modelcontextprotocol/ext-apps
Watch
1
0
Fork
You've already forked ext-apps
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add media-src to CSP for video and audio support (#109)

Browse source 
This adds the media-src directive to the Content Security Policy to enable
MCP Apps to play video and audio content.

Changes:
- Add media-src to the restrictive default CSP in the spec
- Add media-src to the CSP construction from metadata in the spec
- Update resourceDomains documentation in spec to include media
- Update resourceDomains JSDoc in src/types.ts to include media-src

Fixes modelcontextprotocol/ext-apps#106
This commit is contained in:
Andrew Harvard 2025-12-09 18:10:58 -05:00 • committed by GitHub
commit 4953cd320e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/types.ts
View file

@ -872,7 +872,7 @@ type _VerifyInitializedNotification = VerifySchemaMatches<
export const McpUiResourceCspSchema = z.object({
/** Origins for network requests (fetch/XHR/WebSocket). Maps to CSP connect-src */
connectDomains: z.array(z.string()).optional(),
/** Origins for static resources (images, scripts, stylesheets, fonts). Maps to CSP img-src, script-src, style-src, font-src */
/** Origins for static resources (images, scripts, stylesheets, fonts, media). Maps to CSP img-src, script-src, style-src, font-src, media-src */
resourceDomains: z.array(z.string()).optional(),
});
export type McpUiResourceCsp = z.infer<typeof McpUiResourceCspSchema>;