modelcontextprotocol/ext-apps
Watch
1
0
Fork
You've already forked ext-apps
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Replace "external" with "network" in CSP documentation

Browse source 
The term "external" is misleading for MCP Apps because developers
typically interpret it as "third-party." However, MCP App HTML runs in
a sandboxed iframe with no same-origin server, so *all* origins must be
declared—including where your own bundled JS/CSS is served from. Using
"network" instead avoids this confusion and aligns with the detailed
explanations in `patterns.md` and `spec.types.ts`.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Jonathan Hefner 2026-02-02 10:37:33 -06:00
commit c39b40e7c8
No known key found for this signature in database
GPG key ID: 0DA40AFD21043691
1 changed files with 21 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/server/index.examples.ts
View file

@ -164,7 +164,7 @@ function registerAppResource_basicUsage(server: McpServer) {
}
/**
* Example: registerAppResource with CSP configuration for external domains.
* Example: registerAppResource with CSP configuration for network access.
*/
function registerAppResource_withCsp(
server: McpServer,