modelcontextprotocol/ext-apps
Watch
1
0
Fork
You've already forked ext-apps
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Convert UiResourceMeta documentation to TypeDoc comments

Browse source 
Move metadata field documentation from separate prose section into
TypeDoc comments on the UiResourceMeta interface properties. This
consolidates the documentation and eliminates duplication while making
it more maintainable and IDE-friendly.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Jonathan Hefner 2025-11-21 16:41:37 -06:00
commit a8107a6733
1 changed files with 45 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

76
specification/draft/apps.mdx
View file

@ -61,11 +61,56 @@ interface UIResource {
}
interface UIResourceMeta {
/**
* Content Security Policy configuration
*
* Servers declare which external origins their UI needs to access.
* Hosts use this to enforce appropriate CSP headers.
*/
csp?: {
/**
* Origins for network requests
*
* - Empty or omitted = no external connections (secure default)
* - Maps to CSP `connect-src` directive
*
* @example
* ["https://api.weather.com", "wss://realtime.service.com"]
*/
connectDomains?: string[],
/**
* Origins for static resources (images, scripts, stylesheets, fonts)
*
* - Empty or omitted = no external resources (secure default)
* - Wildcard subdomains supported: `https://*.example.com`
* - Maps to CSP `img-src`, `script-src`, `style-src`, `font-src` directives
*
* @example
* ["https://cdn.jsdelivr.net", "https://*.cloudflare.com"]
*/
resourceDomains?: string[],
},
/**
* Dedicated origin for widget
*
* Optional domain for the widget's sandbox origin. Useful when widgets need
* dedicated origins for API key allowlists or cross-origin isolation.
*
* If omitted, Host uses default sandbox origin.
*
* @example
* "https://weather-widget.example.com"
*/
domain?: string,
/**
* Visual boundary preference
*
* Boolean indicating the UI prefers a visible border. Useful for widgets
* that might blend with host background.
*
* - `true`: Request visible border (host decides styling)
* - `false` or omitted: No preference
*/
prefersBorder?: boolean,
}
```
@ -101,37 +146,6 @@ The resource content is returned via `resources/read`:
- Content MUST be provided via either `text` (string) or `blob` (base64-encoded)
- Content MUST be valid HTML5 document
#### Metadata Fields:
**`ui.csp` - Content Security Policy configuration**
Servers declare which external origins their UI needs to access. Hosts use this to enforce appropriate CSP headers.
- `connect_domains`: Origins for network requests
- Example: `["https://api.weather.com", "wss://realtime.service.com"]`
- Empty or omitted = no external connections (secure default)
- Maps to CSP `connect-src` directive
- `resource_domains`: Origins for static resources (images, scripts, stylesheets, fonts)
- Example: `["https://cdn.jsdelivr.net", "https://*.cloudflare.com"]`
- Empty or omitted = no external resources (secure default)
- Wildcard subdomains supported: `https://*.example.com`
- Maps to CSP `img-src`, `script-src`, `style-src`, `font-src` directives
**`ui.domain` - Dedicated origin for widget**
Optional domain for the widget's sandbox origin. Useful when widgets need dedicated origins for API key allowlists or cross-origin isolation.
- Example: `"https://weather-widget.example.com"`
- If omitted, Host uses default sandbox origin
**`ui.prefersBorder` - Visual boundary preference**
Boolean indicating the UI prefers a visible border. Useful for widgets that might blend with host background.
- `true`: Request visible border (host decides styling)
- `false` or omitted: No preference
#### Host Behavior:
- **CSP Enforcement:** Host MUST construct CSP headers based on declared domains