MCP Apps Security Model - Iframes, CSP & Tool Access

​

Trust Boundaries

​

Host Isolation Requirements

import { App } from '@modelcontextprotocol/ext-apps';

const app = new App({ name: 'Orders View', version: '1.0.0' });

app.ontoolresult = (result) => {
  renderOrders(result.structuredContent);
};

await app.connect();

​

Content Security Policy

{
  uri: "ui://orders/view.html",
  mimeType: "text/html;profile=mcp-app",
  text: ordersHtml,
  _meta: {
    ui: {
      csp: {
        connectDomains: ["https://api.example.com"],
        resourceDomains: ["https://cdn.example.com"],
        frameDomains: ["https://embed.example.com"],
      },
    },
  },
}

​

View-to-Host Messages

• Use the App SDK instead of hand-written postMessage listeners.
• Check Host capabilities before calling an optional API.
• Treat tool results, host context, and server resources as untrusted input before placing strings into the DOM.
• Use DOM text nodes or framework escaping for text. Avoid passing result strings to innerHTML.
• Keep dependencies current and avoid enabling allowUnsafeEval unless the Host CSP permits it and you control the code path.

​

Tool Access and Authorization

• ["model", "app"] lets both the model and View call the tool.
• ["model"] blocks calls from the View.
• ["app"] hides the tool from the model and allows calls only from a View connected to the same server.

​

Tool Result Data

​

Permissions, Links, and Downloads

• openLink() asks the Host to open a URL under its own policy.
• downloadFile() asks the Host to download content or a resource.
• callServerTool() routes a tool call through the Host to the originating server.

​

Pre-Ship Security Check

• The UI resource uses ui:// and text/html;profile=mcp-app.
• CSP lists only the external origins the built View loads.
• The View works when optional browser permissions are denied.
• Every View-callable tool includes "app" visibility.
• Every tool validates input and enforces server-side authorization.
• Destructive calls are honestly annotated and safe against retries.
• Model-safe data goes in content or structuredContent; View-only data goes in _meta.
• Result strings render through escaped text APIs.
• The app works in a real separate-origin sandbox, not only a same-origin development iframe.

​

Primary References