modelcontextprotocol/ext-apps
Watch
1
0
Fork
You've already forked ext-apps
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: enhance sandbox capability negotiation (#158)

Browse source 
* feat: enhance sandbox capability negotiation

* Update specification/draft/apps.mdx

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* add all csp and permissions to host capabilities + update SEP

* feat: add clipboard-write permission support

Adds clipboardWrite to McpUiResourcePermissions for clipboard access.
Maps to Permission Policy 'clipboard-write' feature.

* rm files added by mistake

* refactor: change McpUiResourcePermissions properties to empty objects

* chore: remove scratch files and redundant cross-env dependency

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Olivier Chafik <ochafik@anthropic.com>
This commit is contained in:
Ido Salomon 2026-01-12 17:10:27 +02:00 • committed by GitHub
commit 9acc52cb96
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 496 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

27
src/spec.types.ts
View file

@ -220,6 +220,8 @@ export interface McpUiSandboxResourceReadyNotification {
sandbox?: string;
/** @description CSP configuration from resource metadata. */
csp?: McpUiResourceCsp;
/** @description Sandbox permissions from resource metadata. */
permissions?: McpUiResourcePermissions;
};
}
@ -423,6 +425,13 @@ export interface McpUiHostCapabilities {
};
/** @description Host accepts log messages. */
logging?: {};
/** @description Sandbox configuration applied by the host. */
sandbox?: {
/** @description Permissions granted by the host (camera, microphone, geolocation). */
permissions?: McpUiResourcePermissions;
/** @description CSP domains approved by the host. */
csp?: McpUiResourceCsp;
};
}
/**
@ -498,12 +507,30 @@ export interface McpUiResourceCsp {
baseUriDomains?: string[];
}
/**
* @description Sandbox permissions requested by the UI resource.
* Hosts MAY honor these by setting appropriate iframe `allow` attributes.
* Apps SHOULD NOT assume permissions are granted; use JS feature detection as fallback.
*/
export interface McpUiResourcePermissions {
/** @description Request camera access (Permission Policy `camera` feature). */
camera?: {};
/** @description Request microphone access (Permission Policy `microphone` feature). */
microphone?: {};
/** @description Request geolocation access (Permission Policy `geolocation` feature). */
geolocation?: {};
/** @description Request clipboard write access (Permission Policy `clipboard-write` feature). */
clipboardWrite?: {};
}
/**
* @description UI Resource metadata for security and rendering configuration.
*/
export interface McpUiResourceMeta {
/** @description Content Security Policy configuration. */
csp?: McpUiResourceCsp;
/** @description Sandbox permissions requested by the UI. */
permissions?: McpUiResourcePermissions;
/** @description Dedicated origin for widget sandbox. */
domain?: string;
/** @description Visual boundary preference - true if UI prefers a visible border. */