Back to Home
Cronos402 icon

examples

Verified Safe

by Cronos402

Overview

A Next.js application demonstrating how to build an OpenAI Apps SDK compatible MCP server with widget rendering in ChatGPT.

Installation

Run Command
npm run dev

Environment Variables

  • VERCEL_ENV
  • VERCEL_PROJECT_PRODUCTION_URL
  • VERCEL_BRANCH_URL
  • VERCEL_URL
  • NEXT_PUBLIC_AUTH_URL

Security Notes

The application uses broad CORS headers (`Access-Control-Allow-Origin: *`) and patches browser APIs (`history.pushState`, `window.fetch`, `MutationObserver` for `<html>`) to function within a ChatGPT iframe. While these are necessary for the specific integration, they inherently increase the attack surface and complexity compared to a standard web application. The `baseURL` is derived from Vercel environment variables, reducing direct user manipulation risk. The `auth-example` relies on an external authentication service via `NEXT_PUBLIC_AUTH_URL` and forwards cookies for session management. No obvious malicious code patterns or critical hardcoded secrets were identified in the provided snippets for the server operations.

Similar Servers

Stats

Interest Score0
Security Score7
Cost ClassMedium
Avg Tokens10000
Stars0
Forks0
Last Update2026-01-18

Tags

OpenAIChatGPTNext.jsMCP ServerWidget RenderingFrontend Integration