          name: tool.name,
-          description: tool.description,
+          ...tool,
           inputSchema: requireMcpToolSchema(tool.inputSchema),
           serverId: row.id,
           canonicalServerId: row.serverId,
diff --git a/apps/sim/lib/mcp/application/operations.test.ts b/apps/sim/lib/mcp/application/operations.test.ts
index e03ab42f73c..74739e843ed 100644
--- a/apps/sim/lib/mcp/application/operations.test.ts
+++ b/apps/sim/lib/mcp/application/operations.test.ts
@@ -27,16 +27,6 @@ describe('MCP server operation registry', () => {
     })
   })
 
-  it('admits executor and Copilot delegations for tool execution', () => {
-    expect(mcpServerOperations.executeTool).toMatchObject({
-      id: 'mcp_servers.tools.execute',
-      minimumRole: 'read',
-      workspaceApiKey: 'deny',
-      principalKinds: ['delegated'],
-      delegatedServices: ['executor', 'copilot'],
-    })
-  })
-
   /**
    * The six workflow-deployment operations were widened from `['delegated']` to
    * human principals when `/api/v2/workflow-mcp-servers` shipped. Their roles
@@ -136,6 +126,7 @@ const EXPECTED_CAPABILITIES: Record<keyof typeof mcpServerOperations, string> =
   delete: 'mcp_tools.use',
   discoverTools: 'mcp_tools.use',
   executeTool: 'mcp_tools.use',
+  readResource: 'mcp_tools.use',
   listManagedConnections: 'mcp_tools.use',
   listWorkflowDeployments: 'deploy.mcp',
   readWorkflowDeploymentServer: 'deploy.mcp',
@@ -157,7 +148,6 @@ describe('MCP operation capability declarations', () => {
   })
 })
 
-/** `tools.execute` admits only the executor delegation, so a session cannot stand in for it. */
 function sessionReachable(capability: string) {
   return Object.values(mcpServerOperations).filter(
     (operation) =>
diff --git a/apps/sim/lib/mcp/application/operations.ts b/apps/sim/lib/mcp/application/operations.ts
index 1f38e05b576..503fd153923 100644
--- a/apps/sim/lib/mcp/application/operations.ts
+++ b/apps/sim/lib/mcp/application/operations.ts
@@ -19,7 +19,7 @@ const DISCOVERY_PRINCIPAL_POLICY = {
   delegatedServices: ['copilot', 'executor'],
 } as const
 const EXECUTION_PRINCIPAL_POLICY = {
-  principalKinds: ['delegated'],
+  principalKinds: ['session', 'delegated'],
   delegatedServices: ['executor', 'copilot'],
 } as const
 
@@ -68,6 +68,13 @@ export const mcpServerOperations = {
     capability: 'mcp_tools.use',
     ...EXECUTION_PRINCIPAL_POLICY,
   }),
+  readResource: defineWorkspaceOperation({
+    id: 'mcp_servers.resources.read',
+    minimumRole: 'read',
+    workspaceApiKey: 'deny',
+    capability: 'mcp_tools.use',
+    principalKinds: ['session'],
+  }),
   /**
    * Publishing a workflow as an MCP server was reachable only through Copilot,
    * so all six operations below declared `principalKinds: ['delegated']` — not
diff --git a/apps/sim/lib/mcp/application/presentation.integration.ts b/apps/sim/lib/mcp/application/presentation.integration.ts
new file mode 100644
index 00000000000..220c15c93dd
--- /dev/null
+++ b/apps/sim/lib/mcp/application/presentation.integration.ts
@@ -0,0 +1,995 @@
+import { createServer } from 'node:http'
+import { json } from 'node:stream/consumers'
+import { Server } from '@modelcontextprotocol/sdk/server/index.js'
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'
+import {
+  CallToolRequestSchema,
+  ListResourcesRequestSchema,
+  ListToolsRequestSchema,
+  ReadResourceRequestSchema,
+} from '@modelcontextprotocol/sdk/types.js'
+import { db } from '@sim/db'
+import { copilotChats, environment, mcpServers, permissions, user, workspace } from '@sim/db/schema'
+import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
+import { generateId } from '@sim/utils/id'
+import { toArray, toRecord } from '@sim/utils/object'
+import { eq, inArray } from 'drizzle-orm'
+import { afterAll, afterEach, beforeAll, describe, expect, it } from 'vitest'
+import { resolveBillingAttribution } from '@/lib/billing/core/billing-attribution'
+import { env } from '@/lib/core/config/env'
+import { encryptSecret } from '@/lib/core/security/encryption'
+import { executeMcpTool } from '@/lib/internal/mcp/execute-tool'
+import { updateMcpServerUseCase } from '@/lib/mcp/application/use-cases'
+import { evictMcpServerConnections } from '@/lib/mcp/connection-pool'
+import { compactMcpPresentation } from '@/lib/mcp/presentation'
+import {
+  mcpPresentationCleanupKeys,
+  planForkMcpPresentations,
+} from '@/lib/mcp/presentation-lifecycle'
+import { loadMcpPresentation } from '@/lib/mcp/presentation-storage'
+import { mcpService } from '@/lib/mcp/service'
+import { changeChatResources } from '@/lib/mothership/chat/application/change-resources'
+import {
+  callMcpAppTool,
+  readMcpAppFrame,
+  readMcpAppResource,
+  readMcpResult,
+  readMcpResultAsset,
+  readMcpResultMetadata,
+} from '@/lib/mothership/chat/application/mcp-results'
+import { executeChatFileBlobCopies } from '@/lib/mothership/chat/fork-chat-files'
+import { loadCopilotChatMessages } from '@/lib/mothership/chat/lifecycle'
+import { appendCopilotChatMessages } from '@/lib/mothership/chat/messages-store'
+import type { PersistedMessage } from '@/lib/mothership/chat/persisted-message'
+import { buildTaggedMcpToolSchemas } from '@/lib/mothership/mcp-tools'
+import { deleteFile } from '@/lib/uploads/core/storage-service'
+import {
+  type ResolvedSecretTraceProvenanceV1,
+  ResolvedSecretTraceRegistry,
+} from '@/executor/utils/resolved-secret-trace-registry'
+
+const owner = generateId()
+const stranger = generateId()
+const workspaceId = generateId()
+const chatId = generateId()
+const forkId = generateId()
+const serverId = `mcp-${generateId()}`
+const appUri = 'ui://fixture/view.html'
+const sourceUri = 'file:///report.txt'
+const credentialCanary = 'fixture-secret-7ea-not-for-display'
+let reflectCredential = false
+let encodedCredential = false
+let encodedMimeType = 'text/plain'
+let encodedCharset: 'utf-8' | 'utf-16le' | 'utf-16be' = 'utf-8'
+let receivedCredential: string | string[] | undefined
+const session = createSessionPrincipal({ userId: owner })
+const transports = new Map<string, StreamableHTTPServerTransport>()
+const blobs = new Set<string>()
+let appCalls = 0
+let appAvailable = true
+let listingOnlyPolicy = false
+let providerTitle = 'Quarterly report'
+let providerMime = 'text/plain'
+let linkedReportText = 'Remote resource bytes'
+let linkedResourceMissing = false
+let linkedResourceProtected = false
+let resourceReads = 0
+let echoAppUri = false
+let connectDomain = 'https://allowed.test'
+let rejectResourceStatus = 0
+let rejectResourcesPersistently = false
+let rejectedResourceReads = 0
+let rejectedSession: string | undefined
+let origin = ''
+const provider = createServer(async (request, response) => {
+  try {
+    const body = request.method === 'POST' ? toRecord(await json(request)) : undefined
+    if (body?.method === 'resources/read' && rejectResourceStatus) {
+      response.writeHead(rejectResourceStatus).end()
+      rejectedResourceReads++
+      rejectedSession ??= String(request.headers['mcp-session-id'])
+      if (!rejectResourcesPersistently) rejectResourceStatus = 0
+      return
+    }
+    if (body?.method === 'resources/read' && rejectedSession) {
+      if (request.headers['mcp-session-id'] === rejectedSession) {
+        response.writeHead(404).end()
+        return
+      }
+      rejectedSession = undefined
+    }
+    receivedCredential = request.headers['x-fixture-token']
+    const sessionId = request.headers['mcp-session-id']
+    let transport = typeof sessionId === 'string' ? transports.get(sessionId) : undefined
+    if (!transport) {
+      if (sessionId || request.method !== 'POST') {
+        response.writeHead(404).end()
+        return
+      }
+      const protocol = new Server(
+        { name: 'presentation-fixture', version: '1' },
+        { capabilities: { tools: {}, resources: {} } }
+      )
+      protocol.setRequestHandler(ListToolsRequestSchema, async () => ({
+        tools: [
+          {
+            name: 'show_report',
+            title: reflectCredential ? String(request.headers['x-fixture-token']) : providerTitle,
+            inputSchema: { type: 'object' as const },
+            _meta: appAvailable
+              ? {
+                  ui: {
+                    resourceUri: echoAppUri ? `${appUri}/${credentialCanary}` : appUri,
+                    visibility: ['model'],
+                  },
+                }
+              : {},
+          },
+          {
+            name: 'change_report',
+            inputSchema: { type: 'object' as const },
+            _meta: { ui: { visibility: ['app'] } },
+          },
+          {
+            name: 'model_only',
+            inputSchema: { type: 'object' as const },
+            _meta: { ui: { visibility: ['model'] } },
+          },
+        ],
+      }))
+      protocol.setRequestHandler(CallToolRequestSchema, async ({ params }) => {
+        if (params.name === 'change_report') {
+          appCalls++
+          if (params.arguments?.linked)
+            return {
+              content: [
+                { type: 'resource_link', name: 'Report', uri: sourceUri, mimeType: 'text/plain' },
+              ],
+            }
+          if (encodedCredential)
+            return {
+              content: [
+                {
+                  type: 'resource',
+                  resource: {
+                    uri: sourceUri,
+                    mimeType: `${encodedMimeType}; charset=${encodedCharset}`,
+                    blob: encodeFixtureText(
+                      `Encoded report: ${request.headers['x-fixture-token']}:end`
+                    ),
+                  },
+                },
+              ],
+            }
+          return {
+            content: [
+              {
+                type: 'text' as const,
+                text: reflectCredential
+                  ? String(request.headers['x-fixture-token'])
+                  : `Revision ${appCalls}`,
+              },
+            ],
+          }
+        }
+        if (params.arguments?.linked) {
+          if (typeof params.arguments.revision === 'number')
+            linkedReportText = `Revision ${params.arguments.revision}`
+          return {
+            content: [
+              {
+                type: 'resource_link',
+                name: providerTitle,
+                title: providerTitle,
+                uri: sourceUri,
+                mimeType: providerMime,
+              },
+              ...(linkedResourceMissing || linkedResourceProtected
+                ? [
+                    {
+                      type: 'resource' as const,
+                      resource: {
+                        uri: 'file:///embedded.txt',
+                        mimeType: 'text/plain',
+                        blob: Buffer.from(`Encoded report: ${credentialCanary}:end`).toString(
+                          'base64'
+                        ),
+                      },
+                    },
+                    {
+                      type: 'resource_link' as const,
+                      uri: 'file:///later.txt',
+                      name: 'Later report',
+                      mimeType: 'text/plain',
+                    },
+                  ]
+                : []),
+            ],
+            _meta: { privateWidgetData: 'Only the app should receive this' },
+          }
+        }
+        if (encodedCredential)
+          return {
+            content: [
+              {
+                type: 'resource',
+                resource: {
+                  uri: sourceUri,
+                  mimeType: `${encodedMimeType}; charset=${encodedCharset}`,
+                  blob: encodeFixtureText(
+                    `Encoded report: ${request.headers['x-fixture-token']}:end`
+                  ),
+                },
+              },
+            ],
+          }
+        if (params.arguments?.unsupportedMedia)
+          return {
+            content: [
+              {
+                type: params.arguments.unsupportedMedia === 'image/tiff' ? 'image' : 'audio',
+                mimeType: params.arguments.unsupportedMedia,
+                data: Buffer.from('Unsupported fixture bytes').toString('base64'),
+              },
+            ],
+          }
+        if (params.arguments?.malformed)
+          return {
+            content: [
+              ...(params.arguments.malformed === 'base64'
+                ? [{ type: 'image' as const, mimeType: 'image/png', data: 'YR==' }]
+                : [
+                    {
+                      type: 'resource' as const,
+                      resource: {
+                        uri: 'file:///rejected.bin',
+                        mimeType:
+                          params.arguments.malformed === 'protected'
+                            ? 'application/octet-stream'
+                            : 'text/plain; charset=unsupported',
+                        blob: Buffer.from(credentialCanary).toString('base64'),
+                      },
+                    },
+                  ]),
+              {
+                type: 'resource',
+                resource: { uri: sourceUri, mimeType: 'text/plain', text: 'Valid attachment' },
+              },
+            ],
+          }
+        return {
+          content: [
+            { type: 'text' as const, text: 'Report ready' },
+            {
+              type: 'resource' as const,
+              resource: {
+                uri: sourceUri,
+                mimeType: 'text/plain',
+                text: reflectCredential
+                  ? String(request.headers['x-fixture-token'])
+                  : typeof params.arguments?.revision === 'number'
+                    ? `Revision ${params.arguments.revision}`
+                    : 'Private report bytes',
+              },
+            },
+          ],
+          structuredContent: { total: 42 },
+          _meta: {
+            privateWidgetData: 'Only the app should receive this',
+            ...(reflectCredential ? { credential: request.headers['x-fixture-token'] } : {}),
+          },
+        }
+      })
+      protocol.setRequestHandler(ListResourcesRequestSchema, async () => ({
+        resources: [
+          {
+            name: 'Report app',
+            uri: appUri,
+            mimeType: 'text/html;profile=mcp-app',
+            _meta: { ui: { csp: { connectDomains: ['https://listed.test'] } } },
+          },
+        ],
+      }))
+      protocol.setRequestHandler(ReadResourceRequestSchema, async ({ params }) => {
+        resourceReads++
+        if (linkedResourceProtected && params.uri === sourceUri)
+          return {
+            contents: [
+              {
+                uri: sourceUri,
+                mimeType: 'application/octet-stream',
+                blob: Buffer.from(credentialCanary).toString('base64'),
+              },
+            ],
+          }
+        if (linkedResourceMissing && params.uri === sourceUri)
+          throw new Error('Synthetic missing linked resource')
+        return {
+          contents: [
+            {
+              uri: params.uri,
+              mimeType: `${params.uri === appUri ? 'text/html;profile=mcp-app' : providerMime}${encodedCredential ? `; charset=${encodedCharset}` : params.uri === appUri ? '; charset=utf-8' : ''}`,
+              ...(encodedCredential
+                ? {
+                    blob: encodeFixtureText(
+                      `<p>Encoded report: ${request.headers['x-fixture-token']}:end</p>`
+                    ),
+                  }
+                : {
+                    text: reflectCredential
+                      ? `<p>${request.headers['x-fixture-token']}</p>`
+                      : params.uri === appUri
+                        ? '<!doctype html><p>Private app</p>'
+                        : linkedReportText,
+                  }),
+              _meta: listingOnlyPolicy ? {} : { ui: { csp: { connectDomains: [connectDomain] } } },
+            },
+          ],
+        }
+      })
+      transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: generateId,
+        enableJsonResponse: true,
+        onsessioninitialized: (id) => {
+          if (transport) transports.set(id, transport)
+        },
+      })
+      await protocol.connect(transport)
+    }
+    await transport.handleRequest(request, response, body)
+  } catch {
+    if (!response.headersSent) response.writeHead(500)
+    response.end()
+  }
+})
+
+async function invokeReport(args?: Record<string, unknown>, toolCallId = generateId()) {
+  const context = {
+    userId: owner,
+    workspaceId,
+    chatId,
+    toolCallId,
+    workflowId: '',
+    copilotToolExecution: true as const,
+    resolvedSecretTraceRegistry: new ResolvedSecretTraceRegistry([], {
+      userId: owner,
+      workspaceId,
+    }),
+  }
+  const response = await executeMcpTool({
+    toolId: 'mcp_run_operation',
+    input: { server: serverId, tool: 'show_report', arguments: args ?? {} },
+    headers: new Headers(),
+    requestId: toolCallId,
+    context: {
+      ...context,
+      billingAttribution: await resolveBillingAttribution({ actorUserId: owner, workspaceId }),
+    },
+  })
+  const body = toRecord(await response.json())
+  expect(response.status, JSON.stringify(body)).toBe(200)
+  const result = { success: body.success === true, output: body.output }
+  expect(result.success).toBe(true)
+  return { result, toolCallId }
+}
+
+async function executeReport(args?: Record<string, unknown>, toolCallId = generateId()) {
+  const { result } = await invokeReport(args, toolCallId)
+  const receipt = compactMcpPresentation(result.output)
+  if (!receipt) throw new Error('Provider output did not produce a native presentation')
+  const message: PersistedMessage = {
+    id: generateId(),
+    role: 'assistant',
+    content: '',
+    timestamp: new Date().toISOString(),
+    contentBlocks: [
+      {
+        type: 'tool',
+        phase: 'call',
+        toolCall: { id: toolCallId, name: `mcp-${serverId}-show_report`, state: 'success', result },
+      },
+    ],
+  }
+  for (const key of mcpPresentationCleanupKeys(chatId, message)) blobs.add(key)
+  return { result, receipt: receipt.mcpPresentation, message, toolCallId }
+}
+
+function encodeFixtureText(text: string) {
+  const bytes = Buffer.from(text, encodedCharset === 'utf-8' ? 'utf8' : 'utf16le')
+  return (encodedCharset === 'utf-16be' ? bytes.swap16() : bytes).toString('base64')
+}
+
+function expectProtectedEncodedContent(blob: unknown) {
+  if (typeof blob !== 'string') throw new Error('Expected encoded resource bytes')
+  const text = Buffer.from(blob, 'base64').toString()
+  expect(text).toContain('Encoded report: ')
+  expect(text).toContain(':end')
+  expect(text).not.toContain(credentialCanary)
+}
+
+beforeAll(async () => {
+  Object.assign(env, { EGRESS_ALLOWED_HOSTS: '127.0.0.1' })
+  await new Promise<void>((resolve) => provider.listen(0, '127.0.0.1', resolve))
+  const address = provider.address()
+  if (!address || typeof address === 'string') throw new Error('Provider fixture failed to bind')
+  origin = `http://127.0.0.1:${address.port}/mcp`
+  await db.insert(user).values(
+    [owner, stranger].map((id) => ({
+      id,
+      name: 'MCP presentation fixture',
+      email: `${id}@fixture.test`,
+      emailVerified: true,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    }))
+  )
+  await db.insert(workspace).values({
+    id: workspaceId,
+    name: 'MCP presentation fixture',
+    ownerId: owner,
+    billedAccountUserId: owner,
+  })
+  await db.insert(permissions).values(
+    [owner, stranger].map((userId) => ({
+      id: generateId(),
+      userId,
+      entityType: 'workspace',
+      entityId: workspaceId,
+      permissionType: 'admin' as const,
+    }))
+  )
+  await db.insert(copilotChats).values(
+    [chatId, forkId].map((id) => ({
+      id,
+      userId: owner,
+      workspaceId,
+      type: 'mothership' as const,
+    }))
+  )
+  await db.insert(environment).values({
+    id: owner,
+    userId: owner,
+    variables: { MCP_APP_SECRET: (await encryptSecret(credentialCanary)).encrypted },
+  })
+  await db.insert(mcpServers).values({
+    id: serverId,
+    workspaceId,
+    name: 'Fixture',
+    transport: 'streamable-http',
+    url: origin,
+    authType: 'none',
+    headers: { 'x-fixture-token': '{{MCP_APP_SECRET}}' },
+    createdBy: owner,
+  })
+})
+
+afterEach(() => {
+  linkedReportText = 'Remote resource bytes'
+  linkedResourceMissing = false
+  linkedResourceProtected = false
+  echoAppUri = false
+})
+
+afterAll(async () => {
+  await evictMcpServerConnections(serverId, 'fixture cleanup')
+  for (const transport of transports.values()) await transport.close()
+  await new Promise<void>((resolve) => {
+    provider.close(() => resolve())
+    provider.closeAllConnections()
+  })
+  for (const key of blobs) await deleteFile({ key, context: 'mothership' })
+  await db.delete(workspace).where(eq(workspace.id, workspaceId))
+  await db.delete(user).where(inArray(user.id, [owner, stranger]))
+  await db.$client.end()
+})
+
+describe('native MCP results over real transport, storage and Postgres', () => {
+  it('reopens bytes after transcript stripping and keeps private widget metadata outside model output', async () => {
+    const { result, receipt, message } = await executeReport()
+    expect(JSON.stringify(result.output)).not.toContain('Only the app should receive this')
+    expect(JSON.stringify(result.output)).toContain('Private report bytes')
+    await appendCopilotChatMessages(chatId, [message])
+    const restored = await loadCopilotChatMessages(chatId)
+    expect(
+      compactMcpPresentation(restored[0].contentBlocks?.[0].toolCall?.result?.output)
+        ?.mcpPresentation.id
+    ).toBe(receipt.id)
+    const asset = await readMcpResultAsset.execute({
+      principal: session,
+      input: { chatId, id: receipt.id, index: 1 },
+    })
+    expect(asset.buffer.toString()).toBe('Private report bytes')
+    const reopened = await readMcpResult.execute({
+      principal: session,
+      input: { chatId, id: receipt.id },
+    })
+    expect(reopened.result._meta?.privateWidgetData).toBe('Only the app should receive this')
+    const metadata = await readMcpResultMetadata.execute({
+      principal: session,
+      input: { chatId, id: receipt.id },
+    })
+    expect(metadata.receipt).toEqual(receipt)
+    expect('result' in metadata || 'arguments' in metadata).toBe(false)
+    expect(JSON.stringify(metadata)).not.toContain('Private report bytes')
+    const plan = planForkMcpPresentations([message], chatId, forkId)
+    for (const task of plan) blobs.add(task.targetKey)
+    expect((await executeChatFileBlobCopies(plan)).failed).toBe(0)
+    expect(
+      (
+        await readMcpResultAsset.execute({
+          principal: session,
+          input: { chatId: forkId, id: receipt.id, index: 1 },
+        })
+      ).buffer.toString()
+    ).toBe('Private report bytes')
+  })
+
+  it('denies another member of the same workspace and forged snapshot addresses', async () => {
+    const { receipt } = await executeReport()
+    await expect(
+      readMcpResult.execute({
+        principal: createSessionPrincipal({ userId: stranger }),
+        input: { chatId, id: receipt.id },
+      })
+    ).rejects.toThrow('Chat not found')
+    await expect(
+      readMcpResult.execute({ principal: session, input: { chatId: forkId, id: receipt.id } })
+    ).rejects.toThrow('MCP result not found')
+  })
+
+  it('keeps app-only tools out of the model and enforces both App origin and target visibility', async () => {
+    const { receipt } = await executeReport()
+    const callsBefore = appCalls
+    const schemas = await buildTaggedMcpToolSchemas(owner, workspaceId, [serverId])
+    expect(schemas.some((tool) => tool.name.endsWith('change_report'))).toBe(false)
+    const result = await callMcpAppTool.execute({
+      principal: session,
+      input: { chatId, id: receipt.id, name: 'change_report' },
+    })
+    expect(result.content).toEqual([{ type: 'text', text: `Revision ${callsBefore + 1}` }])
+    await expect(
+      callMcpAppTool.execute({
+        principal: session,
+        input: { chatId, id: receipt.id, name: 'model_only' },
+      })
+    ).rejects.toThrow('unavailable to this caller')
+    appAvailable = false
+    try {
+      await expect(
+        callMcpAppTool.execute({
+          principal: session,
+          input: { chatId, id: receipt.id, name: 'change_report' },
+        })
+      ).rejects.toThrow('originating MCP App')
+    } finally {
+      appAvailable = true
+    }
+    expect(appCalls).toBe(callsBefore + 1)
+  })
+
+  it('reads App resources through the recorded connection and stops live access when disabled', async () => {
+    const { receipt } = await executeReport()
+    const callsBeforeDisable = appCalls
+    expect(
+      (
+        await readMcpAppResource.execute({
+          principal: session,
+          input: { chatId, id: receipt.id, uri: sourceUri },
+        })
+      ).contents[0]
+    ).toMatchObject({ text: 'Remote resource bytes' })
+    const frame = await readMcpAppFrame.execute({
+      principal: session,
+      input: { chatId, id: receipt.id },
+    })
+    expect(frame.buffer.toString()).not.toContain('Private report bytes')
+    await updateMcpServerUseCase.execute({
+      principal: session,
+      input: { workspaceId, serverId, enabled: false },
+    })
+    try {
+      await expect(
+        callMcpAppTool.execute({
+          principal: session,
+          input: { chatId, id: receipt.id, name: 'change_report' },
+        })
+      ).rejects.toThrow()
+    } finally {
+      await updateMcpServerUseCase.execute({
+        principal: session,
+        input: { workspaceId, serverId, enabled: true },
+      })
+    }
+    expect(appCalls).toBe(callsBeforeDisable)
+  })
+  it.each([false, true])(
+    'updates one persisted artifact tab while retaining immutable versions (linked=%s)',
+    async (linked) => {
+      const first = await executeReport({ revision: 1, linked })
+      const second = await executeReport({ revision: 2, linked })
+      await executeReport({ revision: 99, linked }, first.toolCallId)
+      const index = linked ? 0 : 1
+      const [stored] = await db
+        .select({ resources: copilotChats.resources })
+        .from(copilotChats)
+        .where(eq(copilotChats.id, chatId))
+      const matching = toArray(stored.resources).filter(
+        (resource) => toRecord(resource).id === first.receipt.items[0].identity
+      )
+      expect(matching).toHaveLength(1)
+      expect(matching[0]).toMatchObject({
+        id: first.receipt.items[0].identity,
+        mcp: { presentationId: second.receipt.id, index },
+      })
+      await updateMcpServerUseCase.execute({
+        principal: session,
+        input: { workspaceId, serverId, enabled: false },
+      })
+      try {
+        for (const [version, result] of [first, second].entries()) {
+          const asset = await readMcpResultAsset.execute({
+            principal: session,
+            input: { chatId, id: result.receipt.id, index },
+          })
+          expect(asset.buffer.toString()).toBe(`Revision ${version + 1}`)
+        }
+      } finally {
+        await updateMcpServerUseCase.execute({
+          principal: session,
+          input: { workspaceId, serverId, enabled: true },
+        })
+      }
+      await changeChatResources.execute({
+        principal: session,
+        input: {
+          chatId,
+          change: {
+            kind: 'remove',
+            resources: [{ type: 'mcp', id: first.receipt.items[0].identity }],
+          },
+        },
+      })
+      await executeReport({ revision: 99, linked }, first.toolCallId)
+      const [closed] = await db
+        .select({ resources: copilotChats.resources })
+        .from(copilotChats)
+        .where(eq(copilotChats.id, chatId))
+      expect(
+        toArray(closed.resources).some(
+          (resource) => toRecord(resource).id === first.receipt.items[0].identity
+        )
+      ).toBe(false)
+    }
+  )
+
+  it.each([false, true])(
+    'preserves valid attachments when a link fails (protected=%s)',
+    async (protectedBytes) => {
+      linkedResourceMissing = !protectedBytes
+      linkedResourceProtected = protectedBytes
+      const { result, receipt } = await executeReport({ linked: true })
+      expect(receipt.hasApp).toBe(true)
+      expect(receipt.items.map((item) => item.index)).toEqual([1, 2])
+      const asset = await readMcpResultAsset.execute({
+        principal: session,
+        input: { chatId, id: receipt.id, index: 1 },
+      })
+      expect(asset.buffer.toString()).toContain('Encoded report: ')
+      expect(asset.buffer.toString()).not.toContain(credentialCanary)
+      const later = await readMcpResultAsset.execute({
+        principal: session,
+        input: { chatId, id: receipt.id, index: 2 },
+      })
+      expect(later.buffer.toString()).toBe('Remote resource bytes')
+      await expect(
+        readMcpResultAsset.execute({
+          principal: session,
+          input: { chatId, id: receipt.id, index: 0 },
+        })
+      ).rejects.toThrow('MCP file not found')
+      expect(JSON.stringify(result.output)).not.toContain('Only the app should receive this')
+      expect(JSON.stringify(result.output)).not.toContain(
+        Buffer.from(`Encoded report: ${credentialCanary}:end`).toString('base64')
+      )
+      expect(JSON.stringify(result.output)).toContain('could not be displayed')
+    }
+  )
+
+  it('does not download linked resources returned by a live App call', async () => {
+    const { receipt } = await executeReport()
+    const before = resourceReads
+    const result = await callMcpAppTool.execute({
+      principal: session,
+      input: { chatId, id: receipt.id, name: 'change_report', arguments: { linked: true } },
+    })
+    expect(result.content[0]).toMatchObject({ type: 'resource_link', uri: sourceUri })
+    expect(resourceReads).toBe(before)
+  })
+
+  it('redacts credentials reflected in the discovered App address before storage', async () => {
+    echoAppUri = true
+    const { receipt } = await executeReport()
+    const manifest = await loadMcpPresentation(chatId, receipt.id)
+    expect(manifest.appUri).toContain('ui://fixture/view.html/')
+    expect(JSON.stringify(manifest)).not.toContain(credentialCanary)
+  })
+
+  it('redacts encoded credentials in linked snapshot bytes before reopening', async () => {
+    encodedCredential = true
+    try {
+      const { receipt } = await executeReport({ linked: true })
+      const asset = await readMcpResultAsset.execute({
+        principal: session,
+        input: { chatId, id: receipt.id, index: 0 },
+      })
+      expect(
+        asset.buffer.includes(Buffer.from(encodeFixtureText(credentialCanary), 'base64'))
+      ).toBe(false)
+      expect(asset.buffer.toString()).toContain('Encoded report: ')
+      expect(asset.buffer.toString()).toContain(':end')
+      expect(asset.buffer.toString()).not.toContain(credentialCanary)
+    } finally {
+      encodedCredential = false
+    }
+  })
+
+  it.each([
+    ['audio/aiff', 'attachment'],
+    ['image/tiff', 'attachment'],
+    ['audio/ogg; codecs=opus', 'inline'],
+  ] as const)('serves %s with %s disposition', async (mimeType, disposition) => {
+    const { receipt } = await executeReport({ unsupportedMedia: mimeType })
+    const asset = await readMcpResultAsset.execute({
+      principal: session,
+      input: { chatId, id: receipt.id, index: 0 },
+    })
+    expect(asset.disposition).toBe(disposition)
+    expect(asset.buffer.toString()).toBe('Unsupported fixture bytes')
+  })
+
+  it('reports credentials once for both a cold and a pooled resource read', async () => {
+    await evictMcpServerConnections(serverId, 'cold resource fixture')
+    for (let invocation = 0; invocation < 2; invocation++) {
+      const reports: ResolvedSecretTraceProvenanceV1[] = []
+      const result = await mcpService.readResource({
+        serverId,
+        workspaceId,
+        userId: owner,
+        uri: sourceUri,
+        onResolvedSecretTraceProvenance: (value) => reports.push(value),
+      })
+      expect(result.contents[0]).toMatchObject({ text: 'Remote resource bytes' })
+      expect(reports).toHaveLength(1)
+      expect(reports[0].complete).toBe(true)
+      expect(reports[0].entries).toHaveLength(1)
+    }
+  })
+
+  it.each(['base64', 'protected', 'charset'])(
+    'withholds a rejected %s file while retaining attachments and the App',
+    async (problem) => {
+      const { receipt } = await executeReport({ malformed: problem })
+      expect(receipt.items.map((item) => item.index)).toEqual([1])
+      const asset = await readMcpResultAsset.execute({
+        principal: session,
+        input: { chatId, id: receipt.id, index: 1 },
+      })
+      expect(asset.buffer.toString()).toBe('Valid attachment')
+      const frame = await readMcpAppFrame.execute({
+        principal: session,
+        input: { chatId, id: receipt.id },
+      })
+      expect(frame.buffer.length).toBeGreaterThan(0)
+      const saved = await readMcpResult.execute({
+        principal: session,
+        input: { chatId, id: receipt.id },
+      })
+      expect(JSON.stringify(saved)).not.toContain(Buffer.from(credentialCanary).toString('base64'))
+      await expect(
+        readMcpResultAsset.execute({
+          principal: session,
+          input: { chatId, id: receipt.id, index: 0 },
+        })
+      ).rejects.toThrow('MCP file not found')
+      const before = appCalls
+      const controller = new AbortController()
+      controller.abort()
+      await expect(
+        callMcpAppTool.execute({
+          principal: session,
+          input: { chatId, id: receipt.id, name: 'change_report', signal: controller.signal },
+        })
+      ).rejects.toThrow()
+      expect(appCalls).toBe(before)
+    }
+  )
+
+  it('uses authenticated listing metadata when the App read omits its policy', async () => {
+    const { receipt } = await executeReport()
+    listingOnlyPolicy = true
+    try {
+      const frame = await readMcpAppFrame.execute({
+        principal: session,
+        input: { chatId, id: receipt.id },
+      })
+      expect(frame.policy).toContain('https://listed.test')
+      expect(frame.policy).not.toContain('https://allowed.test')
+    } finally {
+      listingOnlyPolicy = false
+    }
+  })
+  it.each([
+    ['text/plain', 'text/plain'],
+    [`text/plain; description="${'long parameter '.repeat(20)}"`, 'text/plain'],
+    [`application/${'x'.repeat(150)}`, 'application/octet-stream'],
+  ])('opens long provider metadata with MIME %s', async (mimeType, expectedMime) => {
+    providerTitle = 'Long report title '.repeat(20)
+    providerMime = mimeType
+    try {
+      const { receipt } = await executeReport({ linked: true })
+      const asset = await readMcpResultAsset.execute({
+        principal: session,
+        input: { chatId, id: receipt.id, index: 0 },
+      })
+      expect(asset.buffer.toString()).toBe('Remote resource bytes')
+      expect(asset.contentType).toBe(expectedMime)
+      expect(receipt.items[0].mimeType).toBe(expectedMime)
+    } finally {
+      providerMime = 'text/plain'
+      providerTitle = 'Quarterly report'
+    }
+  })
+
+  it('rejects trailing-dot loopback domains in provider App policies', async () => {
+    const { receipt } = await executeReport()
+    try {
+      for (const domain of [
+        'https://localhost.',
+        'https://sub.localhost.',
+        'https://*.localhost.',
+      ]) {
+        connectDomain = domain
+        await expect(
+          readMcpAppFrame.execute({ principal: session, input: { chatId, id: receipt.id } })
+        ).rejects.toThrow('local network addresses')
+      }
+    } finally {
+      connectDomain = 'https://allowed.test'
+    }
+  })
+
+  it('recovers resource reads after an upstream session or credential rejection', async () => {
+    const { receipt } = await executeReport()
+    try {
+      for (const status of [400, 401, 404]) {
+        rejectResourceStatus = status
+        const result = await readMcpAppResource.execute({
+          principal: session,
+          input: { chatId, id: receipt.id, uri: sourceUri },
+        })
+        expect(result.contents[0]).toMatchObject({ text: 'Remote resource bytes' })
+        expect(rejectResourceStatus).toBe(0)
+      }
+    } finally {
+      rejectResourceStatus = 0
+      rejectedSession = undefined
+    }
+  })
+
+  it('stops retrying when the provider continues to reject resource reads', async () => {
+    const { receipt } = await executeReport()
+    rejectResourceStatus = 404
+    rejectResourcesPersistently = true
+    const before = rejectedResourceReads
+    try {
+      await expect(
+        readMcpAppResource.execute({
+          principal: session,
+          input: { chatId, id: receipt.id, uri: sourceUri },
+        })
+      ).rejects.toThrow('Streamable HTTP error')
+      expect(rejectedResourceReads - before).toBe(2)
+    } finally {
+      rejectResourceStatus = 0
+      rejectResourcesPersistently = false
+      rejectedSession = undefined
+    }
+  })
+
+  it.each(['utf-8', 'utf-16le', 'utf-16be'] as const)(
+    'redacts %s credentials in saved files and live App responses',
+    async (charset) => {
+      encodedCredential = true
+      encodedCharset = charset
+      try {
+        const { receipt } = await executeReport()
+        const asset = await readMcpResultAsset.execute({
+          principal: session,
+          input: { chatId, id: receipt.id, index: 0 },
+        })
+        expect(
+          asset.buffer.includes(Buffer.from(encodeFixtureText(credentialCanary), 'base64'))
+        ).toBe(false)
+        expect(asset.buffer.toString()).toContain('Encoded report: ')
+        expect(asset.buffer.toString()).not.toContain(credentialCanary)
+        const saved = await readMcpResult.execute({
+          principal: session,
+          input: { chatId, id: receipt.id },
+        })
+        const savedResource = toRecord(toRecord(saved.result.content[0]).resource)
+        expectProtectedEncodedContent(savedResource.blob)
+        const live = await callMcpAppTool.execute({
+          principal: session,
+          input: { chatId, id: receipt.id, name: 'change_report' },
+        })
+        const liveResource = toRecord(toRecord(live.content[0]).resource)
+        expectProtectedEncodedContent(liveResource.blob)
+        const resource = await readMcpAppResource.execute({
+          principal: session,
+          input: { chatId, id: receipt.id, uri: sourceUri },
+        })
+        expectProtectedEncodedContent(toRecord(resource.contents[0]).blob)
+        const frame = await readMcpAppFrame.execute({
+          principal: session,
+          input: { chatId, id: receipt.id },
+        })
+        const encoded = frame.buffer.toString().match(/atob\('([^']+)'\)/)?.[1]
+        expectProtectedEncodedContent(encoded)
+      } finally {
+        reflectCredential = false
+        encodedCredential = false
+        encodedCharset = 'utf-8'
+      }
+    }
+  )
+
+  it('withholds protected bytes when an App declares an encoded binary file', async () => {
+    const { receipt } = await executeReport()
+    encodedCredential = true
+    encodedMimeType = 'application/octet-stream'
+    try {
+      await expect(
+        callMcpAppTool.execute({
+          principal: session,
+          input: { chatId, id: receipt.id, name: 'change_report' },
+        })
+      ).rejects.toThrow('MCP binary file contains protected content')
+    } finally {
+      encodedCredential = false
+      encodedMimeType = 'text/plain'
+    }
+  })
+
+  it('redacts resolved credential echoes from saved and live App data', async () => {
+    reflectCredential = true
+    try {
+      const { receipt } = await executeReport()
+      expect(receivedCredential).toBe(credentialCanary)
+      const reopened = await readMcpResult.execute({
+        principal: session,
+        input: { chatId, id: receipt.id },
+      })
+      expect(reopened.result._meta?.credential).not.toBe(credentialCanary)
+      expect(JSON.stringify(reopened)).not.toContain(credentialCanary)
+      const live = await callMcpAppTool.execute({
+        principal: session,
+        input: { chatId, id: receipt.id, name: 'change_report' },
+      })
+      expect(JSON.stringify(live)).not.toContain(credentialCanary)
+      const resource = await readMcpAppResource.execute({
+        principal: session,
+        input: { chatId, id: receipt.id, uri: sourceUri },
+      })
+      expect(JSON.stringify(resource)).not.toContain(credentialCanary)
+      const frame = await readMcpAppFrame.execute({
+        principal: session,
+        input: { chatId, id: receipt.id },
+      })
+      const encoded = frame.buffer.toString().match(/atob\('([^']+)'\)/)?.[1]
+      expect(encoded).toBeDefined()
+      expect(Buffer.from(encoded ?? '', 'base64').toString()).not.toContain(credentialCanary)
+    } finally {
+      reflectCredential = false
+    }
+  })
+})
diff --git a/apps/sim/lib/mcp/application/presentation.ts b/apps/sim/lib/mcp/application/presentation.ts
new file mode 100644
index 00000000000..98c6e56ab12
--- /dev/null
+++ b/apps/sim/lib/mcp/application/presentation.ts
@@ -0,0 +1,56 @@
+import type { ReadResourceResult } from '@modelcontextprotocol/sdk/types.js'
+import { createLogger } from '@sim/logger'
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { isJsonWithinByteLimit } from '@/lib/core/utils/bounded-json'
+import type { ExecuteMcpToolResult } from '@/lib/mcp/application/execute-tool'
+import { MCP_PRESENTATION_MAX_BYTES, MCP_PRESENTATION_MAX_ITEMS } from '@/lib/mcp/presentation'
+
+const logger = createLogger('McpPresentationSnapshot')
+
+/** Captures linked bytes within the authorized invocation before publishing its immutable result. */
+export async function createMcpToolPresentation(
+  presentation: NonNullable<ExecuteMcpToolResult['presentation']>,
+  readResource: (uri: string, signal: AbortSignal) => Promise<ReadResourceResult>,
+  signal?: AbortSignal
+): Promise<NonNullable<ExecuteMcpToolResult['presentation']>> {
+  try {
+    if (
+      presentation.result.content.length > MCP_PRESENTATION_MAX_ITEMS ||
+      !isJsonWithinByteLimit(presentation, MCP_PRESENTATION_MAX_BYTES)
+    )
+      throw new OrchestrationError('payload_too_large', 'MCP presentation exceeds its limits')
+    const resources: ReadResourceResult['contents'] = []
+    const deadline = AbortSignal.any([AbortSignal.timeout(30_000), ...(signal ? [signal] : [])])
+    for (const item of presentation.result.content) {
+      if (item.type !== 'resource_link' || resources.some((resource) => resource.uri === item.uri))
+        continue
+      try {
+        if (!item.uri || item.uri.length > 2048)
+          throw new OrchestrationError('validation', 'Invalid MCP resource URI')
+        deadline.throwIfAborted()
+        const result = await readResource(item.uri, deadline)
+        if (!isJsonWithinByteLimit(result, MCP_PRESENTATION_MAX_BYTES))
+          throw new OrchestrationError('payload_too_large', 'MCP resource exceeds 12 MiB')
+        const resource = result.contents.find((resource) => resource.uri === item.uri)
+        if (!resource) throw new OrchestrationError('not_found', 'MCP linked resource not found')
+        if (
+          !isJsonWithinByteLimit(
+            { ...presentation, resources: [...resources, resource] },
+            MCP_PRESENTATION_MAX_BYTES
+          )
+        )
+          throw new OrchestrationError('payload_too_large', 'MCP presentation exceeds 12 MiB')
+        resources.push(resource)
+      } catch {
+        signal?.throwIfAborted()
+        logger.warn('An MCP linked resource could not be captured')
+        if (deadline.aborted) break
+      }
+    }
+    return { ...presentation, resources }
+  } catch {
+    signal?.throwIfAborted()
+    logger.warn('MCP tool completed but its linked resources could not be captured')
+    return presentation
+  }
+}
diff --git a/apps/sim/lib/mcp/application/read-resource.ts b/apps/sim/lib/mcp/application/read-resource.ts
new file mode 100644
index 00000000000..9d5fc83bded
--- /dev/null
+++ b/apps/sim/lib/mcp/application/read-resource.ts
@@ -0,0 +1,141 @@
+import { AuditAction, AuditResourceType } from '@sim/audit'
+import { defineAuthorizedWorkspaceUseCase } from '@/lib/core/application'
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { requireCredentialGroupCredentialAccess } from '@/lib/credential-groups/application/authorization'
+import { discoverManagedMcpToolsUseCase } from '@/lib/credentials/application/discover-managed-mcp-tools'
+import { credentialOperations } from '@/lib/credentials/application/operations'
+import {
+  loadManagedMcpCredentialApplicationContext,
+  loadManagedMcpRuntimeCredential,
+} from '@/lib/credentials/managed-mcp'
+import { resolveMcpServerContext } from '@/lib/mcp/application/context'
+import { loadManagedMcpAuthProvider } from '@/lib/mcp/application/managed-auth-provider'
+import { mcpServerOperations } from '@/lib/mcp/application/operations'
+import { discoverMcpServerToolsUseCase } from '@/lib/mcp/application/use-cases'
+import { getMcpAppResourceUri } from '@/lib/mcp/presentation-metadata'
+import { mcpService } from '@/lib/mcp/service'
+import type { McpTool } from '@/lib/mcp/types'
+import { assertWorkspaceCapability } from '@/lib/permission-groups/capability-assertions'
+import type { ResolvedSecretTraceProvenanceV1 } from '@/executor/utils/resolved-secret-trace-registry'
+
+interface ReadMcpResourceInput {
+  workspaceId: string
+  connectionId: string
+  toolName: string
+  uri: string
+  appUri?: string
+  onResolvedSecretTraceProvenance?: (provenance: ResolvedSecretTraceProvenanceV1) => void
+  signal?: AbortSignal
+}
+
+function requireOriginTool(tools: McpTool[], input: ReadMcpResourceInput) {
+  const tool = tools.find((candidate) => candidate.name === input.toolName)
+  if (!tool || (input.appUri !== undefined && getMcpAppResourceUri(tool) !== input.appUri))
+    throw new OrchestrationError(
+      'forbidden',
+      'The originating MCP operation is no longer available'
+    )
+  if (!input.uri || input.uri.length > 2048)
+    throw new OrchestrationError('validation', 'Invalid MCP resource URI')
+  return tool
+}
+
+/** Resource reads share current connection authorization with tool execution. */
+export const readMcpResource = defineAuthorizedWorkspaceUseCase({
+  operation: mcpServerOperations.readResource,
+  authorizationOptions: {},
+  resolveContext: ({ input }: { input: ReadMcpResourceInput }) =>
+    resolveMcpServerContext(input.workspaceId, input.connectionId),
+  async execute({ principal, input, context }) {
+    const { tools } = await discoverMcpServerToolsUseCase.execute({
+      principal,
+      input: {
+        workspaceId: context.workspaceId,
+        serverId: context.server.id,
+        requireComplete: true,
+        signal: input.signal,
+      },
+    })
+    requireOriginTool(tools, input)
+    const current = await resolveMcpServerContext(context.workspaceId, context.server.id)
+    if (!current.server.enabled || current.server.credentialGroupId)
+      throw new OrchestrationError('forbidden', 'MCP server is unavailable')
+    return mcpService.readResource({
+      serverId: context.server.id,
+      workspaceId: context.workspaceId,
+      userId: principal.userId,
+      uri: input.uri,
+      includeListingMetadata: input.appUri === input.uri,
+      onResolvedSecretTraceProvenance: input.onResolvedSecretTraceProvenance,
+      signal: input.signal,
+    })
+  },
+})
+
+export const readManagedMcpResource = defineAuthorizedWorkspaceUseCase({
+  operation: credentialOperations.readManagedMcpResource,
+  authorizationOptions: {},
+  resolveContext: async ({ input }: { input: ReadMcpResourceInput }) => {
+    const context = await loadManagedMcpCredentialApplicationContext(
+      input.connectionId,
+      input.workspaceId
+    )
+    if (!context || context.workspaceId !== input.workspaceId)
+      throw new OrchestrationError('not_found', 'Managed MCP connection not found')
+    return context
+  },
+  async authorizeResource({ principal, context, resourcePolicy }) {
+    await assertWorkspaceCapability(
+      principal.userId,
+      context.workspaceId,
+      'integrations.manage',
+      context.workspaceOrganizationId
+    )
+    await requireCredentialGroupCredentialAccess(principal, context, resourcePolicy)
+  },
+  async execute({ principal, input, context }) {
+    const before = await loadManagedMcpRuntimeCredential(context.credentialId, context.workspaceId)
+    const { tools } = await discoverManagedMcpToolsUseCase.execute({
+      principal,
+      input: {
+        workspaceId: context.workspaceId,
+        credentialId: context.credentialId,
+        signal: input.signal,
+        onResolvedSecretTraceProvenance: input.onResolvedSecretTraceProvenance,
+      },
+    })
+    requireOriginTool(tools, input)
+    const current = await loadManagedMcpRuntimeCredential(context.credentialId, context.workspaceId)
+    if (
+      current.mcpServerId !== before.mcpServerId ||
+      current.oauthConfigVersion !== before.oauthConfigVersion ||
+      current.grantedAt.getTime() !== before.grantedAt.getTime()
+    )
+      throw new OrchestrationError('forbidden', 'Managed MCP credential changed during discovery')
+    await requireCredentialGroupCredentialAccess(
+      principal,
+      context,
+      credentialOperations.readManagedMcpResource.resourcePolicy
+    )
+    return mcpService.readResource({
+      serverId: current.mcpServerId,
+      workspaceId: context.workspaceId,
+      userId: principal.userId,
+      uri: input.uri,
+      includeListingMetadata: input.appUri === input.uri,
+      onResolvedSecretTraceProvenance: input.onResolvedSecretTraceProvenance,
+      signal: input.signal,
+      managed: {
+        connectionId: context.credentialId,
+        scope: current.scope,
+        loadAuthProvider: () =>
+          loadManagedMcpAuthProvider(context.credentialId, context.workspaceId),
+      },
+    })
+  },
+  projectAudit: ({ context }) => ({
+    action: AuditAction.CREDENTIAL_ACCESSED,
+    resourceType: AuditResourceType.CREDENTIAL,
+    resourceId: context.credentialId,
+  }),
+})
diff --git a/apps/sim/lib/mcp/client.ts b/apps/sim/lib/mcp/client.ts
index bcfe4a5072d..8a252840d40 100644
--- a/apps/sim/lib/mcp/client.ts
+++ b/apps/sim/lib/mcp/client.ts
@@ -1,16 +1,22 @@
 import { UnauthorizedError } from '@modelcontextprotocol/sdk/client/auth.js'
 import { Client } from '@modelcontextprotocol/sdk/client/index.js'
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
+import type { OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js'
 import {
+  ErrorCode,
   LATEST_PROTOCOL_VERSION,
   type ListToolsResult,
+  type ReadResourceResult,
+  McpError as SdkMcpError,
   SUPPORTED_PROTOCOL_VERSIONS,
   ToolListChangedNotificationSchema,
 } from '@modelcontextprotocol/sdk/types.js'
 import { createLogger } from '@sim/logger'
 import { isPrivateIp } from '@sim/security/ssrf'
 import { getErrorMessage } from '@sim/utils/errors'
+import { isPlainRecord } from '@sim/utils/object'
 import { getMaxExecutionTimeout } from '@/lib/core/execution-limits'
+import { encryptSecret } from '@/lib/core/security/encryption'
 import { getMcpSafeErrorDiagnostics } from '@/lib/mcp/error-diagnostics'
 import { McpOauthRedirectRequired } from '@/lib/mcp/oauth'
 import {
@@ -36,6 +42,7 @@ import {
 } from '@/lib/mcp/types'
 import { MCP_CLIENT_CONSTANTS } from '@/lib/mcp/utils'
 import { createEnvVarPattern } from '@/executor/utils/reference-validation'
+import { ResolvedSecretTraceProvenanceAccumulator } from '@/executor/utils/resolved-secret-trace-registry'
 
 const logger = createLogger('McpClient')
 
@@ -88,7 +95,12 @@ export class McpClient {
   private authProvider?: McpClientOptions['authProvider']
   private isConnected = false
   private closeGuardedTransport?: () => Promise<void>
-  private readonly resolvedSecretTraceProvenance?: McpClientOptions['resolvedSecretTraceProvenance']
+  private readonly resolvedSecrets?: ResolvedSecretTraceProvenanceAccumulator
+  private lastOauthTokens?: {
+    accessToken: string
+    refreshToken?: string
+    registration: Promise<void>
+  }
 
   constructor(options: McpClientOptions) {
     this.config = options.config
@@ -99,7 +111,12 @@ export class McpClient {
     }
     this.onToolsChanged = options.onToolsChanged
     this.authProvider = options.authProvider
-    this.resolvedSecretTraceProvenance = options.resolvedSecretTraceProvenance
+    if (options.resolvedSecretTraceProvenance) {
+      this.resolvedSecrets = new ResolvedSecretTraceProvenanceAccumulator(
+        options.resolvedSecretTraceProvenance.scope
+      )
+      this.resolvedSecrets.record(options.resolvedSecretTraceProvenance)
+    }
     const resolvedIP = options.resolvedIP
 
     this.connectionStatus = { connected: false }
@@ -140,6 +157,7 @@ export class McpClient {
         ? createCoordinatedMcpOauthFetch(options.oauthCredentials, {
             serverUrl: this.config.url,
             fetch: oauthFetch,
+            onTokens: this.resolvedSecrets ? (tokens) => this.recordOauthTokens(tokens) : undefined,
           })
         : (oauthFetch ?? guarded.fetch)
     this.transport = new StreamableHTTPClientTransport(new URL(this.config.url), {
@@ -154,7 +172,11 @@ export class McpClient {
         version: '1.0.0',
       },
       {
-        capabilities: {},
+        capabilities: {
+          extensions: {
+            'io.modelcontextprotocol/ui': { mimeTypes: ['text/html;profile=mcp-app'] },
+          },
+        },
       }
     )
 
@@ -169,9 +191,37 @@ export class McpClient {
   }
 
   getResolvedSecretTraceProvenance(): McpClientOptions['resolvedSecretTraceProvenance'] {
-    return this.resolvedSecretTraceProvenance
-      ? structuredClone(this.resolvedSecretTraceProvenance)
-      : undefined
+    return this.resolvedSecrets?.exportProvenance()
+  }
+
+  private async recordOauthTokens(tokens: OAuthTokens): Promise<void> {
+    if (
+      this.lastOauthTokens?.accessToken === tokens.access_token &&
+      this.lastOauthTokens.refreshToken === tokens.refresh_token
+    ) {
+      await this.lastOauthTokens.registration
+      return
+    }
+    const registry = this.resolvedSecrets
+    const registration = (async () => {
+      const entries = await Promise.all(
+        [tokens.access_token, tokens.refresh_token]
+          .filter((value): value is string => typeof value === 'string' && value.length > 0)
+          .map(async (value) => ({ encryptedValue: (await encryptSecret(value)).encrypted }))
+      )
+      registry?.record({
+        version: 1,
+        complete: true,
+        scope: registry.exportProvenance().scope,
+        entries,
+      })
+    })()
+    this.lastOauthTokens = {
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token,
+      registration,
+    }
+    await registration
   }
 
   /**
@@ -379,8 +429,7 @@ export class McpClient {
             break
           }
           tools.push({
-            name: tool.name,
-            description: tool.description,
+            ...tool,
             inputSchema: tool.inputSchema as McpTool['inputSchema'],
             serverId: this.config.id,
             serverName: this.config.name,
@@ -492,6 +541,57 @@ export class McpClient {
     }
   }
 
+  async readResource(
+    uri: string,
+    options: McpToolCallOptions & { includeListingMetadata?: boolean } = {}
+  ): Promise<ReadResourceResult> {
+    if (!this.isConnected) throw new McpConnectionError('Not connected to server', this.config.name)
+    const consent = await this.requestConsent({
+      type: 'resource_access',
+      context: { serverId: this.config.id, serverName: this.config.name, action: uri },
+      expires: Date.now() + 5 * 60 * 1000,
+    })
+    if (!consent.granted) throw new McpError('User consent denied for resource access', -32000)
+    const timeout = options.timeoutMs ?? getMaxExecutionTimeout()
+    const signal = AbortSignal.any([
+      AbortSignal.timeout(timeout),
+      ...(options.signal ? [options.signal] : []),
+    ])
+    const requestOptions = { signal, timeout }
+    const result = await this.client.readResource({ uri }, requestOptions)
+    if (!options.includeListingMetadata) return result
+    const content = result.contents.find((item) => item.uri === uri)
+    const readUi = content?._meta?.ui
+    if (!content || (isPlainRecord(readUi) && readUi.csp !== undefined)) return result
+    let cursor: string | undefined
+    const seen = new Set<string>()
+    for (let page = 0; page < 20; page++) {
+      options.signal?.throwIfAborted()
+      let listing
+      try {
+        listing = await this.client.listResources({ cursor }, requestOptions)
+      } catch (error) {
+        if (error instanceof SdkMcpError && error.code === ErrorCode.MethodNotFound) return result
+        throw error
+      }
+      const resource = listing.resources.find((item) => item.uri === uri)
+      if (resource) {
+        const listedUi = resource._meta?.ui
+        if (isPlainRecord(listedUi))
+          content._meta = {
+            ...resource._meta,
+            ...content._meta,
+            ui: { ...listedUi, ...(isPlainRecord(readUi) ? readUi : {}) },
+          }
+        return result
+      }
+      cursor = listing.nextCursor
+      if (!cursor || seen.has(cursor)) return result
+      seen.add(cursor)
+    }
+    throw new McpError('MCP resource discovery exceeds the page limit', -32000)
+  }
+
   async ping(timeoutMs?: number): Promise<{ _meta?: Record<string, any> }> {
     if (!this.isConnected) {
       throw new McpConnectionError('Not connected to server', this.config.name)
diff --git a/apps/sim/lib/mcp/encoded-content.ts b/apps/sim/lib/mcp/encoded-content.ts
new file mode 100644
index 00000000000..b1c5ad8225f
--- /dev/null
+++ b/apps/sim/lib/mcp/encoded-content.ts
@@ -0,0 +1,119 @@
+import { MIMEType } from 'node:util'
+import type { CallToolResult, ReadResourceResult } from '@modelcontextprotocol/sdk/types.js'
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { isJsonWithinByteLimit } from '@/lib/core/utils/bounded-json'
+import { MCP_PRESENTATION_MAX_BYTES } from '@/lib/mcp/presentation'
+import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
+import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+
+type McpContentResult = Pick<CallToolResult, 'content'> | Pick<ReadResourceResult, 'contents'>
+
+/** Checks decoded provider bytes before an encoded resource crosses into a saved or live App. */
+export function projectMcpEncodedContents<T extends McpContentResult>(
+  value: T,
+  registry: ResolvedSecretTraceRegistry | undefined,
+  rejectedFiles: 'error' | 'omit' = 'error'
+): T {
+  if (!isJsonWithinByteLimit(value, MCP_PRESENTATION_MAX_BYTES))
+    throw new OrchestrationError('payload_too_large', 'MCP result exceeds 12 MiB')
+  const projectFile = (encoded: string, mimeType?: string) => {
+    const bytes = decodeMcpBase64(encoded)
+    let mime: MIMEType | undefined
+    try {
+      mime = mimeType ? new MIMEType(mimeType) : undefined
+    } catch {
+      throw new OrchestrationError('validation', 'MCP file has an invalid MIME type')
+    }
+    const textual =
+      mime?.type === 'text' ||
+      ['application/json', 'application/xml', 'application/javascript'].includes(
+        mime?.essence ?? ''
+      ) ||
+      mime?.subtype.endsWith('+json') ||
+      mime?.subtype.endsWith('+xml')
+    let text = bytes.toString('utf8')
+    if (textual) {
+      const bomEncoding =
+        bytes[0] === 0xff && bytes[1] === 0xfe
+          ? 'utf-16le'
+          : bytes[0] === 0xfe && bytes[1] === 0xff
+            ? 'utf-16be'
+            : 'utf-8'
+      try {
+        text = new TextDecoder(mime?.params.get('charset') ?? bomEncoding, { fatal: true }).decode(
+          bytes
+        )
+      } catch {
+        throw new OrchestrationError(
+          'validation',
+          'MCP text file has an unsupported or invalid encoding'
+        )
+      }
+    }
+    const projection = projectResolvedSecretModelContent(text, registry, MCP_PRESENTATION_MAX_BYTES)
+    if (!projection.safe || typeof projection.value !== 'string')
+      throw new OrchestrationError('forbidden', 'MCP file could not be displayed safely')
+    if (!textual) {
+      if (projection.value !== text)
+        throw new OrchestrationError('forbidden', 'MCP binary file contains protected content')
+      return { encoded, mimeType }
+    }
+    mime?.params.delete('charset')
+    return { encoded: Buffer.from(projection.value).toString('base64'), mimeType: mime?.toString() }
+  }
+  const project = (encoded: string, mimeType?: string) => {
+    try {
+      return projectFile(encoded, mimeType)
+    } catch (error) {
+      if (
+        rejectedFiles === 'omit' &&
+        error instanceof OrchestrationError &&
+        (error.code === 'validation' || error.code === 'forbidden')
+      )
+        return undefined
+      throw error
+    }
+  }
+  if ('contents' in value)
+    return {
+      ...value,
+      contents: value.contents.flatMap<ReadResourceResult['contents'][number]>((resource) => {
+        if (!('blob' in resource)) return [resource]
+        const projected = project(resource.blob, resource.mimeType)
+        return projected
+          ? [{ ...resource, blob: projected.encoded, mimeType: projected.mimeType }]
+          : []
+      }),
+    }
+  return {
+    ...value,
+    content: value.content.map((item) => {
+      if (item.type === 'image' || item.type === 'audio') {
+        const projected = project(item.data, item.mimeType)
+        if (!projected)
+          return { type: 'text' as const, text: 'MCP file output could not be displayed.' }
+        return { ...item, data: projected.encoded, mimeType: projected.mimeType ?? item.mimeType }
+      }
+      if (item.type === 'resource' && 'blob' in item.resource) {
+        const projected = project(item.resource.blob, item.resource.mimeType)
+        if (!projected)
+          return { type: 'text' as const, text: 'MCP file output could not be displayed.' }
+        return {
+          ...item,
+          resource: { ...item.resource, blob: projected.encoded, mimeType: projected.mimeType },
+        }
+      }
+      return item
+    }),
+  }
+}
+
+/** Decodes canonical bounded MCP file bytes for publication and historical asset reads. */
+export function decodeMcpBase64(value: string): Buffer {
+  if (value.length > MCP_PRESENTATION_MAX_BYTES || value.length % 4 !== 0)
+    throw new OrchestrationError('validation', 'Invalid MCP file encoding')
+  const buffer = Buffer.from(value, 'base64')
+  if (buffer.toString('base64') !== value)
+    throw new OrchestrationError('validation', 'Invalid MCP file encoding')
+  return buffer
+}
diff --git a/apps/sim/lib/mcp/oauth/coordinated-fetch.ts b/apps/sim/lib/mcp/oauth/coordinated-fetch.ts
index 62570405aa6..b32a7916c05 100644
--- a/apps/sim/lib/mcp/oauth/coordinated-fetch.ts
+++ b/apps/sim/lib/mcp/oauth/coordinated-fetch.ts
@@ -3,6 +3,7 @@ import {
   type OAuthClientProvider,
   UnauthorizedError,
 } from '@modelcontextprotocol/sdk/client/auth.js'
+import type { OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js'
 import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js'
 import { mcpAuthGuarded } from '@/lib/mcp/oauth/auth'
 import { withMcpOauthRefreshLock } from '@/lib/mcp/oauth/storage'
@@ -44,7 +45,11 @@ export function createMcpEndpointFetch(
  */
 export function createCoordinatedMcpOauthFetch(
   { credentialId, loadProvider, initialProvider }: McpOauthSession,
-  options: { serverUrl: string; fetch: FetchLike }
+  options: {
+    serverUrl: string
+    fetch: FetchLike
+    onTokens?: (tokens: OAuthTokens) => Promise<void>
+  }
 ): FetchLike {
   const serverUrl = new URL(options.serverUrl)
   let currentProvider = initialProvider
@@ -61,6 +66,7 @@ export function createCoordinatedMcpOauthFetch(
     for (let attempt = 0; ; attempt++) {
       init?.signal?.throwIfAborted()
       const tokens = await provider.tokens()
+      if (tokens) await options.onTokens?.(tokens)
       const headers = new Headers(init?.headers)
       if (tokens && !headers.has('authorization')) {
         headers.set('authorization', `Bearer ${tokens.access_token}`)
diff --git a/apps/sim/lib/mcp/presentation-lifecycle.ts b/apps/sim/lib/mcp/presentation-lifecycle.ts
new file mode 100644
index 00000000000..271e9c2b406
--- /dev/null
+++ b/apps/sim/lib/mcp/presentation-lifecycle.ts
@@ -0,0 +1,65 @@
+import { createHash } from 'node:crypto'
+import { isPlainRecord } from '@sim/utils/object'
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { compactMcpPresentation, MCP_PRESENTATION_MAX_BYTES } from '@/lib/mcp/presentation'
+import { mcpPresentationKey } from '@/lib/mcp/presentation-storage'
+import type { ChatBlobCopyTask } from '@/lib/mothership/chat/fork-chat-files'
+
+function presentationIds(message: unknown, includeUnpublished: boolean): string[] {
+  if (
+    !isPlainRecord(message) ||
+    message.role !== 'assistant' ||
+    !Array.isArray(message.contentBlocks)
+  )
+    return []
+  const ids = new Set<string>()
+  for (const block of message.contentBlocks) {
+    if (!isPlainRecord(block) || !isPlainRecord(block.toolCall)) continue
+    const call = block.toolCall
+    const receipt = isPlainRecord(call.result)
+      ? compactMcpPresentation(call.result.output)
+      : undefined
+    if (receipt) ids.add(receipt.mcpPresentation.id)
+    else if (
+      includeUnpublished &&
+      typeof call.name === 'string' &&
+      (call.name === 'mcp_run_operation' || call.name.startsWith('mcp-')) &&
+      typeof call.id === 'string' &&
+      call.id.length > 0 &&
+      call.id.length <= 256
+    )
+      ids.add(createHash('sha256').update(call.id).digest('hex'))
+  }
+  return [...ids]
+}
+
+/** Keys always derive from the row's canonical chat, never a client-supplied storage address. */
+export function mcpPresentationCleanupKeys(chatId: string, message: unknown): string[] {
+  return presentationIds(message, true).map((id) => mcpPresentationKey(chatId, id))
+}
+
+export function planForkMcpPresentations(
+  messages: readonly unknown[],
+  sourceChatId: string,
+  newChatId: string
+): ChatBlobCopyTask[] {
+  const ids = new Set(messages.flatMap((message) => presentationIds(message, false)))
+  if (ids.size > 100)
+    throw new OrchestrationError(
+      'payload_too_large',
+      'A chat fork can copy at most 100 MCP results'
+    )
+  return [...ids].map((id) => {
+    const sourceKey = mcpPresentationKey(sourceChatId, id)
+    return {
+      copyId: sourceKey,
+      sourceKey,
+      targetKey: mcpPresentationKey(newChatId, id),
+      context: 'mothership',
+      fileName: 'mcp-result.json',
+      contentType: 'application/json',
+      maxBytes: MCP_PRESENTATION_MAX_BYTES,
+      persistMetadata: false,
+    }
+  })
+}
diff --git a/apps/sim/lib/mcp/presentation-metadata.ts b/apps/sim/lib/mcp/presentation-metadata.ts
new file mode 100644
index 00000000000..dd5c3ebad18
--- /dev/null
+++ b/apps/sim/lib/mcp/presentation-metadata.ts
@@ -0,0 +1,48 @@
+import type { ManagedMcpToolSnapshot } from '@sim/db/schema'
+import { isPlainRecord } from '@sim/utils/object'
+import type { McpTool } from '@/lib/mcp/types'
+
+/** Protocol metadata stays intact when discovery is saved for a managed connection. */
+export function snapshotMcpTool(tool: McpTool): ManagedMcpToolSnapshot {
+  return {
+    name: tool.name,
+    inputSchema: tool.inputSchema,
+    ...(tool.title !== undefined ? { title: tool.title } : {}),
+    ...(tool.description !== undefined ? { description: tool.description } : {}),
+    ...(tool.annotations !== undefined ? { annotations: tool.annotations } : {}),
+    ...(tool._meta !== undefined ? { _meta: tool._meta } : {}),
+    ...(tool.icons !== undefined ? { icons: tool.icons } : {}),
+    ...(tool.outputSchema !== undefined ? { outputSchema: tool.outputSchema } : {}),
+  }
+}
+
+/** Malformed visibility metadata never expands a tool's audience. */
+export function isMcpToolVisible(tool: Pick<McpTool, '_meta'>, audience: 'model' | 'app'): boolean {
+  const ui = tool._meta?.ui
+  if (!isPlainRecord(ui) || ui.visibility === undefined) return true
+  return (
+    Array.isArray(ui.visibility) &&
+    ui.visibility.every((value) => value === 'model' || value === 'app') &&
+    ui.visibility.includes(audience)
+  )
+}
+
+export function getMcpAppResourceUri(tool: Pick<McpTool, '_meta'>): string | undefined {
+  const ui = tool._meta?.ui
+  const nested = isPlainRecord(ui) ? ui.resourceUri : undefined
+  const uri = nested === undefined ? tool._meta?.['ui/resourceUri'] : nested
+  return typeof uri === 'string' && uri.startsWith('ui://') && uri.length <= 2048 ? uri : undefined
+}
+
+/** A session App may only reuse the connection and UI template that created its snapshot. */
+export function matchesMcpAppOrigin(
+  tools: McpTool[],
+  origin: { toolName: string; resourceUri: string } | undefined
+): boolean {
+  return (
+    !!origin &&
+    tools.some(
+      (tool) => tool.name === origin.toolName && getMcpAppResourceUri(tool) === origin.resourceUri
+    )
+  )
+}
diff --git a/apps/sim/lib/mcp/presentation-storage.ts b/apps/sim/lib/mcp/presentation-storage.ts
new file mode 100644
index 00000000000..88727d73b75
--- /dev/null
+++ b/apps/sim/lib/mcp/presentation-storage.ts
@@ -0,0 +1,170 @@
+import { createHash } from 'node:crypto'
+import { MIMEType } from 'node:util'
+import {
+  CallToolResultSchema,
+  type ReadResourceResult,
+  ReadResourceResultSchema,
+} from '@modelcontextprotocol/sdk/types.js'
+import { truncateAtCodePoint } from '@sim/utils/string'
+import { z } from 'zod'
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { isJsonWithinByteLimit } from '@/lib/core/utils/bounded-json'
+import type { DurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
+import {
+  MCP_PRESENTATION_MAX_BYTES,
+  MCP_PRESENTATION_MAX_ITEMS,
+  MCP_PRESENTATION_PREFIX,
+  mcpPresentationIdSchema,
+  mcpPresentationReceiptSchema,
+} from '@/lib/mcp/presentation'
+import { getMcpAppResourceUri } from '@/lib/mcp/presentation-metadata'
+import type { McpTool, McpToolResult } from '@/lib/mcp/types'
+import { inlineImageRequestIdSchema } from '@/lib/mothership/chat/inline-image-reference'
+import { isObjectNotFoundError } from '@/lib/uploads/core/errors'
+import { downloadFile, uploadFile } from '@/lib/uploads/core/storage-service'
+
+const manifestSchema = z.object({
+  version: z.literal(1),
+  workspaceId: z.string().min(1).max(128),
+  connectionId: z.string().min(1).max(256),
+  toolName: z.string().min(1).max(256),
+  appUri: z.string().max(2048).optional(),
+  arguments: z.record(z.string(), z.unknown()),
+  result: CallToolResultSchema,
+  resources: ReadResourceResultSchema.shape.contents.default([]),
+  receipt: mcpPresentationReceiptSchema,
+  secretProvenance: z.unknown(),
+})
+export type McpPresentationManifest = z.output<typeof manifestSchema>
+
+export function mcpPresentationKey(chatId: string, id: string): string {
+  inlineImageRequestIdSchema.parse(chatId)
+  mcpPresentationIdSchema.parse(id)
+  return `${MCP_PRESENTATION_PREFIX}${chatId}/${id}.json`
+}
+
+/** One bounded immutable object keeps media, App data, and their source binding atomic. */
+export async function storeMcpPresentation(input: {
+  chatId: string
+  workspaceId: string
+  connectionId: string
+  toolCallId: string
+  tool: Pick<McpTool, 'name' | 'title' | '_meta'>
+  arguments: Record<string, unknown>
+  result: McpToolResult
+  resources?: ReadResourceResult['contents']
+  secretProvenance: DurableSecretProvenance
+  signal?: AbortSignal
+}) {
+  if (!input.toolCallId || input.toolCallId.length > 256)
+    throw new OrchestrationError('validation', 'Invalid MCP invocation identity')
+  if (input.result.content.length > MCP_PRESENTATION_MAX_ITEMS)
+    throw new OrchestrationError('payload_too_large', 'MCP presentation has too many items')
+  const digest = (value: string) => createHash('sha256').update(value).digest('hex')
+  const id = digest(input.toolCallId)
+  const appUri = getMcpAppResourceUri(input.tool)
+  const title = truncateAtCodePoint(input.tool.title || input.tool.name, 197)
+  const items = input.result.content.flatMap((item, index) => {
+    if (item.type === 'text') return []
+    const resource =
+      item.type === 'resource' ? item.resource : item.type === 'resource_link' ? item : undefined
+    const snapshot =
+      item.type === 'resource_link'
+        ? input.resources?.find((resource) => resource.uri === item.uri)
+        : undefined
+    if (item.type === 'resource_link' && !snapshot) return []
+    const declaredMimeType =
+      item.type === 'image' || item.type === 'audio'
+        ? item.mimeType
+        : snapshot?.mimeType || resource?.mimeType || 'application/octet-stream'
+    let mimeType = 'application/octet-stream'
+    try {
+      const essence = new MIMEType(declaredMimeType).essence
+      if (essence.length <= 128) mimeType = essence
+    } catch {}
+    const identity = resource
+      ? digest(`${input.workspaceId}:${input.connectionId}:${resource.uri}`)
+      : `${id}:${index}`
+    return [
+      {
+        index,
+        identity,
+        title: truncateAtCodePoint(
+          item.type === 'resource_link' ? item.title || item.name : `${title} ${index + 1}`,
+          197
+        ),
+        mimeType,
+        kind: ['image/png', 'image/jpeg', 'image/webp', 'image/gif'].includes(mimeType)
+          ? ('image' as const)
+          : mimeType.startsWith('audio/')
+            ? ('audio' as const)
+            : ('file' as const),
+      },
+    ]
+  })
+  if (!items.length && !appUri) return undefined
+  const candidate = {
+    version: 1,
+    workspaceId: input.workspaceId,
+    connectionId: input.connectionId,
+    toolName: input.tool.name,
+    appUri,
+    arguments: input.arguments,
+    result: input.result,
+    resources: input.resources ?? [],
+    secretProvenance: input.secretProvenance,
+    receipt: { id, title, hasApp: !!appUri, items },
+  }
+  if (!isJsonWithinByteLimit(candidate, MCP_PRESENTATION_MAX_BYTES))
+    throw new OrchestrationError('payload_too_large', 'MCP presentation exceeds 12 MiB')
+  const manifest = manifestSchema.parse(candidate)
+  const buffer = Buffer.from(JSON.stringify(manifest))
+  if (buffer.length > MCP_PRESENTATION_MAX_BYTES)
+    throw new OrchestrationError('payload_too_large', 'MCP presentation exceeds 12 MiB')
+  try {
+    await uploadFile({
+      file: buffer,
+      fileName: 'mcp-result.json',
+      contentType: 'application/json',
+      context: 'mothership',
+      customKey: mcpPresentationKey(input.chatId, id),
+      preserveKey: true,
+      persistMetadata: false,
+      createOnly: true,
+      signal: input.signal,
+    })
+  } catch (error) {
+    input.signal?.throwIfAborted()
+    try {
+      return (await loadMcpPresentation(input.chatId, id, input.signal)).receipt
+    } catch {
+      throw error
+    }
+  }
+  return manifest.receipt
+}
+
+export async function loadMcpPresentation(
+  chatId: string,
+  id: string,
+  signal?: AbortSignal
+): Promise<McpPresentationManifest> {
+  try {
+    const buffer = await downloadFile({
+      key: mcpPresentationKey(chatId, id),
+      context: 'mothership',
+      maxBytes: MCP_PRESENTATION_MAX_BYTES,
+      signal,
+    })
+    const manifest = manifestSchema.parse(JSON.parse(buffer.toString('utf8')))
+    if (manifest.receipt.id !== id) throw new Error('MCP presentation identity mismatch')
+    return manifest
+  } catch (error) {
+    if (
+      isObjectNotFoundError(error) ||
+      (error instanceof Error && 'code' in error && error.code === 'ENOENT')
+    )
+      throw new OrchestrationError('not_found', 'MCP result not found')
+    throw error
+  }
+}
diff --git a/apps/sim/lib/mcp/presentation.ts b/apps/sim/lib/mcp/presentation.ts
new file mode 100644
index 00000000000..f9c4dcfbcba
--- /dev/null
+++ b/apps/sim/lib/mcp/presentation.ts
@@ -0,0 +1,41 @@
+import { isPlainRecord } from '@sim/utils/object'
+import { z } from 'zod'
+
+export const MCP_PRESENTATION_PREFIX = 'chat-mcp/'
+export const MCP_PRESENTATION_MAX_BYTES = 12 * 1024 * 1024
+export const MCP_PRESENTATION_MAX_ITEMS = 16
+export const mcpPresentationIdSchema = z.string().regex(/^[a-f0-9]{64}$/)
+export const mcpPresentationReceiptSchema = z.object({
+  id: mcpPresentationIdSchema,
+  title: z.string().min(1).max(200),
+  hasApp: z.boolean(),
+  items: z
+    .array(
+      z.object({
+        index: z
+          .number()
+          .int()
+          .min(0)
+          .max(MCP_PRESENTATION_MAX_ITEMS - 1),
+        identity: z.string().max(2048),
+        title: z.string().max(200),
+        mimeType: z.string().max(128),
+        kind: z.enum(['image', 'audio', 'file', 'resource']),
+      })
+    )
+    .max(MCP_PRESENTATION_MAX_ITEMS),
+})
+export type McpPresentationReceipt = z.output<typeof mcpPresentationReceiptSchema>
+
+/** Persist display addresses only; their private manifest is the authority for every action. */
+export function compactMcpPresentation(
+  output: unknown
+): { mcpPresentation: McpPresentationReceipt } | undefined {
+  if (!isPlainRecord(output)) return undefined
+  const parsed = mcpPresentationReceiptSchema.safeParse(output.mcpPresentation)
+  return parsed.success ? { mcpPresentation: parsed.data } : undefined
+}
+
+export function mcpPresentationAssetUrl(chatId: string, id: string, index: number): string {
+  return `/api/mothership/chats/${encodeURIComponent(chatId)}/mcp-results/${encodeURIComponent(id)}/assets/${index}`
+}
diff --git a/apps/sim/lib/mcp/service.ts b/apps/sim/lib/mcp/service.ts
index 1826df7318f..633972248c9 100644
--- a/apps/sim/lib/mcp/service.ts
+++ b/apps/sim/lib/mcp/service.ts
@@ -461,7 +461,8 @@ class McpService {
   private async createManagedOauthClient(
     config: McpServerConfig,
     auth: OAuthClientProvider | McpOauthCredentials,
-    signal?: AbortSignal
+    signal?: AbortSignal,
+    provenanceScope?: { userId: string; workspaceId: string }
   ): Promise<McpClient> {
     if (config.authType !== 'oauth' || !config.url) {
       throw new Error('Managed MCP connection requires an OAuth HTTP server')
@@ -477,6 +478,9 @@ class McpService {
     const resolvedIP = await validateMcpServerSsrf(config.url)
     const client = new McpClient({
       config,
+      resolvedSecretTraceProvenance: provenanceScope
+        ? { version: 1, complete: true, entries: [], scope: provenanceScope }
+        : undefined,
       securityPolicy: {
         requireConsent: true,
         auditLevel: 'basic',
@@ -498,7 +502,7 @@ class McpService {
     scope: ResourceScope,
     auth: McpOauthCredentials,
     signal: AbortSignal
-  ): Promise<Pick<McpClient, 'listTools' | 'callTool' | 'disconnect'>> {
+  ): Promise<Pick<McpClient, 'listTools' | 'callTool' | 'readResource' | 'disconnect'>> {
     const config = await this.getServerConfig(serverId, scope)
     if (!config) throw new Error('Managed MCP server is unavailable')
     return this.createManagedOauthClient(config, auth, signal)
@@ -509,21 +513,37 @@ class McpService {
     scope: string | ResourceScope,
     auth: OAuthClientProvider | McpOauthCredentials,
     signal?: AbortSignal,
-    options: { requireComplete?: boolean } = {}
+    options: {
+      requireComplete?: boolean
+      provenanceScope?: { userId: string; workspaceId: string }
+      onResolvedSecretTraceProvenance?: ResolvedSecretTraceProvenanceCallback
+    } = {}
   ): Promise<McpTool[]> {
     const config = await this.getServerConfig(serverId, scope)
     if (!config) throw new Error('Managed MCP server is unavailable')
     return this.withServerClient(
       { key: '', serverId, allowPool: false },
-      () => this.createManagedOauthClient(config, auth, signal),
-      (client) =>
-        options.requireComplete
-          ? client.listTools(signal, { requireComplete: true })
-          : client.listTools(signal)
+      () => this.createManagedOauthClient(config, auth, signal, options.provenanceScope),
+      async (client) => {
+        try {
+          return await client.listTools(signal, { requireComplete: options.requireComplete })
+        } finally {
+          if (options.provenanceScope)
+            reportRetainedClientProvenance(
+              client.getResolvedSecretTraceProvenance(),
+              options.provenanceScope.userId,
+              options.provenanceScope.workspaceId,
+              options.onResolvedSecretTraceProvenance
+            )
+        }
+      }
     )
   }
 
   async executeManagedMcpTool(params: {
+    userId?: string
+    workspaceId?: string
+    onResolvedSecretTraceProvenance?: ResolvedSecretTraceProvenanceCallback
     connectionId: string
     serverId: string
     scope: ResourceScope
@@ -544,14 +564,102 @@ class McpService {
         this.createManagedOauthClient(
           effectiveConfig,
           { credentialId: params.connectionId, loadProvider: params.loadAuthProvider },
-          params.signal
+          params.signal,
+          params.userId && params.workspaceId
+            ? { userId: params.userId, workspaceId: params.workspaceId }
+            : undefined
         ),
-      (client) =>
-        client.callTool(params.toolCall, {
-          signal: params.signal,
-          timeoutMs: params.timeoutMs,
-        })
+      async (client) => {
+        try {
+          return await client.callTool(params.toolCall, {
+            signal: params.signal,
+            timeoutMs: params.timeoutMs,
+          })
+        } finally {
+          if (params.userId && params.workspaceId)
+            reportRetainedClientProvenance(
+              client.getResolvedSecretTraceProvenance(),
+              params.userId,
+              params.workspaceId,
+              params.onResolvedSecretTraceProvenance
+            )
+        }
+      }
+    )
+  }
+
+  async readResource(params: {
+    serverId: string
+    workspaceId: string
+    userId: string
+    uri: string
+    includeListingMetadata?: boolean
+    managed?: {
+      connectionId: string
+      scope: ResourceScope
+      loadAuthProvider: () => Promise<OAuthClientProvider>
+    }
+    onResolvedSecretTraceProvenance?: ResolvedSecretTraceProvenanceCallback
+    signal?: AbortSignal
+  }) {
+    const reportProvenance = createInvocationProvenanceReporter(
+      params.onResolvedSecretTraceProvenance
     )
+    const managed = params.managed
+    for (let attempt = 0; ; attempt++) {
+      params.signal?.throwIfAborted()
+      try {
+        const config = await this.getServerConfig(
+          params.serverId,
+          managed?.scope ?? params.workspaceId
+        )
+        if (!config) throw new Error('MCP server is unavailable')
+        return await this.withServerClient(
+          {
+            key: this.poolKey(params.serverId, params.workspaceId, params.userId),
+            serverId: params.serverId,
+            allowPool: !params.managed,
+          },
+          managed
+            ? () =>
+                this.createManagedOauthClient(
+                  config,
+                  { credentialId: managed.connectionId, loadProvider: managed.loadAuthProvider },
+                  params.signal,
+                  { userId: params.userId, workspaceId: params.workspaceId }
+                )
+            : this.buildClient(
+                config,
+                params.userId,
+                params.workspaceId,
+                undefined,
+                reportProvenance,
+                params.signal
+              ),
+          async (client) => {
+            try {
+              return await client.readResource(params.uri, {
+                signal: params.signal,
+                timeoutMs: 30_000,
+                includeListingMetadata: params.includeListingMetadata,
+              })
+            } finally {
+              reportRetainedClientProvenance(
+                client.getResolvedSecretTraceProvenance?.(),
+                params.userId,
+                params.workspaceId,
+                reportProvenance
+              )
+            }
+          }
+        )
+      } catch (error) {
+        params.signal?.throwIfAborted()
+        if (!managed && attempt === 0 && (this.isSessionError(error) || isAuthError(error)))
+          continue
+        throw error
+      }
+    }
   }
 
   /** Auth-scoped pool key: a server's resolved credentials depend on the (user, workspace) env. */
@@ -632,16 +740,17 @@ class McpService {
             onResolvedSecretTraceProvenance,
             signal
           ),
-          (client) => {
-            reportRetainedClientProvenance(
-              client.getResolvedSecretTraceProvenance?.(),
-              userId,
-              workspaceId,
-              onResolvedSecretTraceProvenance
-            )
-            return requireComplete
-              ? client.listTools(signal, { requireComplete: true })
-              : client.listTools(signal)
+          async (client) => {
+            try {
+              return await client.listTools(signal, { requireComplete })
+            } finally {
+              reportRetainedClientProvenance(
+                client.getResolvedSecretTraceProvenance?.(),
+                userId,
+                workspaceId,
+                onResolvedSecretTraceProvenance
+              )
+            }
           }
         )
       } catch (error) {
@@ -737,14 +846,17 @@ class McpService {
             reportProvenance,
             options.signal
           ),
-          (client) => {
-            reportRetainedClientProvenance(
-              client.getResolvedSecretTraceProvenance?.(),
-              userId,
-              workspaceId,
-              reportProvenance
-            )
-            return client.callTool(toolCall, options)
+          async (client) => {
+            try {
+              return await client.callTool(toolCall, options)
+            } finally {
+              reportRetainedClientProvenance(
+                client.getResolvedSecretTraceProvenance?.(),
+                userId,
+                workspaceId,
+                reportProvenance
+              )
+            }
           }
         )
         logger.info(`[${requestId}] Successfully executed tool ${toolCall.name}`)
diff --git a/apps/sim/lib/mcp/types.ts b/apps/sim/lib/mcp/types.ts
index a4007638a03..026035be4c9 100644
--- a/apps/sim/lib/mcp/types.ts
+++ b/apps/sim/lib/mcp/types.ts
@@ -1,4 +1,4 @@
-import type { Tool } from '@modelcontextprotocol/sdk/types.js'
+import type { CallToolResult, Tool } from '@modelcontextprotocol/sdk/types.js'
 import type { ManagedMcpConnectorId } from '@/lib/credential-groups/managed-mcp-connectors'
 import type { ResolvedSecretTraceProvenanceV1 } from '@/executor/utils/resolved-secret-trace-registry'
 
@@ -89,7 +89,11 @@ export interface McpToolSchema {
 }
 
 /** SDK `Tool` plus the server context Sim tracks. */
-export interface McpTool extends Pick<Tool, 'name' | 'description'> {
+export interface McpTool
+  extends Pick<
+    Tool,
+    'name' | 'title' | 'description' | 'annotations' | '_meta' | 'icons' | 'outputSchema'
+  > {
   inputSchema: McpToolSchema
   canonicalServerId?: string
   serverId: string
@@ -102,16 +106,7 @@ export interface McpToolCall {
   arguments: Record<string, unknown>
 }
 
-export interface McpToolResult {
-  content?: Array<{
-    type: 'text' | 'image' | 'resource'
-    text?: string
-    data?: string
-    mimeType?: string
-  }>
-  isError?: boolean
-  [key: string]: unknown
-}
+export type McpToolResult = CallToolResult
 
 export interface McpConnectionStatus {
   connected: boolean
diff --git a/apps/sim/lib/mothership/chat/application/fork.ts b/apps/sim/lib/mothership/chat/application/fork.ts
index 97b15c298ce..d816a848735 100644
--- a/apps/sim/lib/mothership/chat/application/fork.ts
+++ b/apps/sim/lib/mothership/chat/application/fork.ts
@@ -8,6 +8,8 @@ import { defineWorkspaceOperation } from '@/lib/core/application'
 import { defineOrganizationOperation } from '@/lib/core/application/organization-operation'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { mapWithConcurrency } from '@/lib/core/utils/concurrency'
+import { planForkMcpPresentations } from '@/lib/mcp/presentation-lifecycle'
+import { mcpPresentationKey } from '@/lib/mcp/presentation-storage'
 import { defineAuthorizedChatUseCase } from '@/lib/mothership/chat/application/authorized-chat-use-case'
 import { resolveOwnedChatContext } from '@/lib/mothership/chat/application/context'
 import {
@@ -129,7 +131,12 @@ export const forkChat = defineAuthorizedChatUseCase({
       const now = new Date()
 
       const plan = planChatFileCopies({ rows: sourceFiles, newChatId: newId, userId, now })
-      preparedBlobs = [...plan.blobTasks, ...planForkInlineImages(forkedMessages, chatId, newId)]
+      const mcpCopies = planForkMcpPresentations(forkedMessages, chatId, newId)
+      preparedBlobs = [
+        ...plan.blobTasks,
+        ...planForkInlineImages(forkedMessages, chatId, newId),
+        ...mcpCopies,
+      ]
       const { failed, failedCopyIds } = await executeChatFileBlobCopies(preparedBlobs)
       const failedIds = new Set(failedCopyIds)
       const maps = {
@@ -137,7 +144,19 @@ export const forkChat = defineAuthorizedChatUseCase({
         workspaceId: context.workspaceId,
       }
       /** A chat-owned file whose copy failed is a ghost here too: no published copy stands in for it. */
-      const newChatResources = rewriteResourceFileRefs(parentResources, maps, chatOwnedFileIds)
+      const copiedMcpKeys = new Set(
+        mcpCopies.filter((task) => !failedIds.has(task.copyId)).map((task) => task.sourceKey)
+      )
+      const newChatResources = rewriteResourceFileRefs(
+        parentResources,
+        maps,
+        chatOwnedFileIds
+      ).filter(
+        (resource) =>
+          resource.type !== 'mcp' ||
+          (resource.mcp &&
+            copiedMcpKeys.has(mcpPresentationKey(chatId, resource.mcp.presentationId)))
+      )
       const cutUser = [...forkedMessages].reverse().find((message) => message.role === 'user')
       if (!cutUser) throw new Error('The fork has no user message')
       workerCopyRequested = true
diff --git a/apps/sim/lib/mothership/chat/application/mcp-results.ts b/apps/sim/lib/mothership/chat/application/mcp-results.ts
new file mode 100644
index 00000000000..456fb94d4f7
--- /dev/null
+++ b/apps/sim/lib/mothership/chat/application/mcp-results.ts
@@ -0,0 +1,356 @@
+import { MIMEType } from 'node:util'
+import { CallToolResultSchema, ReadResourceResultSchema } from '@modelcontextprotocol/sdk/types.js'
+import type { Principal, SessionPrincipal } from '@sim/auth/principal'
+import { defineWorkspaceOperation } from '@/lib/core/application'
+import { defineOrganizationOperation } from '@/lib/core/application/organization-operation'
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { buildMcpAppFrame } from '@/lib/mcp/app-frame'
+import { executeManagedMcpToolUseCase } from '@/lib/mcp/application/execute-managed-tool'
+import { executeMcpToolUseCase } from '@/lib/mcp/application/execute-tool'
+import { readManagedMcpResource, readMcpResource } from '@/lib/mcp/application/read-resource'
+import { decodeMcpBase64, projectMcpEncodedContents } from '@/lib/mcp/encoded-content'
+import { MCP_PRESENTATION_MAX_BYTES } from '@/lib/mcp/presentation'
+import { loadMcpPresentation, storeMcpPresentation } from '@/lib/mcp/presentation-storage'
+import { isManagedMcpConnectionId } from '@/lib/mcp/utils'
+import { resolveInvocationWorkspace } from '@/lib/mothership/application/workspace-target'
+import { defineAuthorizedChatUseCase } from '@/lib/mothership/chat/application/authorized-chat-use-case'
+import { resolveOwnedChatContext } from '@/lib/mothership/chat/application/context'
+import { normalizeInlineChatImage } from '@/lib/mothership/chat/inline-image-storage'
+import { extractResourcesFromToolResult } from '@/lib/mothership/resources/extraction'
+import { changeStoredChatResources } from '@/lib/mothership/resources/store'
+import { resolveFileCategory } from '@/lib/uploads/utils/file-category'
+import { resolveStoredFileMetadata } from '@/lib/uploads/utils/stored-file-metadata'
+import { projectResolvedSecretModelJsonContent } from '@/executor/utils/resolved-secret-content-projection'
+import {
+  ResolvedSecretTraceProvenanceAccumulator,
+  ResolvedSecretTraceRegistry,
+} from '@/executor/utils/resolved-secret-trace-registry'
+
+export const MCP_PRESENTATION_AUDIENCE = 'sim:mcp-presentations'
+const readOperation = defineWorkspaceOperation({
+  id: 'mothership.chats.read_mcp_result',
+  minimumRole: 'read',
+  workspaceApiKey: 'deny',
+  capability: 'mcp_tools.use',
+  principalKinds: ['session'],
+})
+const readOrganizationOperation = defineOrganizationOperation({
+  id: readOperation.id,
+  minimumRole: 'member',
+  capability: 'copilot.use',
+  principalKinds: ['session'],
+})
+
+interface McpResultInput {
+  chatId: string
+  id: string
+  signal?: AbortSignal
+}
+
+const readDefinition = {
+  operation: readOperation,
+  organizationOperation: readOrganizationOperation,
+  authorizationOptions: {},
+  resolveContext: ({ principal, input }: { principal: Principal; input: McpResultInput }) =>
+    resolveOwnedChatContext(principal, input.chatId),
+} as const
+
+/** Only trusted server tool execution publishes a manifest; there is no upload surface. */
+export const publishMcpResult = defineAuthorizedChatUseCase({
+  operation: defineWorkspaceOperation({
+    id: 'mothership.chats.publish_mcp_result',
+    minimumRole: 'read',
+    workspaceApiKey: 'deny',
+    capability: 'mcp_tools.use',
+    principalKinds: ['delegated'],
+    delegatedServices: ['copilot'],
+  }),
+  organizationOperation: defineOrganizationOperation({
+    id: 'mothership.chats.publish_mcp_result',
+    minimumRole: 'member',
+    capability: 'copilot.use',
+    principalKinds: ['organization_delegated'],
+    delegatedServices: ['copilot'],
+    delegationAudience: MCP_PRESENTATION_AUDIENCE,
+  }),
+  authorizationOptions: {
+    delegation: {
+      audience: MCP_PRESENTATION_AUDIENCE,
+      isWithinScope: (principal, context) => principal.resourceScope?.chatId === context.chatId,
+    },
+  },
+  resolveContext: ({
+    principal,
+    input,
+  }: {
+    principal: Principal
+    input: Parameters<typeof storeMcpPresentation>[0]
+  }) => resolveOwnedChatContext(principal, input.chatId),
+  async execute({ context, input: sourceInput, request }) {
+    const input = { ...sourceInput, signal: sourceInput.signal ?? request?.signal }
+    await requirePresentationWorkspace(context, input.workspaceId)
+    const receipt = await storeMcpPresentation({ ...input, chatId: context.chatId })
+    if (receipt?.items.length)
+      await changeStoredChatResources(
+        context.chatId,
+        {
+          kind: 'upsert',
+          resources: extractResourcesFromToolResult('mcp_run_operation', undefined, {
+            mcpPresentation: receipt,
+          }),
+        },
+        `mcp-presentation:${receipt.id}`
+      )
+    return receipt
+  },
+})
+
+async function requirePresentationWorkspace(
+  context: Awaited<ReturnType<typeof resolveOwnedChatContext>>,
+  workspaceId: string
+) {
+  if (context.workspaceId && context.workspaceId !== workspaceId)
+    throw new OrchestrationError('not_found', 'MCP result not found')
+  if (context.organizationId)
+    await resolveInvocationWorkspace(
+      { userId: context.userId, organizationId: context.organizationId, chatId: context.chatId },
+      workspaceId
+    )
+}
+
+async function readManifest(
+  context: Awaited<ReturnType<typeof resolveOwnedChatContext>>,
+  input: McpResultInput
+) {
+  const manifest = await loadMcpPresentation(context.chatId, input.id, input.signal)
+  await requirePresentationWorkspace(context, manifest.workspaceId)
+  return manifest
+}
+
+export const readMcpResult = defineAuthorizedChatUseCase({
+  ...readDefinition,
+  async execute({ context, input: sourceInput, request }) {
+    const input = { ...sourceInput, signal: sourceInput.signal ?? request?.signal }
+    const manifest = await readManifest(context, input)
+    return {
+      workspaceId: manifest.workspaceId,
+      receipt: manifest.receipt,
+      arguments: manifest.arguments,
+      result: manifest.result,
+    }
+  },
+})
+
+export const readMcpResultMetadata = defineAuthorizedChatUseCase({
+  ...readDefinition,
+  async execute({ context, input: sourceInput, request }) {
+    const input = { ...sourceInput, signal: sourceInput.signal ?? request?.signal }
+    const manifest = await readManifest(context, input)
+    return { workspaceId: manifest.workspaceId, receipt: manifest.receipt }
+  },
+})
+
+async function readProviderResource(
+  principal: SessionPrincipal,
+  manifest: Awaited<ReturnType<typeof loadMcpPresentation>>,
+  uri: string,
+  signal?: AbortSignal
+) {
+  const useCase = isManagedMcpConnectionId(manifest.connectionId)
+    ? readManagedMcpResource
+    : readMcpResource
+  const provenance = new ResolvedSecretTraceProvenanceAccumulator({
+    userId: principal.userId,
+    workspaceId: manifest.workspaceId,
+  })
+  const result = await useCase.execute({
+    principal,
+    input: {
+      workspaceId: manifest.workspaceId,
+      connectionId: manifest.connectionId,
+      toolName: manifest.toolName,
+      appUri: manifest.appUri,
+      uri,
+      signal,
+      onResolvedSecretTraceProvenance: (value) => provenance.record(value),
+    },
+  })
+  return ReadResourceResultSchema.parse(
+    await projectAppValue(result, provenance, principal.userId, manifest.workspaceId)
+  )
+}
+
+export const readMcpAppFrame = defineAuthorizedChatUseCase({
+  ...readDefinition,
+  async execute({ principal, context, input: sourceInput, request }) {
+    const input = { ...sourceInput, signal: sourceInput.signal ?? request?.signal }
+    const manifest = await readManifest(context, input)
+    if (!manifest.appUri) throw new OrchestrationError('not_found', 'MCP App not found')
+    const resource = await readProviderResource(principal, manifest, manifest.appUri, input.signal)
+    const content = resource.contents.find((item) => {
+      if (item.uri !== manifest.appUri || !item.mimeType) return false
+      try {
+        const mime = new MIMEType(item.mimeType)
+        return mime.essence === 'text/html' && mime.params.get('profile') === 'mcp-app'
+      } catch {
+        return false
+      }
+    })
+    if (!content)
+      throw new OrchestrationError('validation', 'The MCP App did not return an HTML resource')
+    const html = 'text' in content ? content.text : decodeMcpBase64(content.blob).toString('utf8')
+    return buildMcpAppFrame(html, content._meta)
+  },
+})
+
+export const callMcpAppTool = defineAuthorizedChatUseCase({
+  ...readDefinition,
+  operation: defineWorkspaceOperation({
+    id: 'mothership.chats.call_mcp_app_tool',
+    minimumRole: 'read',
+    workspaceApiKey: 'deny',
+    capability: 'mcp_tools.use',
+    principalKinds: ['session'],
+  }),
+  organizationOperation: defineOrganizationOperation({
+    id: 'mothership.chats.call_mcp_app_tool',
+    minimumRole: 'member',
+    capability: 'copilot.use',
+    principalKinds: ['session'],
+  }),
+  resolveContext: ({
+    principal,
+    input,
+  }: {
+    principal: Principal
+    input: McpResultInput & { name: string; arguments?: Record<string, unknown> }
+  }) => resolveOwnedChatContext(principal, input.chatId),
+  async execute({ principal, context, input: sourceInput, request }) {
+    const input = { ...sourceInput, signal: sourceInput.signal ?? request?.signal }
+    const manifest = await readManifest(context, input)
+    if (!manifest.appUri) throw new OrchestrationError('forbidden', 'This result has no MCP App')
+    const provenance = new ResolvedSecretTraceProvenanceAccumulator({
+      userId: principal.userId,
+      workspaceId: manifest.workspaceId,
+    })
+    const common = {
+      onResolvedSecretTraceProvenance: (value: Parameters<typeof provenance.record>[0]) =>
+        provenance.record(value),
+      workspaceId: manifest.workspaceId,
+      toolName: input.name,
+      arguments: input.arguments,
+      appOrigin: { toolName: manifest.toolName, resourceUri: manifest.appUri },
+      presentation: 'app' as const,
+      signal: input.signal,
+      timeoutMs: 60_000,
+    }
+    const result = isManagedMcpConnectionId(manifest.connectionId)
+      ? await executeManagedMcpToolUseCase.execute({
+          principal,
+          input: { ...common, credentialId: manifest.connectionId },
+        })
+      : await executeMcpToolUseCase.execute({
+          principal,
+          input: { ...common, serverId: manifest.connectionId },
+        })
+    const output = result.presentation?.result ?? {
+      content: [{ type: 'text' as const, text: result.success ? 'Done' : result.error }],
+      isError: !result.success,
+    }
+    return CallToolResultSchema.parse(
+      await projectAppValue(output, provenance, principal.userId, manifest.workspaceId)
+    )
+  },
+})
+
+export const readMcpAppResource = defineAuthorizedChatUseCase({
+  ...readDefinition,
+  resolveContext: ({
+    principal,
+    input,
+  }: {
+    principal: Principal
+    input: McpResultInput & { uri: string }
+  }) => resolveOwnedChatContext(principal, input.chatId),
+  async execute({ principal, context, input: sourceInput, request }) {
+    const input = { ...sourceInput, signal: sourceInput.signal ?? request?.signal }
+    const manifest = await readManifest(context, input)
+    if (!manifest.appUri) throw new OrchestrationError('forbidden', 'This result has no MCP App')
+    return readProviderResource(principal, manifest, input.uri, input.signal)
+  },
+})
+
+async function projectAppValue(
+  value: Parameters<typeof projectMcpEncodedContents>[0],
+  provenance: ResolvedSecretTraceProvenanceAccumulator,
+  userId: string,
+  workspaceId: string
+) {
+  const registry = new ResolvedSecretTraceRegistry([], { userId, workspaceId })
+  if (
+    !(await registry.importProvenance(provenance.exportProvenance(), {
+      trusted: true,
+      origin: 'mcp.app',
+    }))
+  )
+    throw new OrchestrationError('forbidden', 'MCP App response metadata could not be verified')
+  const projection = projectResolvedSecretModelJsonContent(
+    projectMcpEncodedContents(value, registry.forkForPropagatedEntries()),
+    registry.forkForPropagatedEntries(),
+    MCP_PRESENTATION_MAX_BYTES
+  )
+  if (!projection.safe)
+    throw new OrchestrationError('forbidden', 'MCP App response could not be displayed safely')
+  return projection.value
+}
+
+export const readMcpResultAsset = defineAuthorizedChatUseCase({
+  ...readDefinition,
+  resolveContext: ({
+    principal,
+    input,
+  }: {
+    principal: Principal
+    input: McpResultInput & { index: number }
+  }) => resolveOwnedChatContext(principal, input.chatId),
+  async execute({ context, input: sourceInput, request }) {
+    const input = { ...sourceInput, signal: sourceInput.signal ?? request?.signal }
+    const manifest = await readManifest(context, input)
+    const item = manifest.result.content[input.index]
+    const receiptItem = manifest.receipt.items.find((item) => item.index === input.index)
+    if (!receiptItem || !item || item.type === 'text')
+      throw new OrchestrationError('not_found', 'MCP file not found')
+    const resource =
+      item.type === 'resource_link'
+        ? manifest.resources.find((content) => content.uri === item.uri)
+        : item.type === 'resource'
+          ? item.resource
+          : undefined
+    const buffer =
+      item.type === 'image' || item.type === 'audio'
+        ? decodeMcpBase64(item.data)
+        : resource && 'blob' in resource
+          ? decodeMcpBase64(resource.blob)
+          : resource && 'text' in resource
+            ? Buffer.from(resource.text)
+            : undefined
+    if (!buffer) throw new OrchestrationError('not_found', 'MCP file not found')
+    const mimeType = receiptItem.mimeType
+    if (['image/png', 'image/jpeg', 'image/webp', 'image/gif'].includes(mimeType))
+      return {
+        buffer: await normalizeInlineChatImage(buffer, input.signal),
+        contentType: 'image/webp',
+        disposition: 'inline',
+      }
+    const metadata = resolveStoredFileMetadata(`mcp-result-${input.index + 1}`, mimeType, buffer)
+    const safeInline =
+      resolveFileCategory(metadata.mimeType, '') === 'audio-previewable' ||
+      metadata.mimeType === 'application/pdf' ||
+      metadata.mimeType === 'text/plain'
+    return {
+      buffer,
+      contentType: metadata.mimeType,
+      disposition: safeInline ? 'inline' : 'attachment',
+    }
+  },
+})
diff --git a/apps/sim/lib/mothership/chat/persisted-message.ts b/apps/sim/lib/mothership/chat/persisted-message.ts
index 9771edb2973..69c506b62b2 100644
--- a/apps/sim/lib/mothership/chat/persisted-message.ts
+++ b/apps/sim/lib/mothership/chat/persisted-message.ts
@@ -5,6 +5,7 @@ import type {
   PersistedToolCall,
   PersistedToolState,
 } from '@/lib/api/contracts/copilot-messages'
+import { compactMcpPresentation } from '@/lib/mcp/presentation'
 import { buildMothershipErrorTag } from '@/lib/mothership/chat/error-tag'
 import { compactRetrievalCitations } from '@/lib/mothership/chat/retrieval-citations'
 import {
@@ -147,6 +148,7 @@ export function stripToolResultOutput(message: PersistedMessage): PersistedMessa
     const result = toolCall?.result
     if (!toolCall || !result || typeof result !== 'object' || !('output' in result)) return block
     const output = result.output
+    const mcpReceipt = compactMcpPresentation(output)
     const citations = result.success ? compactRetrievalCitations(toolCall.name, output) : undefined
     const taskId =
       result.success && toolCall.name === 'watch' && isPlainRecord(output)
@@ -174,6 +176,7 @@ export function stripToolResultOutput(message: PersistedMessage): PersistedMessa
     const strippedResult: { success: boolean; output?: unknown; error?: string } = {
       success: result.success,
       ...(citations ? { output: citations } : {}),
+      ...(mcpReceipt ? { output: mcpReceipt } : {}),
       ...(watchReceipt ? { output: watchReceipt } : {}),
       ...(normalizedInstruction ? { output: { userInstruction: normalizedInstruction } } : {}),
     }
diff --git a/apps/sim/lib/mothership/chat/post.ts b/apps/sim/lib/mothership/chat/post.ts
index d7bb135fc03..90cce900ff3 100644
--- a/apps/sim/lib/mothership/chat/post.ts
+++ b/apps/sim/lib/mothership/chat/post.ts
@@ -130,6 +130,7 @@ const FileAttachmentSchema = z.object({
 const GENERIC_RESOURCE_TITLE: Record<z.infer<typeof ResourceAttachmentSchema>['type'], string> = {
   search: 'Search results',
   sources: 'Sources',
+  mcp: 'MCP result',
   workflow: 'Workflow',
   table: 'Table',
   integration: 'Integration',
@@ -587,7 +588,7 @@ async function resolveAgentContexts(params: {
   ) {
     const results = await Promise.allSettled(
       resourceAttachments.map(async (resource) => {
-        if (resource.type === 'sources') return null
+        if (resource.type === 'sources' || resource.type === 'mcp') return null
         // The live browser panel resolves from the attachment itself: its
         // page state is client-held (the desktop app's embedded browser),
         // not a workspace entity the server could look up.
diff --git a/apps/sim/lib/mothership/mcp-tools.ts b/apps/sim/lib/mothership/mcp-tools.ts
index 4ecb2b217b8..18b00f52d82 100644
--- a/apps/sim/lib/mothership/mcp-tools.ts
+++ b/apps/sim/lib/mothership/mcp-tools.ts
@@ -3,6 +3,7 @@ import { discoverMcpServerToolsAsExecutor } from '@/lib/internal/mcp/discover-to
 import type { InternalToolOperationContext } from '@/lib/internal/tool-operations/types'
 import { MCP_SERVER_DELEGATION_AUDIENCE } from '@/lib/mcp/application/authorization'
 import { discoverMcpServerToolsUseCase, getMcpServerUseCase } from '@/lib/mcp/application/use-cases'
+import { isMcpToolVisible } from '@/lib/mcp/presentation-metadata'
 import { resolveMcpToolBinding } from '@/lib/mcp/tool-binding'
 import type { McpTool, McpToolSchema } from '@/lib/mcp/types'
 import { createMcpToolId } from '@/lib/mcp/utils'
@@ -84,7 +85,12 @@ export async function buildTaggedMcpToolSchemas(
       return tools
     })
   )
-  return dedupeMcpTools(discovered.flat().map(toMothershipMcpTool))
+  return dedupeMcpTools(
+    discovered
+      .flat()
+      .filter((tool) => isMcpToolVisible(tool, 'model'))
+      .map(toMothershipMcpTool)
+  )
 }
 
 /**
@@ -115,7 +121,8 @@ export async function buildSelectedMcpToolSchemas(
         discoveredByServer.set(serverId, discovery)
       }
       const match = (await discovery).find((tool) => tool.name === toolName)
-      if (!match) throw new Error(`MCP operation "${toolName}" is missing or not permitted`)
+      if (!match || !isMcpToolVisible(match, 'model'))
+        throw new Error(`MCP operation "${toolName}" is missing or not permitted`)
       return toMothershipMcpTool(match)
     })
   )
diff --git a/apps/sim/lib/mothership/request/tools/resources.ts b/apps/sim/lib/mothership/request/tools/resources.ts
index c74853cfda4..3949c091bff 100644
--- a/apps/sim/lib/mothership/request/tools/resources.ts
+++ b/apps/sim/lib/mothership/request/tools/resources.ts
@@ -89,6 +89,7 @@ export async function handleResourceSideEffects(
           for (let index = 0; index < deleted.length; index += 1) {
             if (isAborted()) break
             const resource = deleted[index]
+            if (resource.type === 'mcp') continue
             const projected = projectedDeleted[index]
             await onEvent?.({
               type: MothershipStreamV1EventType.resource,
@@ -125,7 +126,7 @@ export async function handleResourceSideEffects(
                 ...projectedResources[index],
                 type: resource.type,
                 id: resource.id,
-                ...((resource.workspaceId ?? workspaceId)
+                ...(resource.type !== 'mcp' && (resource.workspaceId ?? workspaceId)
                   ? { workspaceId: resource.workspaceId ?? workspaceId }
                   : {}),
               }))
@@ -139,7 +140,9 @@ export async function handleResourceSideEffects(
             resources: resources.map((r) => ({ type: r.type, id: r.id, title: r.title })),
           })
           const upserts = resources.filter(
-            (resource) => !('clearViewId' in resource && resource.clearViewId === true)
+            (resource) =>
+              resource.type !== 'mcp' &&
+              !('clearViewId' in resource && resource.clearViewId === true)
           )
           persistChatResources(chatId, upserts).catch((err) => {
             logger.warn('Failed to persist chat resources', {
@@ -150,6 +153,7 @@ export async function handleResourceSideEffects(
 
           for (const resource of resources) {
             if (isAborted()) break
+            if (resource.type === 'mcp') continue
             if ('clearViewId' in resource && resource.clearViewId === true) {
               const viewId = toRecord(params?.args).viewId
               if (resource.type !== 'table' || typeof viewId !== 'string' || !viewId.trim()) {
@@ -179,7 +183,7 @@ export async function handleResourceSideEffects(
               type: MothershipStreamV1EventType.resource,
               payload: {
                 op: MothershipStreamV1ResourceOp.upsert,
-                resource,
+                resource: { ...resource, type: resource.type },
                 ...(toolName === 'search_workspace' && resource.type === 'search'
                   ? {
                       searchResult: searchResultFromToolResult(projectedResult.output, actorUserId),
diff --git a/apps/sim/lib/mothership/resources/extraction.ts b/apps/sim/lib/mothership/resources/extraction.ts
index 3579ab39f30..a33a76b54fb 100644
--- a/apps/sim/lib/mothership/resources/extraction.ts
+++ b/apps/sim/lib/mothership/resources/extraction.ts
@@ -1,4 +1,5 @@
 import { toRecord } from '@sim/utils/object'
+import { compactMcpPresentation } from '@/lib/mcp/presentation'
 import {
   ApplyFileEdit,
   CreateEmptyFile,
@@ -41,7 +42,11 @@ const RESOURCE_TOOL_NAMES: Set<string> = new Set([
 ])
 
 export function isResourceToolName(toolName: string): boolean {
-  return RESOURCE_TOOL_NAMES.has(toolName)
+  return (
+    RESOURCE_TOOL_NAMES.has(toolName) ||
+    toolName === 'mcp_run_operation' ||
+    toolName.startsWith('mcp-')
+  )
 }
 
 function getOperation(params: Record<string, unknown> | undefined): string | undefined {
@@ -71,6 +76,14 @@ export function extractResourcesFromToolResult(
   output: unknown
 ): ChatResource[] {
   if (!isResourceToolName(toolName)) return []
+  const presentation = compactMcpPresentation(output)?.mcpPresentation
+  if (presentation)
+    return presentation.items.map((item) => ({
+      type: 'mcp',
+      id: item.identity,
+      title: item.title,
+      mcp: { presentationId: presentation.id, index: item.index },
+    }))
 
   const result = toRecord(output)
   const data = toRecord(result.data)
diff --git a/apps/sim/lib/mothership/resources/types.test.ts b/apps/sim/lib/mothership/resources/types.test.ts
index 17547c19ba8..1da23a81907 100644
--- a/apps/sim/lib/mothership/resources/types.test.ts
+++ b/apps/sim/lib/mothership/resources/types.test.ts
@@ -71,6 +71,7 @@ describe('client and server agree on what can be persisted', () => {
         id: 'r1',
         title: 'Thing',
         ...(type === 'sources' ? { sources: { messageId: 'message-1' } } : {}),
+        ...(type === 'mcp' ? { mcp: { presentationId: 'a'.repeat(64), index: 0 } } : {}),
         ...(type === 'search'
           ? { search: { query: 'policy', scope: { kind: 'organization', organizationId: 'org' } } }
           : {}),
diff --git a/apps/sim/lib/mothership/resources/types.ts b/apps/sim/lib/mothership/resources/types.ts
index 6e4990a6d31..f7aa39f037c 100644
--- a/apps/sim/lib/mothership/resources/types.ts
+++ b/apps/sim/lib/mothership/resources/types.ts
@@ -3,6 +3,7 @@ import type { SearchResource } from '@/lib/mothership/generated/resources'
 export const MothershipResourceType = {
   search: 'search',
   sources: 'sources',
+  mcp: 'mcp',
   table: 'table',
   file: 'file',
   dashboard: 'dashboard',
@@ -40,6 +41,7 @@ export interface MothershipResource {
   search?: SearchResource
   /** Address of evidence already present in this conversation, never a provider query. */
   sources?: { messageId: string; requestId?: string }
+  mcp?: { presentationId: string; index: number }
 }
 
 /** A resource upsert may explicitly clear metadata that omission preserves. */
@@ -109,6 +111,7 @@ interface ResourcePolicy {
 const RESOURCE_POLICY: Record<MothershipResourceType, ResourcePolicy> = {
   search: { persisted: true },
   sources: { persisted: true },
+  mcp: { persisted: true },
   table: { persisted: true },
   file: { persisted: true },
   dashboard: { persisted: true },
@@ -258,6 +261,7 @@ const MERGED_FIELDS = {
   executionId: true,
   search: true,
   sources: true,
+  mcp: true,
 } as const satisfies Record<Exclude<keyof MothershipResource, 'type' | 'id'>, true>
 
 const MERGED_FIELD_NAMES = Object.keys(MERGED_FIELDS) as (keyof typeof MERGED_FIELDS)[]
@@ -291,6 +295,7 @@ export function mergeChatResource(
     ...(next.executionId !== undefined ? { executionId: next.executionId } : {}),
     ...(next.search !== undefined ? { search: next.search } : {}),
     ...(next.sources !== undefined ? { sources: next.sources } : {}),
+    ...(next.mcp !== undefined ? { mcp: next.mcp } : {}),
     title:
       (!prev.title.trim() || prev.title === prev.id || GENERIC_RESOURCE_TITLES.has(prev.title)) &&
       Boolean(next.title.trim()) &&
diff --git a/apps/sim/lib/mothership/tool-executor/executor.ts b/apps/sim/lib/mothership/tool-executor/executor.ts
index a3c4028d538..fd0700bcc1a 100644
--- a/apps/sim/lib/mothership/tool-executor/executor.ts
+++ b/apps/sim/lib/mothership/tool-executor/executor.ts
@@ -185,6 +185,7 @@ async function executeBoundTool(
           workflowId: context.workflowId,
           workspaceId: context.workspaceId,
           organizationId: context.organizationId,
+          chatOrganizationId: context.chatOrganizationId,
           executionId: context.executionId,
           chatId: context.chatId,
           toolCallId: context.toolCallId,
diff --git a/apps/sim/lib/mothership/tools/client/resource-display.ts b/apps/sim/lib/mothership/tools/client/resource-display.ts
index 4b04e09bd17..3031850af74 100644
--- a/apps/sim/lib/mothership/tools/client/resource-display.ts
+++ b/apps/sim/lib/mothership/tools/client/resource-display.ts
@@ -1,6 +1,7 @@
 import { isRecordLike } from '@sim/utils/object'
 import type { QueryKey } from '@tanstack/react-query'
 import type { ResourceAddress } from '@/lib/mothership/generated/resources'
+import type { MothershipResource } from '@/lib/mothership/resources/types'
 import {
   blockDisplayName,
   cliFirstPositional,
@@ -23,7 +24,7 @@ import { workspaceFilesKeys } from '@/hooks/queries/workspace-files'
 
 export interface ToolResourceContext {
   workspaceId?: string
-  resources?: readonly ResourceAddress[]
+  resources?: readonly MothershipResource[]
 }
 
 type NamedResource = ResourceAddress['type'] | 'skill' | 'customtool' | 'mcpserver' | 'workspace'
diff --git a/apps/sim/lib/sim-search/live/managed-mcp.integration.ts b/apps/sim/lib/sim-search/live/managed-mcp.integration.ts
index 43a6df18f81..25b34e31c20 100644
--- a/apps/sim/lib/sim-search/live/managed-mcp.integration.ts
+++ b/apps/sim/lib/sim-search/live/managed-mcp.integration.ts
@@ -3,35 +3,67 @@ import { createServer } from 'node:http'
 import { dirname } from 'node:path'
 import { Server } from '@modelcontextprotocol/sdk/server/index.js'
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'
-import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js'
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema,
+  ReadResourceRequestSchema,
+} from '@modelcontextprotocol/sdk/types.js'
 import { db } from '@sim/db'
 import {
+  copilotChats,
   credential,
   credentialGroupEnrollment,
   mcpServers,
   member,
   organization,
   organizationSearchIntegration,
+  permissions,
   user,
+  workspace,
 } from '@sim/db/schema'
 import { readTestRedisUrl } from '@sim/db/testing/test-infrastructure'
 import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
 import { createDeferred } from '@sim/testing/helpers/deferred'
 import { sleep } from '@sim/utils/helpers'
 import { generateId } from '@sim/utils/id'
+import { toRecord } from '@sim/utils/object'
 import { eq, inArray } from 'drizzle-orm'
 import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest'
+import { resolveBillingAttribution } from '@/lib/billing/core/billing-attribution'
 import { env } from '@/lib/core/config/env'
 import { runWithOutboundOrganization } from '@/lib/core/network/context.server'
+import {
+  buildOrganizationAccountAccessPolicy,
+  organizationAccountAccessPolicyCodec,
+} from '@/lib/credential-groups/application/workspace-access-policy'
 import { createManagedMcpConnector } from '@/lib/credential-groups/managed-mcp-service'
 import { createViewerCredentialGroupEnrollment } from '@/lib/credential-groups/self-enrollment'
 import { ensureWorkspaceAccountsGroup } from '@/lib/credential-groups/service'
 import { encryptManagedMcpTokens } from '@/lib/credentials/managed-mcp'
+import { executeMcpTool } from '@/lib/internal/mcp/execute-tool'
+import { executeManagedMcpToolUseCase } from '@/lib/mcp/application/execute-managed-tool'
+import { readManagedMcpResource } from '@/lib/mcp/application/read-resource'
 import * as pinnedFetch from '@/lib/mcp/pinned-fetch'
+import { compactMcpPresentation, MCP_PRESENTATION_PREFIX } from '@/lib/mcp/presentation'
+import { generateManagedMcpConnectionId } from '@/lib/mcp/utils'
+import {
+  callMcpAppTool,
+  readMcpAppFrame,
+  readMcpAppResource,
+  readMcpResult,
+  readMcpResultAsset,
+} from '@/lib/mothership/chat/application/mcp-results'
+import { requireResourcePolicy, writeResourcePolicy } from '@/lib/resource-policies/repository'
 import { readLiveDocument, searchLiveKnowledge } from '@/lib/sim-search/live/application'
 import { createManagedSearchMcpClient } from '@/lib/sim-search/live/managed-mcp'
+import { deleteFile } from '@/lib/uploads/core/storage-service'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
+const workspaceId = generateId()
+const chatId = generateId()
+const appUri = 'ui://managed-fixture/view.html'
+const presentationKeys = new Set<string>()
+let echoToken = false
 const RESOURCE = 'https://mcp.lucid.app/mcp/readonly'
 const DOCUMENT = '00000000-0000-4000-8000-000000000001'
 const SECOND_DOCUMENT = '00000000-0000-4000-8000-000000000002'
@@ -39,21 +71,21 @@ const TITLE = 'Synthetic topology'
 const actors = [0, 1].map(() => ({
   userId: generateId(),
   organizationId: generateId(),
-  credentialId: `mcp-cg-${generateId()}`,
+  credentialId: generateManagedMcpConnectionId(),
   token: generateId(),
   provider: 'lucid' as 'lucid' | 'notion',
 }))
 actors.push({
   userId: generateId(),
   organizationId: actors[0].organizationId,
-  credentialId: `mcp-cg-${generateId()}`,
+  credentialId: generateManagedMcpConnectionId(),
   token: generateId(),
   provider: 'lucid',
 })
 actors.push({
   userId: generateId(),
   organizationId: generateId(),
-  credentialId: `mcp-cg-${generateId()}`,
+  credentialId: generateManagedMcpConnectionId(),
   token: generateId(),
   provider: 'notion',
 })
@@ -99,7 +131,7 @@ const providerServer = createServer(async (request, response) => {
       await sleep(setupDelay)
       const protocol = new Server(
         { name: 'synthetic-lucid', version: '1' },
-        { capabilities: { tools: {} } }
+        { capabilities: { tools: {}, resources: {} } }
       )
       protocol.setRequestHandler(ListToolsRequestSchema, async ({ params }) => {
         events.push({ method: 'tools/list', actor, at: performance.now() })
@@ -120,6 +152,7 @@ const providerServer = createServer(async (request, response) => {
             'write_document',
           ].map((name) => ({
             name,
+            ...(name === 'fetch' ? { _meta: { ui: { resourceUri: appUri } } } : {}),
             inputSchema: {
               type: 'object' as const,
               properties: {
@@ -135,9 +168,48 @@ const providerServer = createServer(async (request, response) => {
           })),
         }
       })
+      protocol.setRequestHandler(ReadResourceRequestSchema, async ({ params }) => {
+        events.push({ method: 'resources/read', actor, at: performance.now() })
+        return {
+          contents: [
+            {
+              uri: params.uri,
+              mimeType: params.uri === appUri ? 'text/html;profile=mcp-app' : 'text/plain',
+              text: echoToken
+                ? `Safe report ${actors[actor].token}:end`
+                : `Private resource ${actor}`,
+            },
+          ],
+        }
+      })
       protocol.setRequestHandler(CallToolRequestSchema, async ({ params }) => {
         events.push({ method: params.name, actor, at: performance.now() })
         await onTool?.(params.name, params.arguments ?? {})
+        if (params.arguments?.linked)
+          return {
+            content: [
+              {
+                type: 'resource_link',
+                name: 'Private report',
+                uri: 'file:///private-report.txt',
+                mimeType: 'text/plain',
+              },
+            ],
+          }
+        if (echoToken && params.name === 'fetch')
+          return {
+            content: [
+              {
+                type: 'resource',
+                resource: {
+                  uri: 'file:///private-report.txt',
+                  mimeType: 'text/plain',
+                  blob: Buffer.from(`Safe report ${actors[actor].token}:end`).toString('base64'),
+                },
+              },
+            ],
+            _meta: { label: 'Safe app metadata', credentialEcho: actors[actor].token },
+          }
         const documentId =
           params.arguments?.query === 'second topology' ||
           params.arguments?.document_id === SECOND_DOCUMENT ||
@@ -370,6 +442,44 @@ beforeAll(async () => {
       })
       .onConflictDoNothing()
   }
+  await db.insert(workspace).values({
+    id: workspaceId,
+    name: 'MCP App fixture',
+    ownerId: actors[0].userId,
+    billedAccountUserId: actors[0].userId,
+    organizationId: actors[0].organizationId,
+  })
+  await db
+    .insert(copilotChats)
+    .values({ id: chatId, userId: actors[0].userId, workspaceId, type: 'mothership' })
+  await db.insert(permissions).values(
+    [actors[0], actors[2]].map((actor) => ({
+      id: generateId(),
+      userId: actor.userId,
+      entityType: 'workspace' as const,
+      entityId: workspaceId,
+      permissionType: 'admin' as const,
+    }))
+  )
+  const group = await ensureWorkspaceAccountsGroup(
+    { kind: 'organization', organizationId: actors[0].organizationId },
+    actors[0].userId
+  )
+  const policyTarget = {
+    organizationId: actors[0].organizationId,
+    resourceType: 'credential_group' as const,
+    resourceId: group.id,
+    codec: organizationAccountAccessPolicyCodec,
+  }
+  const policy = await requireResourcePolicy(policyTarget)
+  await writeResourcePolicy({
+    ...policyTarget,
+    expectedRevision: policy.revision,
+    actorUserId: actors[0].userId,
+    document: buildOrganizationAccountAccessPolicy(group.id, [
+      { workspaceId, access: { mode: 'selected', credentialTypes: ['mcp:lucid'] } },
+    ]),
+  })
 })
 
 afterEach(async () => {
@@ -390,6 +500,8 @@ afterAll(async () => {
     providerServer.close((error) => (error ? reject(error) : resolve()))
     providerServer.closeAllConnections()
   })
+  for (const key of presentationKeys) await deleteFile({ key, context: 'mothership' })
+  await db.delete(workspace).where(eq(workspace.id, workspaceId))
   await db.delete(organization).where(
     inArray(
       organization.id,
@@ -433,6 +545,135 @@ function read(documentId: string, index = 0, signal?: AbortSignal) {
 
 /** Actual SDK HTTP + current database grants, including final document verification. */
 describe('managed Search operation sessions', () => {
+  it('lets an App read its acting user connection but denies another workspace administrator', async () => {
+    const input = {
+      workspaceId,
+      connectionId: actors[0].credentialId,
+      toolName: 'fetch',
+      uri: 'file:///private-report.txt',
+    }
+    const read = await readManagedMcpResource.execute({
+      principal: createSessionPrincipal({ userId: actors[0].userId }),
+      input,
+    })
+    expect(read.contents[0]).toMatchObject({ text: 'Private resource 0' })
+    const before = events.filter((event) => event.method === 'resources/read').length
+    await expect(
+      readManagedMcpResource.execute({
+        principal: createSessionPrincipal({ userId: actors[2].userId }),
+        input,
+      })
+    ).rejects.toThrow('Only your own organization connections')
+    expect(events.filter((event) => event.method === 'resources/read')).toHaveLength(before)
+  })
+  it.each([false, true])(
+    'redacts actual managed OAuth tokens from saved artifacts and live App responses (rotated=%s)',
+    async (rotated) => {
+      echoToken = true
+      try {
+        const actor = actors[0]
+        if (rotated)
+          onInitialize = async () => {
+            actor.token = generateId()
+            await db
+              .update(credential)
+              .set({
+                encryptedOauthTokenSet: await encryptManagedMcpTokens({
+                  access_token: actor.token,
+                  token_type: 'Bearer',
+                }),
+              })
+              .where(eq(credential.id, actor.credentialId))
+          }
+        const principal = createSessionPrincipal({ userId: actor.userId })
+        const toolCallId = generateId()
+        const response = await executeMcpTool({
+          toolId: 'mcp_run_operation',
+          input: { server: actor.credentialId, tool: 'fetch', arguments: {} },
+          headers: new Headers(),
+          requestId: toolCallId,
+          context: {
+            userId: actor.userId,
+            workspaceId,
+            chatId,
+            toolCallId,
+            workflowId: '',
+            copilotToolExecution: true,
+            billingAttribution: await resolveBillingAttribution({
+              actorUserId: actor.userId,
+              workspaceId,
+            }),
+            resolvedSecretTraceRegistry: new ResolvedSecretTraceRegistry([], {
+              userId: actor.userId,
+              workspaceId,
+            }),
+          },
+        })
+        const body = toRecord(await response.json())
+        expect(response.status, JSON.stringify(body)).toBe(200)
+        const receipt = compactMcpPresentation(body.output)?.mcpPresentation
+        if (!receipt) throw new Error('Expected managed MCP presentation')
+        presentationKeys.add(`${MCP_PRESENTATION_PREFIX}${chatId}/${receipt.id}.json`)
+        const input = { chatId, id: receipt.id }
+        const saved = await readMcpResult.execute({ principal, input })
+        expect(saved.result._meta?.label).toBe('Safe app metadata')
+        expect.soft(JSON.stringify(saved)).not.toContain(actor.token)
+        const asset = await readMcpResultAsset.execute({ principal, input: { ...input, index: 0 } })
+        expect(asset.buffer.toString()).toContain('Safe report ')
+        expect.soft(asset.buffer.toString()).not.toContain(actor.token)
+        const live = await callMcpAppTool.execute({ principal, input: { ...input, name: 'fetch' } })
+        expect(live._meta?.label).toBe('Safe app metadata')
+        expect.soft(JSON.stringify(live)).not.toContain(actor.token)
+        const liveBlob = toRecord(toRecord(live.content[0]).resource).blob
+        expect(typeof liveBlob).toBe('string')
+        expect(Buffer.from(String(liveBlob), 'base64').toString()).toContain('Safe report ')
+        expect(Buffer.from(String(liveBlob), 'base64').toString()).toContain(':end')
+        expect.soft(Buffer.from(String(liveBlob), 'base64').toString()).not.toContain(actor.token)
+        const resource = await readMcpAppResource.execute({
+          principal,
+          input: { ...input, uri: 'file:///private-report.txt' },
+        })
+        expect(JSON.stringify(resource)).toContain('Safe report ')
+        expect.soft(JSON.stringify(resource)).not.toContain(actor.token)
+        const frame = await readMcpAppFrame.execute({ principal, input })
+        const encoded = frame.buffer.toString().match(/atob\('([^']+)'\)/)?.[1]
+        expect(encoded).toBeTruthy()
+        expect(Buffer.from(encoded ?? '', 'base64').toString()).toContain('Safe report ')
+        expect.soft(Buffer.from(encoded ?? '', 'base64').toString()).not.toContain(actor.token)
+      } finally {
+        echoToken = false
+        onInitialize = undefined
+      }
+    }
+  )
+
+  it('rechecks actor eligibility before reading a tool result attachment', async () => {
+    const actor = actors[0]
+    onTool = async () => {
+      await db.update(user).set({ emailVerified: false }).where(eq(user.id, actor.userId))
+    }
+    const before = events.filter((event) => event.method === 'resources/read').length
+    try {
+      const result = await executeManagedMcpToolUseCase.execute({
+        principal: createSessionPrincipal({ userId: actor.userId }),
+        input: {
+          workspaceId,
+          credentialId: actor.credentialId,
+          toolName: 'fetch',
+          arguments: { linked: true },
+          presentation: 'snapshot',
+          appOrigin: { toolName: 'fetch', resourceUri: appUri },
+        },
+      })
+      expect(result.success).toBe(true)
+      expect(events.filter((event) => event.method === 'resources/read')).toHaveLength(before)
+      expect(result.presentation?.resources ?? []).toEqual([])
+    } finally {
+      onTool = undefined
+      await db.update(user).set({ emailVerified: true }).where(eq(user.id, actor.userId))
+    }
+  })
+
   it('reads a complete diagram with one handshake per authorized operation and disposes both transports', async () => {
     setupDelay = 150
     try {
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/file-category.ts b/apps/sim/lib/uploads/utils/file-category.ts
similarity index 100%
rename from apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/file-category.ts
rename to apps/sim/lib/uploads/utils/file-category.ts
diff --git a/apps/sim/next.config.ts b/apps/sim/next.config.ts
index 6d9b2a3a0fe..a575ddc0aa3 100644
--- a/apps/sim/next.config.ts
+++ b/apps/sim/next.config.ts
@@ -423,6 +423,13 @@ const nextConfig: NextConfig = {
             key: 'X-Frame-Options',
             value: 'SAMEORIGIN',
           },
+        ],
+      },
+      {
+        // MCP App frames supply an opaque-origin sandbox policy with provider-declared domains.
+        source:
+          '/((?!workspace|chat|login|signup|api/mothership/chats/[^/]+/mcp-results/[^/]+/frame/?$|$).*)',
+        headers: [
           {
             key: 'Content-Security-Policy',
             value: getMainCSPPolicy(),
diff --git a/apps/sim/package.json b/apps/sim/package.json
index 1a8f53bc0dc..ee31c89436e 100644
--- a/apps/sim/package.json
+++ b/apps/sim/package.json
@@ -21,6 +21,7 @@
     "build:sandbox-bundles": "bun run ./lib/execution/sandbox/bundles/build.ts",
     "start": "next start",
     "test": "vitest run",
+    "test:mcp-app:e2e": "bun --no-env-file scripts/test-mcp-app-e2e.ts",
     "test:scim:e2e": "bun run scripts/test-scim-e2e.ts",
     "test:workflow-version-compare:e2e": "bun --no-env-file scripts/test-workflow-version-compare-e2e.ts",
     "test:workflow-stop-after:e2e": "bun --no-env-file scripts/test-workflow-stop-after-e2e.ts",
@@ -89,6 +90,7 @@
     "@hookform/resolvers": "5.2.2",
     "@linear/sdk": "91.0.0",
     "@marsidev/react-turnstile": "1.4.2",
+    "@modelcontextprotocol/ext-apps": "1.7.5",
     "@modelcontextprotocol/sdk": "1.31.0",
     "@monaco-editor/react": "4.7.0",
     "@napi-rs/canvas": "0.1.100",
@@ -272,6 +274,7 @@
   "devDependencies": {
     "@next/env": "16.4.0",
     "@opentelemetry/context-async-hooks": "2.10.0",
+    "@playwright/test": "1.61.1",
     "@sim/testing": "workspace:*",
     "@sim/tsconfig": "workspace:*",
     "@tailwindcss/postcss": "^4.3.3",
@@ -297,6 +300,8 @@
     "@vitejs/plugin-react": "^6.0.5",
     "@vitest/coverage-v8": "^5.0.1",
     "artillery": "2.0.34",
+    "buffer": "5.6.0",
+    "esbuild": "0.28.1",
     "node-gyp": "12.4.0",
     "postcss": "^8",
     "postcss-load-config": "6.0.1",
diff --git a/apps/sim/scripts/fixtures/mcp-app.tsx b/apps/sim/scripts/fixtures/mcp-app.tsx
new file mode 100644
index 00000000000..4cfd91856bf
--- /dev/null
+++ b/apps/sim/scripts/fixtures/mcp-app.tsx
@@ -0,0 +1,71 @@
+import { StrictMode } from 'react'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { ThemeProvider } from 'next-themes'
+import { createRoot } from 'react-dom/client'
+import type { McpPresentationReceipt } from '@/lib/mcp/presentation'
+import { useDocPreviewBinary } from '@/app/workspace/[workspaceId]/files/components/file-viewer/use-doc-preview-binary'
+import { ChatSurfaceProvider } from '@/app/workspace/[workspaceId]/home/components/chat-surface-context'
+import { McpResult } from '@/app/workspace/[workspaceId]/home/components/message-content/components/mcp-result/mcp-result'
+import { McpResourceContent } from '@/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-content/components/mcp-resource-content'
+import { FileContentSourceProvider } from '@/hooks/use-file-content-source'
+
+const queryClient = new QueryClient()
+const source = {
+  buildUrl: () => '/api/fixture/assets/0',
+  resolveImageSrc: () => undefined,
+  hasCommittedContent: true,
+}
+function BinaryPreviewProbe() {
+  const preview = useDocPreviewBinary('fixture-workspace', {
+    id: 'report',
+    key: 'report',
+    size: 0,
+    updatedAt: new Date(0),
+  })
+  return (
+    <pre>
+      {preview.data
+        ? `${preview.state}:${new TextDecoder().decode(preview.data.slice(0, 5))}`
+        : preview.state}
+    </pre>
+  )
+}
+const receipt: McpPresentationReceipt = {
+  id: 'a'.repeat(64),
+  title: 'Report',
+  hasApp: true,
+  items: [],
+}
+const root = document.getElementById('root')
+if (!root) throw new Error('Fixture root is missing')
+
+createRoot(root).render(
+  <StrictMode>
+    <ThemeProvider attribute='class' defaultTheme='light'>
+      <QueryClientProvider client={queryClient}>
+        <ChatSurfaceProvider chatId='fixture-chat'>
+          {location.pathname === '/artifact' ? (
+            <McpResourceContent
+              chatId='fixture-chat'
+              resource={{
+                type: 'mcp',
+                id: 'fixture',
+                title: 'Artifact',
+                mcp: {
+                  presentationId: receipt.id,
+                  index: Number(new URL(location.href).searchParams.get('index')),
+                },
+              }}
+            />
+          ) : location.pathname === '/preview' ? (
+            <FileContentSourceProvider value={source}>
+              <BinaryPreviewProbe />
+            </FileContentSourceProvider>
+          ) : (
+            <McpResult receipt={receipt} />
+          )}
+        </ChatSurfaceProvider>
+      </QueryClientProvider>
+    </ThemeProvider>
+  </StrictMode>
+)
diff --git a/apps/sim/scripts/fixtures/mcp-video.mp4 b/apps/sim/scripts/fixtures/mcp-video.mp4
new file mode 100644
index 00000000000..2136470a0b3
Binary files /dev/null and b/apps/sim/scripts/fixtures/mcp-video.mp4 differ
diff --git a/apps/sim/scripts/test-mcp-app-e2e.ts b/apps/sim/scripts/test-mcp-app-e2e.ts
new file mode 100644
index 00000000000..cf22094d650
--- /dev/null
+++ b/apps/sim/scripts/test-mcp-app-e2e.ts
@@ -0,0 +1,542 @@
+import assert from 'node:assert/strict'
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { createServer, type Server } from 'node:http'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { json } from 'node:stream/consumers'
+import { fileURLToPath } from 'node:url'
+import { type Browser, chromium, webkit } from '@playwright/test'
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { interruptibleSleep } from '@sim/utils/helpers'
+import { toRecord } from '@sim/utils/object'
+import { Document, Packer, Paragraph } from 'docx'
+import { build } from 'esbuild'
+import { PDFDocument } from 'pdf-lib'
+import PptxGenJS from 'pptxgenjs'
+import * as XLSX from 'xlsx'
+import { buildMcpAppFrame } from '@/lib/mcp/app-frame'
+
+/** Exercises the production sandbox with the real SDK: handshake, isolation, CSP, source checks and teardown. */
+const logger = createLogger('McpAppE2E')
+const reportPath = process.env.MCP_APP_E2E_REPORT_PATH
+assert(reportPath, 'MCP_APP_E2E_REPORT_PATH must be provided')
+const browserName = process.env.MCP_APP_E2E_BROWSER ?? 'chromium'
+assert(browserName === 'chromium' || browserName === 'webkit', 'Unsupported MCP App browser')
+await writeFile(
+  reportPath,
+  JSON.stringify({
+    checks: [{ name: 'Setup', passed: false, error: 'Browser fixture setup did not complete' }],
+  })
+)
+const directory = await mkdtemp(path.join(tmpdir(), 'sim-mcp-app-'))
+const checks: { name: string; passed: boolean; durationMs: number; error?: string }[] = []
+const browserErrors: { message: string; stack?: string }[] = []
+let calls = 0
+let blockedRequests = 0
+const toolRequests: unknown[] = []
+const resourceRequests: unknown[] = []
+
+async function bundleFile(entry: string, output: string) {
+  await build({
+    entryPoints: [entry],
+    outfile: output,
+    bundle: true,
+    ignoreAnnotations: true,
+    platform: 'browser',
+    format: 'esm',
+    target: 'es2022',
+    external: ['node:async_hooks'],
+    loader: { '.ttf': 'dataurl' },
+    jsx: 'automatic',
+    tsconfig: path.join(import.meta.dirname, '../tsconfig.json'),
+    alias: { 'node:buffer': fileURLToPath(import.meta.resolve('buffer/')) },
+    define: { 'process.env.NODE_ENV': '"development"', 'process.env': '{}' },
+    plugins: [
+      {
+        name: 'fixture-next-font',
+        setup(builder) {
+          builder.onResolve({ filter: /^next\/font\/(google|local)$/ }, () => ({
+            path: 'font',
+            namespace: 'fixture-next-font',
+          }))
+          builder.onLoad({ filter: /.*/, namespace: 'fixture-next-font' }, () => ({
+            contents:
+              'export const Inter = () => ({ className: "", style: { fontFamily: "sans-serif" } }); export default Inter;',
+            loader: 'js',
+          }))
+        },
+      },
+    ],
+  })
+  return readFile(output, 'utf8')
+}
+
+async function bundle(name: string, source: string) {
+  const entry = path.join(directory, `${name}.ts`)
+  await writeFile(entry, source)
+  return bundleFile(entry, path.join(directory, `${name}.js`))
+}
+
+let browser: Browser | undefined
+let server: Server | undefined
+let captureFailure: (() => Promise<unknown>) | undefined
+try {
+  const pdf = await PDFDocument.create()
+  pdf.addPage().drawText('MCP PDF preview')
+  const pdfBytes = await pdf.save()
+  const docxBytes = await Packer.toBuffer(
+    new Document({ sections: [{ children: [new Paragraph('MCP document content')] }] })
+  )
+  const workbook = XLSX.utils.book_new()
+  XLSX.utils.book_append_sheet(
+    workbook,
+    XLSX.utils.aoa_to_sheet([
+      ['Report', 'Value'],
+      ['MCP worksheet content', 42],
+    ]),
+    'Report'
+  )
+  const spreadsheetBytes: Buffer = XLSX.write(workbook, { type: 'buffer', bookType: 'xlsx' })
+  const slides = new PptxGenJS()
+  slides.addSlide().addText('MCP slide content', { x: 1, y: 1, w: 6, h: 1 })
+  const slideBytes = await slides.write({ outputType: 'nodebuffer' })
+  assert(Buffer.isBuffer(slideBytes))
+  const audioBytes = Buffer.alloc(8044, 128)
+  audioBytes.write('RIFF', 0)
+  audioBytes.writeUInt32LE(8036, 4)
+  audioBytes.write('WAVEfmt ', 8)
+  audioBytes.writeUInt32LE(16, 16)
+  audioBytes.writeUInt16LE(1, 20)
+  audioBytes.writeUInt16LE(1, 22)
+  audioBytes.writeUInt32LE(8000, 24)
+  audioBytes.writeUInt32LE(8000, 28)
+  audioBytes.writeUInt16LE(1, 32)
+  audioBytes.writeUInt16LE(8, 34)
+  audioBytes.write('data', 36)
+  audioBytes.writeUInt32LE(8000, 40)
+  const artifacts = [
+    { mimeType: 'application/pdf', title: 'Report.pdf', bytes: pdfBytes, kind: 'file' },
+    {
+      mimeType: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+      title: 'Report.docx',
+      bytes: docxBytes,
+      kind: 'file',
+    },
+    {
+      mimeType: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+      title: 'Report.xlsx',
+      bytes: spreadsheetBytes,
+      kind: 'file',
+    },
+    {
+      mimeType: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+      title: 'Report.pptx',
+      bytes: slideBytes,
+      kind: 'file',
+    },
+    {
+      mimeType: 'video/mp4',
+      title: 'Report.mp4',
+      bytes: await readFile(path.join(import.meta.dirname, 'fixtures/mcp-video.mp4')),
+      kind: 'file',
+    },
+    { mimeType: 'audio/wav; codecs=1', title: 'Report.wav', bytes: audioBytes, kind: 'audio' },
+  ]
+  const assetRequests: number[] = []
+  const appModule = fileURLToPath(import.meta.resolve('@modelcontextprotocol/ext-apps'))
+  const bridgeModule = fileURLToPath(
+    import.meta.resolve('@modelcontextprotocol/ext-apps/app-bridge')
+  )
+  const appScript = await bundle(
+    'app',
+    `
+import { App } from ${JSON.stringify(appModule)};
+const app = new App({ name: 'Fixture', version: '1' }, {});
+const state = {};
+const show = () => { document.querySelector('pre').textContent = JSON.stringify(state); };
+app.ontoolinput = ({ arguments: args }) => { state.input = args; show(); };
+app.ontoolresult = async (result) => {
+  state.privateData = result._meta.privateData;
+  state.result = result.structuredContent.total;
+  try { parent.document.body; state.parentBlocked = false; } catch { state.parentBlocked = true; }
+  try { top.document.cookie; state.cookiesBlocked = false; } catch { state.cookiesBlocked = true; }
+  try { localStorage.getItem('fixture'); state.storageBlocked = false; } catch { state.storageBlocked = true; }
+  try { globalThis.eval('1 + 1'); state.evalBlocked = false; } catch { state.evalBlocked = true; }
+  state.allowed = await fetch('https://allowed.test/value').then(r => r.text());
+  try { await fetch('https://blocked.test/value'); state.networkBlocked = false; } catch { state.networkBlocked = true; }
+  state.tool = await app.callServerTool({ name: 'change_report', arguments: { revision: 2 } });
+  state.resource = await app.readServerResource({ uri: 'file:///report.txt' });
+  state.ready = true;
+  show();
+};
+app.onhostcontextchanged = (context) => { state.theme = context.theme; show(); };
+app.onteardown = async () => { state.closed = true; show(); return {}; };
+await app.connect();
+`
+  )
+  const appHtml = `<!doctype html><html><body><h1>MCP report</h1><pre>Opening</pre><script type="module">${appScript.replace(/<\/script/gi, '<\\/script')}</script></body></html>`
+  const frame = buildMcpAppFrame(appHtml, {
+    ui: { csp: { connectDomains: ['https://allowed.test'] } },
+  })
+  const hostScript = await bundle(
+    'host',
+    `
+import { AppBridge, PostMessageTransport } from ${JSON.stringify(bridgeModule)};
+const frame = document.querySelector('iframe');
+const bridge = new AppBridge(null, { name: 'Sim', version: '1' }, { serverTools: {}, serverResources: {} }, { hostContext: { theme: 'light', displayMode: 'inline', availableDisplayModes: ['inline'] } });
+window.fixtureBridge = bridge;
+window.fixtureCalls = 0;
+bridge.onsandboxready = () => bridge.sendSandboxResourceReady({ html: '', sandbox: 'allow-scripts' });
+bridge.oninitialized = async () => {
+  await bridge.sendToolInput({ arguments: { city: 'Example' } });
+  await bridge.sendToolResult({ content: [], structuredContent: { total: 42 }, _meta: { privateData: 'app-only' } });
+};
+bridge.oncalltool = async (params) => { window.fixtureCalls++; return fetch('/tool', { method: 'POST', body: JSON.stringify(params) }).then(r => r.json()); };
+bridge.onreadresource = async () => ({ contents: [{ uri: 'file:///report.txt', text: 'Resource bytes' }] });
+await bridge.connect(new PostMessageTransport(frame.contentWindow, frame.contentWindow));
+frame.src = '/frame';
+`
+  )
+  const reactScript = await bundleFile(
+    path.join(import.meta.dirname, 'fixtures/mcp-app.tsx'),
+    path.join(directory, 'react.js')
+  )
+  await bundle(
+    'react-loader',
+    `import { Buffer } from 'node:buffer'; import Prism from ${JSON.stringify(fileURLToPath(import.meta.resolve('prismjs')))}; globalThis.Buffer = Buffer; globalThis.Prism = Prism; const entry = '/react.js'; await import(entry);`
+  )
+  server = createServer(async (request, response) => {
+    if (request.url === '/frame' || request.url?.endsWith('/frame')) {
+      response
+        .writeHead(200, {
+          'Content-Type': frame.contentType,
+          'Content-Security-Policy': frame.policy,
+          'Cache-Control': 'private, no-store',
+          'X-Content-Type-Options': 'nosniff',
+        })
+        .end(frame.buffer)
+    } else if (request.url === '/attacker') {
+      response.writeHead(200, { 'Content-Type': 'text/html' }).end(`<!doctype html><script>
+        const forge = (id) => ({ jsonrpc: '2.0', id, method: 'tools/call', params: { name: 'change_report', arguments: { revision: 2 } } });
+        parent.frames[0].postMessage(forge('forged-proxy'), '*');
+        parent.postMessage(forge('forged-host'), '*');
+        parent.postMessage({ attackerReady: true }, '*');
+      </script>`)
+    } else if (
+      request.url === '/react' ||
+      request.url === '/preview' ||
+      request.url?.startsWith('/artifact?')
+    ) {
+      response
+        .writeHead(200, { 'Content-Type': 'text/html' })
+        .end(
+          '<!doctype html><html><head><link rel="stylesheet" href="/react.css"></head><body><div id="root"></div><script type="module" src="/react-loader.js"></script></body></html>'
+        )
+    } else if (request.url === '/react.js') {
+      response.writeHead(200, { 'Content-Type': 'text/javascript' }).end(reactScript)
+    } else if (request.url?.endsWith('/resources')) {
+      resourceRequests.push(await json(request))
+      response
+        .writeHead(200, { 'Content-Type': 'application/json' })
+        .end(JSON.stringify({ contents: [{ uri: 'file:///report.txt', text: 'Resource bytes' }] }))
+    } else if (/\/assets\/\d+$/.test(request.url ?? '')) {
+      const index = Number(request.url?.split('/').at(-1))
+      const artifact = artifacts[index]
+      if (!artifact) {
+        response.writeHead(404).end()
+        return
+      }
+      assetRequests.push(index)
+      response.writeHead(200, { 'Content-Type': artifact.mimeType }).end(artifact.bytes)
+    } else if (request.url?.startsWith('/api/') && request.method === 'GET') {
+      response.writeHead(200, { 'Content-Type': 'application/json' }).end(
+        JSON.stringify({
+          workspaceId: 'fixture-workspace',
+          receipt: {
+            id: 'a'.repeat(64),
+            title: 'Report',
+            hasApp: true,
+            items: artifacts.map(({ mimeType, title, kind }, index) => ({
+              index,
+              identity: `artifact-${index}`,
+              mimeType,
+              title,
+              kind,
+            })),
+          },
+          arguments: { city: 'Example' },
+          result: {
+            content: [],
+            structuredContent: { total: 42 },
+            _meta: { privateData: 'app-only' },
+          },
+        })
+      )
+    } else if (request.url === '/host.js') {
+      response.writeHead(200, { 'Content-Type': 'text/javascript' }).end(hostScript)
+    } else if (request.url === '/tool' || request.url?.endsWith('/tools')) {
+      toolRequests.push(await json(request))
+      calls++
+      response
+        .writeHead(200, { 'Content-Type': 'application/json' })
+        .end(JSON.stringify({ content: [{ type: 'text', text: 'Revision 2' }] }))
+    } else if (/^\/[\w.-]+\.(js|css)$/.test(request.url ?? '')) {
+      try {
+        const filename = path.basename(request.url ?? '')
+        const bytes = await readFile(path.join(directory, filename))
+        response
+          .writeHead(200, {
+            'Content-Type': filename.endsWith('.css') ? 'text/css' : 'text/javascript',
+          })
+          .end(bytes)
+      } catch {
+        response.writeHead(404).end()
+      }
+    } else {
+      response
+        .writeHead(200, {
+          'Content-Type': 'text/html',
+          'Set-Cookie': 'fixture=private; HttpOnly; SameSite=Strict',
+          'Content-Security-Policy':
+            "default-src 'none'; script-src 'self'; frame-src 'self'; connect-src 'self'",
+        })
+        .end(
+          '<!doctype html><html><body><h1>Sim MCP App host</h1><iframe title="Report" sandbox="allow-scripts allow-same-origin" width="900" height="600"></iframe><script type="module" src="/host.js"></script></body></html>'
+        )
+    }
+  })
+  browser = await (browserName === 'webkit' ? webkit : chromium).launch()
+
+  async function check(name: string, verify: () => Promise<void>) {
+    const started = performance.now()
+    const controller = new AbortController()
+    try {
+      await Promise.race([
+        verify(),
+        interruptibleSleep(30_000, controller.signal).then(() => {
+          if (!controller.signal.aborted) throw new Error('Browser check exceeded 30 seconds')
+        }),
+      ])
+      checks.push({ name, passed: true, durationMs: performance.now() - started })
+    } catch (error) {
+      checks.push({
+        name,
+        passed: false,
+        durationMs: performance.now() - started,
+        error: getErrorMessage(error),
+      })
+      throw error
+    } finally {
+      controller.abort()
+    }
+  }
+
+  const runningServer = server
+  await new Promise<void>((resolve) => runningServer.listen(0, '127.0.0.1', resolve))
+  const address = server.address()
+  assert(address && typeof address !== 'string')
+  const page = await browser.newPage()
+  page.setDefaultTimeout(20_000)
+  captureFailure = () => page.screenshot({ path: `${reportPath}.png`, fullPage: true })
+  page.on('pageerror', (error) => {
+    browserErrors.push({ message: error.message, stack: error.stack })
+    logger.error('Browser fixture error', { message: error.message, stack: error.stack })
+  })
+  await page.route('https://allowed.test/**', (route) =>
+    route.fulfill({ body: 'Allowed bytes', headers: { 'Access-Control-Allow-Origin': '*' } })
+  )
+  await page.route('https://blocked.test/**', (route) => {
+    blockedRequests++
+    return route.fulfill({ body: 'Unexpected', headers: { 'Access-Control-Allow-Origin': '*' } })
+  })
+  await page.goto(`http://127.0.0.1:${address.port}`)
+  await check('Real App handshake, private data, tools and resources', async () => {
+    const content = page.frameLocator('iframe').frameLocator('iframe').locator('pre')
+    await content.filter({ hasText: '"ready":true' }).waitFor({ timeout: 20_000 })
+    const result = JSON.parse(await content.innerText())
+    assert.deepEqual(result.input, { city: 'Example' })
+    assert.equal(result.privateData, 'app-only')
+    assert.equal(result.result, 42)
+    assert.equal(result.tool.content[0].text, 'Revision 2')
+    assert.equal(result.resource.contents[0].text, 'Resource bytes')
+    assert.equal(calls, 1)
+  })
+  await check('Opaque origins and declared network policy', async () => {
+    const result = JSON.parse(
+      await page.frameLocator('iframe').frameLocator('iframe').locator('pre').innerText()
+    )
+    for (const name of [
+      'parentBlocked',
+      'cookiesBlocked',
+      'storageBlocked',
+      'evalBlocked',
+      'networkBlocked',
+    ])
+      assert.equal(result[name], true, name)
+    assert.equal(result.allowed, 'Allowed bytes')
+    assert.equal(blockedRequests, 0)
+    const proxy = page.frames().find((candidate) => candidate.url().endsWith('/frame'))
+    assert(proxy)
+    assert.equal(
+      await proxy.evaluate(() => {
+        try {
+          parent.document.body
+          return false
+        } catch {
+          return true
+        }
+      }),
+      true
+    )
+  })
+  await check('Foreign-window messages, theme update and teardown', async () => {
+    const attacker = await page.evaluate(async () => {
+      const frame = document.createElement('iframe')
+      frame.sandbox = 'allow-scripts'
+      frame.src = '/attacker'
+      await new Promise<void>((resolve) => {
+        const listener = (event: MessageEvent) => {
+          if (event.source !== frame.contentWindow || !event.data?.attackerReady) return
+          window.removeEventListener('message', listener)
+          resolve()
+        }
+        window.addEventListener('message', listener)
+        document.body.append(frame)
+      })
+      return true
+    })
+    assert(attacker)
+    await page.waitForTimeout(250)
+    assert.equal(calls, 1)
+    await page.locator('iframe[src="/attacker"]').evaluate((element) => element.remove())
+    await page.evaluate(async () => {
+      if (!('fixtureBridge' in window)) throw new Error('Missing App bridge')
+      const bridge = window.fixtureBridge as {
+        setHostContext: (value: {
+          theme: 'dark'
+          displayMode: 'inline'
+          availableDisplayModes: ['inline']
+        }) => void
+        teardownResource: (params: object) => Promise<unknown>
+      }
+      window.postMessage(
+        { jsonrpc: '2.0', id: 'forged', method: 'tools/call', params: { name: 'change_report' } },
+        '*'
+      )
+      bridge.setHostContext({
+        theme: 'dark',
+        displayMode: 'inline',
+        availableDisplayModes: ['inline'],
+      })
+      await bridge.teardownResource({})
+    })
+    const result = JSON.parse(
+      await page.frameLocator('iframe').frameLocator('iframe').locator('pre').innerText()
+    )
+    assert.equal(result.theme, 'dark')
+    assert.equal(result.closed, true)
+    assert.equal(
+      await page.evaluate(() => ('fixtureCalls' in window ? window.fixtureCalls : undefined)),
+      1
+    )
+    assert.equal(calls, 1)
+  })
+  await check(
+    'Production React card and App host open, close and reopen under StrictMode',
+    async () => {
+      const before = calls
+      await page.goto(`http://127.0.0.1:${address.port}/react`)
+      await page.getByRole('button', { name: 'Open Report', exact: true }).focus()
+      await page.keyboard.press('Enter')
+      const content = page.frameLocator('iframe').frameLocator('iframe').locator('pre')
+      await content.filter({ hasText: '"ready":true' }).waitFor({ timeout: 20_000 })
+      assert.deepEqual(JSON.parse(await content.innerText()).input, { city: 'Example' })
+      assert.equal(calls, before + 1)
+      assert.equal(await page.evaluate(() => document.activeElement?.textContent), 'Open Report')
+      await page.getByRole('button', { name: 'Close app', exact: true }).click()
+      await page.locator('iframe').waitFor({ state: 'detached' })
+      assert.equal(await page.evaluate(() => document.activeElement?.textContent), 'Open Report')
+      await page.getByRole('button', { name: 'Open Report', exact: true }).click()
+      await content.filter({ hasText: '"ready":true' }).waitFor({ timeout: 20_000 })
+      assert.equal(calls, before + 2)
+    }
+  )
+  assert(toolRequests.length > 0 && resourceRequests.length > 0)
+  for (const request of toolRequests) {
+    const input = toRecord(request)
+    assert.deepEqual(
+      { name: input.name, arguments: input.arguments },
+      { name: 'change_report', arguments: { revision: 2 } }
+    )
+  }
+  for (const request of resourceRequests) assert.deepEqual(request, { uri: 'file:///report.txt' })
+  await check('Committed binary previews fetch without reported file size', async () => {
+    await page.goto(`http://127.0.0.1:${address.port}/preview`)
+    await page.getByText('ready:%PDF-', { exact: true }).waitFor({ timeout: 20_000 })
+  })
+  for (const [index, text] of [
+    [1, 'MCP document content'],
+    [2, 'MCP worksheet content'],
+    [3, 'MCP slide content'],
+  ] as const) {
+    await check(`Native ${artifacts[index].title} preview renders document bytes`, async () => {
+      await page.goto(`http://127.0.0.1:${address.port}/artifact?index=${index}`)
+      await page.getByText(text, { exact: true }).waitFor({ timeout: 20_000 })
+      assert(assetRequests.includes(index))
+    })
+  }
+  for (const [index, tag] of [
+    [4, 'video'],
+    [5, 'audio'],
+  ] as const) {
+    await check(`Native ${tag} preview decodes and plays artifact bytes`, async () => {
+      await page.goto(`http://127.0.0.1:${address.port}/artifact?index=${index}`)
+      const media = page.locator(tag)
+      await media.waitFor({ timeout: 20_000 })
+      await media.evaluate(async (element) => {
+        if (!(element instanceof HTMLMediaElement)) throw new Error('Missing media element')
+        element.muted = true
+        await element.play()
+      })
+      await page.waitForFunction(
+        (tag) => {
+          const media = document.querySelector(tag)
+          return media instanceof HTMLMediaElement && media.currentTime > 0 && media.error === null
+        },
+        tag,
+        { timeout: 20_000 }
+      )
+      assert(assetRequests.includes(index))
+    })
+  }
+  await page.screenshot({ path: `${reportPath}.png`, fullPage: true })
+  await check('Browser completes without uncaught runtime errors', async () => {
+    assert.deepEqual(browserErrors, [])
+  })
+  logger.info('MCP App browser checks passed', { count: checks.length, reportPath })
+} catch (error) {
+  if (!checks.some((check) => !check.passed))
+    checks.push({ name: 'Setup', passed: false, durationMs: 0, error: getErrorMessage(error) })
+  await captureFailure?.().catch(() => undefined)
+  throw error
+} finally {
+  const runningServer = server
+  const results = await Promise.allSettled([
+    writeFile(reportPath, JSON.stringify({ checks, browserErrors }, null, 2)),
+    browser?.close(),
+    runningServer
+      ? new Promise<void>((resolve) => {
+          runningServer.close(() => resolve())
+          runningServer.closeAllConnections()
+        })
+      : Promise.resolve(),
+    rm(directory, { recursive: true, force: true }),
+  ])
+  for (const result of results) {
+    if (result.status === 'rejected') {
+      logger.error('MCP App fixture cleanup failed', { error: getErrorMessage(result.reason) })
+      process.exitCode = 1
+    }
+  }
+}
diff --git a/apps/sim/tools/index.ts b/apps/sim/tools/index.ts
index bbe9a19177e..1dfbe49b820 100644
--- a/apps/sim/tools/index.ts
+++ b/apps/sim/tools/index.ts
@@ -3328,7 +3328,7 @@ async function executeMcpTool(
         logger.error(`[${actualRequestId}] Request body too large for mcp:${toolId} (HTTP 413)`)
         return {
           success: false,
-          output: {},
+          output: result.output ?? {},
           error: BODY_SIZE_LIMIT_ERROR_MESSAGE,
           timing: {
             startTime: actualStartTime,
@@ -3343,7 +3343,7 @@ async function executeMcpTool(
 
       return {
         success: false,
-        output: {},
+        output: result.output ?? {},
         error: errorMessage,
         timing: {
           startTime: actualStartTime,
@@ -3356,7 +3356,7 @@ async function executeMcpTool(
     if (!result.success) {
       return {
         success: false,
-        output: {},
+        output: result.output ?? {},
         error: result.error || 'MCP tool execution failed',
         timing: {
           startTime: actualStartTime,
diff --git a/bun.lock b/bun.lock
index cfd373b2720..a2840211655 100644
--- a/bun.lock
+++ b/bun.lock
@@ -212,6 +212,7 @@
         "@hookform/resolvers": "5.2.2",
         "@linear/sdk": "91.0.0",
         "@marsidev/react-turnstile": "1.4.2",
+        "@modelcontextprotocol/ext-apps": "1.7.5",
         "@modelcontextprotocol/sdk": "1.31.0",
         "@monaco-editor/react": "4.7.0",
         "@napi-rs/canvas": "0.1.100",
@@ -395,6 +396,7 @@
       "devDependencies": {
         "@next/env": "16.4.0",
         "@opentelemetry/context-async-hooks": "2.10.0",
+        "@playwright/test": "1.61.1",
         "@sim/testing": "workspace:*",
         "@sim/tsconfig": "workspace:*",
         "@tailwindcss/postcss": "^4.3.3",
@@ -420,6 +422,8 @@
         "@vitejs/plugin-react": "^6.0.5",
         "@vitest/coverage-v8": "^5.0.1",
         "artillery": "2.0.34",
+        "buffer": "5.6.0",
+        "esbuild": "0.28.1",
         "node-gyp": "12.4.0",
         "postcss": "^8",
         "postcss-load-config": "6.0.1",
@@ -1512,6 +1516,8 @@
 
     "@microsoft/fetch-event-source": ["@microsoft/fetch-event-source@2.0.1", "", {}, "sha512-W6CLUJ2eBMw3Rec70qrsEW0jOm/3twwJv21mrmj2yORiaVmVYGS4sSS5yUwvQc1ZlDLYGPnClVWmUUMagKNsfA=="],
 
+    "@modelcontextprotocol/ext-apps": ["@modelcontextprotocol/ext-apps@1.7.5", "", { "dependencies": { "@standard-schema/spec": "^1.1.0" }, "peerDependencies": { "@modelcontextprotocol/sdk": "^1.29.0", "react": "^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0", "zod": "^3.25.0 || ^4.0.0" }, "optionalPeers": ["react", "react-dom"] }, "sha512-TjPH2S2y5UEGKhmI6+XGFuqfqOV4ppe1x6DA3txnUaEWkgtA4G5vo14jGKFZmegdkZ1H4QMLyujLvoU1BEdnAg=="],
+
     "@modelcontextprotocol/sdk": ["@modelcontextprotocol/sdk@1.31.0", "", { "dependencies": { "@hono/node-server": "^1.19.9 || ^2.0.5", "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "content-type": "^1.0.5", "cors": "^2.8.5", "cross-spawn": "^7.0.5", "eventsource": "^3.0.2", "eventsource-parser": "^3.0.0", "express": "^5.2.1", "express-rate-limit": "^8.2.1", "hono": "^4.11.4", "jose": "^6.1.3", "json-schema-typed": "^8.0.2", "pkce-challenge": "^5.0.0", "raw-body": "^3.0.0", "zod": "^3.25 || ^4.0", "zod-to-json-schema": "^3.25.1" }, "peerDependencies": { "@cfworker/json-schema": "^4.1.1" }, "optionalPeers": ["@cfworker/json-schema"] }, "sha512-UvTMgnNlnIBO/22ob2RcVGDlcvOslQs8T59+FTGdA0L27a39fdGF/EDETNtDVK4DZGpwomlsYpRdA8UXcVL/pw=="],
 
     "@monaco-editor/loader": ["@monaco-editor/loader@1.7.0", "", { "dependencies": { "state-local": "^1.0.6" } }, "sha512-gIwR1HrJrrx+vfyOhYmCZ0/JcWqG5kbfG7+d3f/C1LXk2EvzAbHSg3MQ5lO2sMlo9izoAZ04shohfKLVT6crVA=="],
@@ -2084,7 +2090,7 @@
 
     "@stablelib/base64": ["@stablelib/base64@1.0.1", "", {}, "sha512-1bnPQqSxSuc3Ii6MhBysoWCg58j97aUjuCSZrGSmDxNqtytIi0k8utUenAwTZN4V5mXXYGsVUI9zeBqy+jBOSQ=="],
 
-    "@standard-schema/spec": ["@standard-schema/spec@1.0.0", "", {}, "sha512-m2bOd0f2RT9k8QJx1JN85cZYyH1RqFBdlwtkSlf4tBDYLCiiZnv1fIIwacK6cqwXavOydf0NPToMQgpKq+dVlA=="],
+    "@standard-schema/spec": ["@standard-schema/spec@1.1.0", "", {}, "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w=="],
 
     "@standard-schema/utils": ["@standard-schema/utils@0.3.0", "", {}, "sha512-e7Mew686owMaPJVNNLs55PUvgz371nKgwsc4vxE49zsODpJEnxgxRo2y/OKrqueavXgZNMDVj3DdHFlaSAeU8g=="],
 
@@ -4084,7 +4090,7 @@
 
     "platform": ["platform@1.3.6", "", {}, "sha512-fnWVljUchTro6RiCFvCXBbNhJc2NijN7oIQxbwsyL0buWJPG85v81ehlHI9fXrJsMNgTofEoWIQeClKpgxFLrg=="],
 
-    "playwright": ["playwright@1.62.1", "", { "dependencies": { "playwright-core": "1.62.1" }, "optionalDependencies": { "fsevents": "2.3.2" }, "bin": { "playwright": "cli.js" } }, "sha512-0M+L3LAD8/nm554LOla9Ayx0j0tmFZ0FBcoQ7F1VuVHpM/XpiC8RcDzBQB8W5+hA8L22THxELzeF+2WcUzvcLg=="],
+    "playwright": ["playwright@1.61.1", "", { "dependencies": { "playwright-core": "1.61.1" }, "optionalDependencies": { "fsevents": "2.3.2" }, "bin": { "playwright": "cli.js" } }, "sha512-DWnY5o3YbLWK4GovuAVwpqL+1VwGNdUGrRr++8j8PtQQzvAVZUIMjKQ90fY689sEJZJBbZVw1rXaOKSTitkzPQ=="],
 
     "playwright-core": ["playwright-core@1.61.1", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-h7Qlt6m4REp25qvIdvbDtVmD4LqVXfpRxhORv9L0jzETM05p4fuPJ3dKyuSXQxDSbXnmS79HAgi9589lGSpLkg=="],
 
@@ -4858,8 +4864,6 @@
 
     "@a2a-js/sdk/jose": ["jose@6.2.3", "", {}, "sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw=="],
 
-    "@ai-sdk/provider-utils/@standard-schema/spec": ["@standard-schema/spec@1.1.0", "", {}, "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w=="],
-
     "@antfu/install-pkg/package-manager-detector": ["package-manager-detector@1.6.0", "", {}, "sha512-61A5ThoTiDG/C8s8UMZwSorAGwMJ0ERVGj2OjoW5pAalsNOg15+iQiPzrLJ4jhZ1HJzmC2PIHT2oEiH3R5fzNA=="],
 
     "@antfu/install-pkg/tinyexec": ["tinyexec@1.2.4", "", {}, "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg=="],
@@ -5042,8 +5046,6 @@
 
     "@better-auth/core/@opentelemetry/semantic-conventions": ["@opentelemetry/semantic-conventions@1.41.1", "", {}, "sha512-/UhIkaZgPutTFmQ7RnIJGgDXZmtEJ7Dvi86xNTFWcnRxVRNk/aotsqDJYeEvDP+FSMB2SdW+pQzNMcWP0rwuNA=="],
 
-    "@better-auth/core/@standard-schema/spec": ["@standard-schema/spec@1.1.0", "", {}, "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w=="],
-
     "@better-auth/core/jose": ["jose@6.2.3", "", {}, "sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw=="],
 
     "@better-auth/oauth-provider/jose": ["jose@6.2.3", "", {}, "sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw=="],
@@ -5178,8 +5180,6 @@
 
     "@playwright/browser-chromium/playwright-core": ["playwright-core@1.62.1", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-wPYSwEBJY9GHraISXqyqtx0na0LpO3XEX7jNDhntbex7tzUS7kLnZsOlFruFJB4Hi/rhDMjXGqHewDZ68nYZVw=="],
 
-    "@playwright/test/playwright": ["playwright@1.61.1", "", { "dependencies": { "playwright-core": "1.61.1" }, "optionalDependencies": { "fsevents": "2.3.2" }, "bin": { "playwright": "cli.js" } }, "sha512-DWnY5o3YbLWK4GovuAVwpqL+1VwGNdUGrRr++8j8PtQQzvAVZUIMjKQ90fY689sEJZJBbZVw1rXaOKSTitkzPQ=="],
-
     "@radix-ui/react-accordion/@radix-ui/primitive": ["@radix-ui/primitive@1.1.4", "", {}, "sha512-7AdCK9PQyiljKoBDbN8OuctCbd/esdwZPQ8RtOE3SsyQtUpiPb+ND75q0jEhC1m1ecBI0MFNeLJvwIh9iKHRcQ=="],
 
     "@radix-ui/react-accordion/@radix-ui/react-collapsible": ["@radix-ui/react-collapsible@1.1.14", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-id": "1.1.2", "@radix-ui/react-presence": "1.1.6", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-use-controllable-state": "1.2.3", "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-9bT+FvifX1FK2Mj6UEsTdyu0cN3JaA3KdfhaBao+ONrYFy/pyOy3TU1TNw7iOk1o+0hOEq67RojlUUmoFGwxyA=="],
@@ -5424,6 +5424,8 @@
 
     "artillery/js-yaml": ["js-yaml@3.15.1", "", { "dependencies": { "argparse": "^1.0.7", "esprima": "^4.0.0" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag=="],
 
+    "artillery/playwright": ["playwright@1.62.1", "", { "dependencies": { "playwright-core": "1.62.1" }, "optionalDependencies": { "fsevents": "2.3.2" }, "bin": { "playwright": "cli.js" } }, "sha512-0M+L3LAD8/nm554LOla9Ayx0j0tmFZ0FBcoQ7F1VuVHpM/XpiC8RcDzBQB8W5+hA8L22THxELzeF+2WcUzvcLg=="],
+
     "artillery/socket.io-client": ["socket.io-client@4.8.3", "", { "dependencies": { "@socket.io/component-emitter": "~3.1.0", "debug": "~4.4.1", "engine.io-client": "~6.6.1", "socket.io-parser": "~4.2.4" } }, "sha512-uP0bpjWrjQmUt5DTHq9RuoCBdFJF10cdX9X+a368j/Ft0wmaVgxlrjvK3kjvgCODOMMOz9lcaRzxmso0bTWZ/g=="],
 
     "asn1js/tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
@@ -5512,8 +5514,6 @@
 
     "echarts/tslib": ["tslib@2.3.0", "", {}, "sha512-N82ooyxVNm6h1riLCoyS9e3fuJ3AMG2zIZs2Gd1ATcSFjSA23Q0fzjjZeh0jbJvWVDZ0cJT8yaNNaaXHzueNjg=="],
 
-    "effect/@standard-schema/spec": ["@standard-schema/spec@1.1.0", "", {}, "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w=="],
-
     "electron/@types/node": ["@types/node@24.13.3", "", { "dependencies": { "undici-types": "~7.18.0" } }, "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q=="],
 
     "electron-builder/chalk": ["chalk@4.1.2", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
@@ -5556,8 +5556,6 @@
 
     "framer-motion/tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
 
-    "fumadocs-mdx/@standard-schema/spec": ["@standard-schema/spec@1.1.0", "", {}, "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w=="],
-
     "fumadocs-mdx/chokidar": ["chokidar@5.0.0", "", { "dependencies": { "readdirp": "^5.0.0" } }, "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw=="],
 
     "fumadocs-mdx/picomatch": ["picomatch@4.0.4", "", {}, "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A=="],
@@ -5666,6 +5664,8 @@
 
     "node-gyp/undici": ["undici@6.28.1", "", {}, "sha512-zWpdTVD54H48CIybL0rWQ3ukpb9d23wM7eH5RtfdmeP70cWHNjtfo7P4vZX+5CoDcO53J4Pu5uXp7lNfjc6DRA=="],
 
+    "nuqs/@standard-schema/spec": ["@standard-schema/spec@1.0.0", "", {}, "sha512-m2bOd0f2RT9k8QJx1JN85cZYyH1RqFBdlwtkSlf4tBDYLCiiZnv1fIIwacK6cqwXavOydf0NPToMQgpKq+dVlA=="],
+
     "nypm/tinyexec": ["tinyexec@1.2.4", "", {}, "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg=="],
 
     "open/wsl-utils": ["wsl-utils@0.1.0", "", { "dependencies": { "is-wsl": "^3.1.0" } }, "sha512-h3Fbisa2nKGPxCpm89Hk33lBLsnaGBvctQopaBSOW/uIs6FTe1ATyAnKFJrzVs9vpGdsTe73WF3V4lIsk4Gacw=="],
@@ -5688,8 +5688,6 @@
 
     "playwright/fsevents": ["fsevents@2.3.2", "", { "os": "darwin" }, "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA=="],
 
-    "playwright/playwright-core": ["playwright-core@1.62.1", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-wPYSwEBJY9GHraISXqyqtx0na0LpO3XEX7jNDhntbex7tzUS7kLnZsOlFruFJB4Hi/rhDMjXGqHewDZ68nYZVw=="],
-
     "plist/xmlbuilder": ["xmlbuilder@15.1.1", "", {}, "sha512-yMqGBqtXyeN1e3TGYvgNgDVZ3j84W4cwkOXQswghol6APgZWaff9lnbvN7MHYJOiXsvGPXtjTYJEiC9J2wv9Eg=="],
 
     "posthog-node/@posthog/core": ["@posthog/core@1.24.4", "", { "dependencies": { "cross-spawn": "^7.0.6" } }, "sha512-S+TolwBHSSJz7WWtgaELQWQqXviSm3uf1e+qorWUts0bZcgPwWzhnmhCUZAhvn0NVpTQHDJ3epv+hHbPLl5dHg=="],
@@ -5982,8 +5980,6 @@
 
     "@octokit/plugin-rest-endpoint-methods/@octokit/types/@octokit/openapi-types": ["@octokit/openapi-types@24.2.0", "", {}, "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg=="],
 
-    "@playwright/test/playwright/fsevents": ["fsevents@2.3.2", "", { "os": "darwin" }, "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA=="],
-
     "@radix-ui/react-accordion/@radix-ui/react-collapsible/@radix-ui/react-presence": ["@radix-ui/react-presence@1.1.6", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-zdTk4PlUO0E18HnZ3wYbW0KkJJxWCdiNYp6g6X1PtONFhxVkg01vliTJAmwIszU6mHiyBOoW9P0rAugl5/hULQ=="],
 
     "@radix-ui/react-accordion/@radix-ui/react-collapsible/@radix-ui/react-use-layout-effect": ["@radix-ui/react-use-layout-effect@1.1.2", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-jrBWOxZITuGcnjRCM2t2U5ZPkCLxD+Ym6DjfssS5haTj2iiak/DOb64JeN6OdLfLgptb6/e2kKR+ZuTrGoZTPA=="],
@@ -6108,6 +6104,10 @@
 
     "artillery/js-yaml/argparse": ["argparse@1.0.10", "", { "dependencies": { "sprintf-js": "~1.0.2" } }, "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg=="],
 
+    "artillery/playwright/fsevents": ["fsevents@2.3.2", "", { "os": "darwin" }, "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA=="],
+
+    "artillery/playwright/playwright-core": ["playwright-core@1.62.1", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-wPYSwEBJY9GHraISXqyqtx0na0LpO3XEX7jNDhntbex7tzUS7kLnZsOlFruFJB4Hi/rhDMjXGqHewDZ68nYZVw=="],
+
     "axios/https-proxy-agent/agent-base": ["agent-base@6.0.2", "", { "dependencies": { "debug": "4" } }, "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ=="],
 
     "builder-util/chalk/supports-color": ["supports-color@7.2.0", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw=="],
diff --git a/packages/db/schema.ts b/packages/db/schema.ts
index 77eed5c65bc..95eb090f8d5 100644
--- a/packages/db/schema.ts
+++ b/packages/db/schema.ts
@@ -5587,8 +5587,13 @@ export interface ManagedOAuthProviderMetadata {
 
 export interface ManagedMcpToolSnapshot {
   name: string
+  title?: string
   description?: string
   inputSchema: Record<string, unknown>
+  outputSchema?: { type: 'object'; [key: string]: unknown }
+  annotations?: Record<string, unknown>
+  _meta?: Record<string, unknown>
+  icons?: Array<{ src: string; mimeType?: string; sizes?: string[]; theme?: 'light' | 'dark' }>
 }
 
 /** contract-pending(after all GitLab tokens migrate and workspace-token writers are retired): drop credential_personal_token_identity_unique; only the index is retired. */