modelcontextprotocol/ext-apps
Watch
1
0
Fork
You've already forked ext-apps
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #39 from modelcontextprotocol/fix/csp-camelcase-naming

Browse source 
fix: use camelCase for CSP domain fields in specification
This commit is contained in:
Anton Pidkuiko 2025-11-27 16:51:21 +00:00 • committed by GitHub
commit 1fa95a3b83
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 7 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

14
specification/draft/apps.mdx
View file

@ -174,8 +174,8 @@ The resource content is returned via `resources/read`:
_meta?: {
ui?: {
csp?: {
connect_domains?: string[]; // Origins for fetch/XHR/WebSocket
resource_domains?: string[]; // Origins for images, scripts, etc
connectDomains?: string[]; // Origins for fetch/XHR/WebSocket
resourceDomains?: string[]; // Origins for images, scripts, etc
};
domain?: string;
prefersBorder?: boolean;
@ -228,8 +228,8 @@ Example:
"_meta": {
"ui" : {
"csp": {
"connect_domains": ["https://api.openweathermap.org"],
"resource_domains": ["https://cdn.jsdelivr.net"]
"connectDomains": ["https://api.openweathermap.org"],
"resourceDomains": ["https://cdn.jsdelivr.net"]
},
"prefersBorder": true
}
@ -1111,9 +1111,9 @@ const cspValue = `
default-src 'none';
script-src 'self' 'unsafe-inline';
style-src 'self' 'unsafe-inline';
connect-src 'self' ${csp?.connect_domains?.join(' ') || ''};
img-src 'self' data: ${csp?.resource_domains?.join(' ') || ''};
font-src 'self' ${csp?.resource_domains?.join(' ') || ''};
connect-src 'self' ${csp?.connectDomains?.join(' ') || ''};
img-src 'self' data: ${csp?.resourceDomains?.join(' ') || ''};
font-src 'self' ${csp?.resourceDomains?.join(' ') || ''};
frame-src 'none';
object-src 'none';
base-uri 'self';