address PR review comments

- Change default visibility to ["model", "apps"]
- Add deprecation notice for flat ui/resourceUri format
- Add McpUiToolMeta and McpUiToolVisibility to spec.types.ts
- Improve tools/list and tools/call behavior wording

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Author: antonpk1

specification/draft/apps.mdx

@@ -252,11 +252,11 @@ interface McpUiToolMeta {
   /** URI of UI resource for rendering tool results */
   resourceUri?: string;
   /**
-   * Who can access this tool. Default: ["model"]
+   * Who can access this tool. Default: ["model", "app"]
    * - "model": Tool visible to and callable by the agent
-   * - "apps": Tool callable by ui apps from this server
+   * - "app": Tool callable by the app from this server only
    */
-  visibility?: Array<"model" | "apps">;
+  visibility?: Array<"model" | "app">;
 }
 
 interface Tool {
@@ -265,10 +265,14 @@ interface Tool {
   inputSchema: object;
   _meta?: {
     ui?: McpUiToolMeta;
+    /** @deprecated Use `ui.resourceUri` instead. Will be removed before GA. */
+    "ui/resourceUri"?: string;
   };
 }
 ```
 
+> **Deprecation notice:** The flat `_meta["ui/resourceUri"]` format is deprecated. Use `_meta.ui.resourceUri` instead. The deprecated format will be removed before GA.
+
 Example (tool visible to both model and apps):
 
 ```json
@@ -284,7 +288,7 @@ Example (tool visible to both model and apps):
   "_meta": {
     "ui": {
       "resourceUri": "ui://weather-server/dashboard-template",
-      "visibility": ["model", "apps"]
+      "visibility": ["model", "app"]
     }
   }
 }
@@ -300,7 +304,7 @@ Example (app-only tool, hidden from model):
   "_meta": {
     "ui": {
       "resourceUri": "ui://weather-server/dashboard-template",
-      "visibility": ["apps"]
+      "visibility": ["app"]
     }
   }
 }
@@ -317,11 +321,11 @@ Example (app-only tool, hidden from model):
 
 #### Visibility:
 
-- `visibility` defaults to `["model"]` if omitted (standard MCP behavior)
+- `visibility` defaults to `["model", "app"]` if omitted
 - `"model"`: Tool is visible to and callable by the agent
-- `"apps"`: Tool is callable by apps from the same server connection only
-- Host MUST NOT include tools with `visibility: ["apps"]` in the agent's tool list
-- Host MUST reject `tools/call` requests from apps for tools that don't include `"apps"` in visibility
+- `"app"`: Tool is callable by the app from the same server connection only
+- **tools/list behavior:** Host MUST NOT include tools in the agent's tool list when their visibility does not include `"model"` (e.g., `visibility: ["app"]`)
+- **tools/call behavior:** Host MUST reject `tools/call` requests from apps for tools that don't include `"app"` in visibility
 - Cross-server tool calls are always blocked for app-only tools
 
 #### Benefits:
@@ -1084,7 +1088,7 @@ await client.callTool("get_weather", { location: "New York" });
 
 This pattern enables interactive, self-updating widgets.
 
-Note: Tools with `visibility: ["apps"]` are hidden from the agent but remain callable by apps via `tools/call`. This enables UI-only interactions (refresh buttons, form submissions) without exposing implementation details to the model. See the Visibility section under Resource Discovery for details.
+Note: Tools with `visibility: ["app"]` are hidden from the agent but remain callable by apps via `tools/call`. This enables UI-only interactions (refresh buttons, form submissions) without exposing implementation details to the model. See the Visibility section under Resource Discovery for details.
 
 ### Client\<\>Server Capability Negotiation
 

src/spec.types.ts

@@ -485,3 +485,22 @@ export interface McpUiResourceMeta {
   /** @description Visual boundary preference - true if UI prefers a visible border. */
   prefersBorder?: boolean;
 }
+
+/**
+ * @description Tool visibility scope - who can access the tool.
+ */
+export type McpUiToolVisibility = "model" | "apps";
+
+/**
+ * @description UI-related metadata for tools.
+ */
+export interface McpUiToolMeta {
+  /** @description URI of UI resource for rendering tool results. */
+  resourceUri?: string;
+  /**
+   * @description Who can access this tool. Default: ["model", "apps"]
+   * - "model": Tool visible to and callable by the agent
+   * - "apps": Tool callable by apps from this server only
+   */
+  visibility?: McpUiToolVisibility[];
+}