diff --git a/src/generated/schema.json b/src/generated/schema.json
index a72ec2d..80b4ac6 100644
--- a/src/generated/schema.json
+++ b/src/generated/schema.json
@@ -5300,6 +5300,12 @@
             ],
             "description": "Tool visibility scope - who can access the tool."
           }
+        },
+        "csp": {
+          "not": {}
+        },
+        "permissions": {
+          "not": {}
         }
       },
       "additionalProperties": false
diff --git a/src/generated/schema.ts b/src/generated/schema.ts
index 707e185..0e0a390 100644
--- a/src/generated/schema.ts
+++ b/src/generated/schema.ts
@@ -730,6 +730,17 @@ export const McpUiToolMetaSchema = z.object({
     .describe(
       'Who can access this tool. Default: ["model", "app"]\n- "model": Tool visible to and callable by the agent\n- "app": Tool callable by the app from this server only',
     ),
+  /**
+   * `csp` belongs on the UI **resource** (see {@link McpUiResourceMeta}),
+   * not the tool. Hosts read it from the `resources/read` content item
+   * (with `resources/list` entry as fallback) and ignore it here.
+   */
+  csp: z.never().optional(),
+  /**
+   * `permissions` belongs on the UI **resource** (see {@link McpUiResourceMeta}),
+   * not the tool. Hosts ignore it here.
+   */
+  permissions: z.never().optional(),
 });
 
 /**
diff --git a/src/spec.types.ts b/src/spec.types.ts
index 3678fb5..ad3d4d2 100644
--- a/src/spec.types.ts
+++ b/src/spec.types.ts
@@ -783,6 +783,17 @@ export interface McpUiToolMeta {
    * - "app": Tool callable by the app from this server only
    */
   visibility?: McpUiToolVisibility[];
+  /**
+   * `csp` belongs on the UI **resource** (see {@link McpUiResourceMeta}),
+   * not the tool. Hosts read it from the `resources/read` content item
+   * (with `resources/list` entry as fallback) and ignore it here.
+   */
+  csp?: never;
+  /**
+   * `permissions` belongs on the UI **resource** (see {@link McpUiResourceMeta}),
+   * not the tool. Hosts ignore it here.
+   */
+  permissions?: never;
 }
 
 /**