modelcontextprotocol/ext-apps
Watch
1
0
Fork
You've already forked ext-apps
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Replace "external" with "network" in CSP documentation

Browse source 
The term "external" is misleading for MCP Apps because developers
typically interpret it as "third-party." However, MCP App HTML runs in
a sandboxed iframe with no same-origin server, so *all* origins must be
declared—including where your own bundled JS/CSS is served from. Using
"network" instead avoids this confusion and aligns with the detailed
explanations in `patterns.md` and `spec.types.ts`.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Jonathan Hefner 2026-02-02 10:37:33 -06:00
commit c39b40e7c8
No known key found for this signature in database
GPG key ID: 0DA40AFD21043691
1 changed files with 21 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/spec.types.ts
View file

@ -539,8 +539,7 @@ export interface McpUiInitializedNotification {
/**
* @description Content Security Policy configuration for UI resources.
*
* Servers declare which external origins their UI needs to access.
* Hosts use this to enforce appropriate CSP headers.
* Servers declare which origins their UI requires. Hosts use this to enforce appropriate CSP headers.
*
* > [!IMPORTANT]
* > MCP App HTML runs in a sandboxed iframe with no same-origin server.
@ -552,7 +551,7 @@ export interface McpUiResourceCsp {
* @description Origins for network requests (fetch/XHR/WebSocket).
*
* - Maps to CSP `connect-src` directive
* - Empty or omitted → no external connections (secure default)
* - Empty or omitted → no network connections (secure default)
*
* @example
* ```ts
@ -565,7 +564,7 @@ export interface McpUiResourceCsp {
*
* - Maps to CSP `img-src`, `script-src`, `style-src`, `font-src`, `media-src` directives
* - Wildcard subdomains supported: `https://*.example.com`
* - Empty or omitted → no external resources (secure default)
* - Empty or omitted → no network resources (secure default)
*
* @example
* ```ts