From 69ca95656b1825bb26d9c6b002c0bed572544327 Mon Sep 17 00:00:00 2001 From: cliffhall Date: Mon, 14 Sep 2026 01:40:30 -0400 Subject: [PATCH] fix(web): point a refused sandbox embedder at ALLOWED_ORIGINS (#1862) Addresses Copilot review round 3. The proxy page's rejection message still told operators to "update the validation logic", but the embedder check now reads ALLOWED_ORIGINS, so name that setting as the fix instead. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01HzuzRPJv7M8wGe3wyw5sSg Signed-off-by: cliffhall --- clients/web/static/sandbox_proxy.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/clients/web/static/sandbox_proxy.html b/clients/web/static/sandbox_proxy.html index 35b92d69..203f9024 100644 --- a/clients/web/static/sandbox_proxy.html +++ b/clients/web/static/sandbox_proxy.html @@ -115,7 +115,7 @@ : LOOPBACK_EMBEDDER_PATTERN.test(referrerOrigin)) ) { throw new Error( - `Embedding domain not allowed in referrer ${document.referrer}. (Consider updating the validation logic to allow your domain.)`, + `Embedding origin ${referrerOrigin} is not allowed to load the MCP Apps sandbox. Add it to the Inspector's ALLOWED_ORIGINS (e.g. ALLOWED_ORIGINS=https://inspector.example.com) and restart.`, ); }