Scenario: MCP Apps extension is advertised during initialize
  Given MCP Apps support is enabled
  And the caller is authorized to use the target server or gateway scope
  When an MCP client calls initialize with compatible client capabilities
  Then the initialize response includes capabilities.extensions["io.modelcontextprotocol/ui"]
  And existing prompts/resources/tools/logging/completions capabilities are preserved
  And capabilities.experimental is not used as the canonical MCP Apps signal

Scenario: MCP Apps extension is not advertised to unauthorized callers
  Given MCP Apps support is enabled
  And the caller is not authorized for the target server or gateway scope
  When the caller invokes initialize
  Then capabilities.extensions["io.modelcontextprotocol/ui"] is omitted
  And no private or team-only extension availability is leaked

Scenario: MCP Apps is registered as a built-in extension handler
  Given the gateway starts with MCP Apps enabled
  When extension handlers are initialized
  Then io.modelcontextprotocol/ui is registered as a built-in extension
  And the handler can contribute initialize capabilities
  And the handler can process MCP Apps-specific resource/session behavior

Scenario: Core MCP methods still take precedence
  Given an MCP request uses a core method such as tools/list or resources/read
  When the request is dispatched
  Then the existing core MCP path handles the request
  And the extension handler is invoked only for MCP Apps-specific behavior or metadata processing

Scenario: Unknown extension methods remain default-deny
  Given no built-in extension handler owns method unknown/hello
  When a client calls unknown/hello
  Then ContextForge returns JSON-RPC method not found
  And no upstream call is made

Scenario: Register UI resource
  Given an administrator has UI content for a dashboard
  When they register a UI resource with a ui:// URI, MIME type, CSP config, and visibility metadata
  Then the resource is stored with audit metadata
  And the resource is associated with the configured owner/team visibility

Scenario: Read UI resource through MCP resource flow
  Given ui://dashboard exists
  And the caller is authorized to read it
  When the caller invokes resources/read for ui://dashboard
  Then the response returns the UI content in MCP resource content format
  And the response includes the metadata needed by an MCP Apps host

Scenario: Deny unauthorized UI resource read
  Given ui://dashboard is private or team-scoped
  And the caller lacks access to that scope
  When the caller invokes resources/read for ui://dashboard
  Then the request is denied
  And an audit event records the denied access

Scenario: Tool declares UI resource metadata
  Given tool create_dashboard exists
  And ui://dashboard exists
  When the tool metadata is updated with _meta.ui.resourceUri="ui://dashboard"
  Then tools/list returns the UI metadata to authorized model-facing clients
  And tools/call can return UI-capable results for compatible hosts

Scenario: App-only tools are hidden from model-facing list
  Given helper tool get_dashboard_data is app-visible only
  When a model-facing client invokes tools/list
  Then get_dashboard_data is omitted
  And model-visible tools remain listed normally

Scenario: App session can call app-visible helper tool
  Given an active MCP Apps session is bound to the same server as get_dashboard_data
  And the caller has permission to execute the tool
  When the app invokes tools/call for get_dashboard_data
  Then the call succeeds
  And the result is returned to the app bridge

Scenario: AppBridge enforces same-server boundary
  Given an app session is bound to server-a
  When the app attempts to call a tool from server-b
  Then the call is denied
  And an audit event records a cross-server app call denial

Scenario: Expired or missing app session is denied
  Given no active app session exists for the provided session id
  When an app-originated JSON-RPC call is received
  Then the call is denied
  And no tool or resource operation is executed

Scenario: CSP and sandbox policy are validated
  Given an administrator registers a UI resource
  When the CSP, sandbox, or permissions policy is unsafe
  Then the resource is rejected or requires an explicit approved override
  And the policy decision is recorded