modelcontextprotocol/ext-apps
Watch
1
0
Fork
You've already forked ext-apps
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add media-src to CSP for video and audio support (#109)

Browse source 
This adds the media-src directive to the Content Security Policy to enable
MCP Apps to play video and audio content.

Changes:
- Add media-src to the restrictive default CSP in the spec
- Add media-src to the CSP construction from metadata in the spec
- Update resourceDomains documentation in spec to include media
- Update resourceDomains JSDoc in src/types.ts to include media-src

Fixes modelcontextprotocol/ext-apps#106
This commit is contained in:
Andrew Harvard 2025-12-09 18:10:58 -05:00 • committed by GitHub
commit 4953cd320e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
specification/draft/apps.mdx
View file

@ -125,11 +125,11 @@ interface UIResourceMeta {
*/
connectDomains?: string[],
/**
* Origins for static resources (images, scripts, stylesheets, fonts)
* Origins for static resources (images, scripts, stylesheets, fonts, media)
*
* - Empty or omitted = no external resources (secure default)
* - Wildcard subdomains supported: `https://*.example.com`
* - Maps to CSP `img-src`, `script-src`, `style-src`, `font-src` directives
* - Maps to CSP `img-src`, `script-src`, `style-src`, `font-src`, `media-src` directives
*
* @example
* ["https://cdn.jsdelivr.net", "https://*.cloudflare.com"]
@ -202,6 +202,7 @@ The resource content is returned via `resources/read`:
script-src 'self' 'unsafe-inline';
style-src 'self' 'unsafe-inline';
img-src 'self' data:;
media-src 'self' data:;
connect-src 'none';
```
@ -1114,6 +1115,7 @@ const cspValue = `
connect-src 'self' ${csp?.connectDomains?.join(' ') || ''};
img-src 'self' data: ${csp?.resourceDomains?.join(' ') || ''};
font-src 'self' ${csp?.resourceDomains?.join(' ') || ''};
media-src 'self' data: ${csp?.resourceDomains?.join(' ') || ''};
frame-src 'none';
object-src 'none';
base-uri 'self';