[MCP-UI] Proxy and Better Message Handling by aharvard · Pull Request #5487 · block/goose

aharvard · 2025-10-30T21:21:54Z

Summary

This PR upgrades @mcp-ui/client to better handle messages from MCP-UI iframes and also decouples the MCP-UI iframe CSP from Goose's top-level CSP set for Electron.

Our top-level CSP previously blocked external fonts, stylesheets, scripts, and media. We now use an MCP-UI Proxy with a permissive CSP inside a sandboxed iframe for security. This creates a parent-child iframe architecture in Goose.

Demo

Now, Goose can load external fonts inside MCP-UI iframes and MCP-UI resources can send request-render-data to get the theme value from goose (as shown here in mcp-ui docs)

goose-proxy-csp-fonts.mov

Now, Goose can load external video and audio media files (unmute video below for sound).

goose-proxy-csp-media.mov

Type of Change

Testing

Manual testing with aharavrd mcp as shown in videos above.

Related Issues

No issue or discussions to link.

Note

This work enables MCP-UI interoperability between Goose and ChatGPT by addressing two blockers:

Sandboxed iframe with permissive CSP - Implements ChatGPT's approach of using a 3rd party sandboxed origin with a lax CSP, enabling capabilities like remote script execution. This follows MCP-UI's documented pattern (used by Postman).
Render data support - Adds full render data implementation, which is currently missing in Goose.

This unblocks @idosal and @liady from targeting Goose for cross-platform MCP-UI development with the Apps SDK.

michaelneale · 2025-10-30T22:16:37Z

ui/desktop/src/main.ts

+
+async function startMcpUIProxyServer(): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const expressApp = express();


nice - and this looks like it is already in the dependencies from electron?

yeah! Express is already a dependency in the app.
https://github.com/block/goose/blob/feat/mcp-ui-improvements/ui/desktop/package.json#L70

aharvard · 2025-10-31T13:12:09Z

ui/desktop/src/components/MCPUIResourceRenderer.tsx

just a note regarding the deletions in this file: previously we were over-handling messages form the iframe, upgrading @mcp-ui/client and using a proxy takes most of this off our plate.

aharvard · 2025-10-31T13:33:41Z

.bundle

… checks. Update related comments and variable names for clarity.

…d origin checks. Update related comments and variable names for clarity." This reverts commit 0ce5a8a.

liady · 2025-10-31T19:28:53Z

@aharvard looks good! Glad this also uses the SDK functionality instead of custom Goose code.
Good proxy implementation 👍. I think we should probably make this code reusable from the SDK somehow at some point.

aharvard · 2025-10-31T19:30:48Z

Thanks for looking @liady!

I think we should probably make this code reusable from the SDK somehow at some point.

^ yeah, you read my mind!

idosal

Looks great @aharvard !

cc @evalstate - this should remove the limitations on the HF MCP-UI tools

Copilot

Pull Request Overview

This PR implements an MCP-UI proxy server to enable secure rendering of MCP UI resources in the Goose Desktop application. The proxy server allows controlled iframe embedding of external content while maintaining security through token-based authentication and origin validation.

Key changes:

Added an HTTP server using Express to serve MCP-UI proxy HTML files with token-based security
Integrated the @mcp-ui/client library (updated to v5.14.1) for rendering MCP UI resources
Implemented security controls including random token generation, header injection, and origin validation

Reviewed Changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
ui/desktop/static/mcp-ui-proxy.html	New proxy HTML page that handles iframe embedding for both raw HTML and external URLs with content security policy
ui/desktop/src/main.ts	Adds Express HTTP server for MCP-UI proxy with security middleware, port management, and Electron session configuration
ui/desktop/src/preload.ts	Exposes `getMcpUIProxyUrl` API to renderer process for fetching the proxy server URL
ui/desktop/src/components/MCPUIResourceRenderer.tsx	Refactors action handlers, removes custom type definitions in favor of imported types, and configures proxy URL support
ui/desktop/package.json	Updates `@mcp-ui/client` dependency from v5.13.0 to v5.14.1
ui/desktop/package-lock.json	Updates lock file for `@mcp-ui/client` v5.14.1
ui/desktop/forge.config.ts	Adds `static` directory to packaged resources

Files not reviewed (1)

ui/desktop/package-lock.json: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

ui/desktop/src/components/MCPUIResourceRenderer.tsx

ui/desktop/src/main.ts

ui/desktop/static/mcp-ui-proxy.html

ui/desktop/src/main.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull Request Overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

ui/desktop/package-lock.json: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

ui/desktop/src/main.ts

ui/desktop/src/components/MCPUIResourceRenderer.tsx

Use lowercase 'x-mcp-ui-proxy-token' when injecting header to match Express's normalized header names for consistency and clarity.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull Request Overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

ui/desktop/package-lock.json: Language not supported

Comments suppressed due to low confidence (1)

ui/desktop/src/components/MCPUIResourceRenderer.tsx:1

Comment on line 332 contains a typo: 'MPC-UIs' should be 'MCP-UIs'.

import {

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

ui/desktop/static/mcp-ui-proxy.html

Copilot

Pull Request Overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

ui/desktop/package-lock.json: Language not supported

ui/desktop/src/proxy.ts

ui/desktop/static/mcp-ui-proxy.html

aharvard · 2025-11-13T21:39:40Z

I chatted with @DOsinga about moving the server into the Rust backend, and @alexhancock will perform the maneuver. Thanks, guys!

aharvard · 2025-11-17T20:21:36Z

Thanks @alexhancock for moving the proxy server from Electron to the backend in #5749

@DOsinga and @michaelneale — can we get another look? If everything is in order, I'd like to merge!

michaelneale · 2025-11-18T00:55:11Z

would that live mcp sampling test have anytihng to do with this - or just bad luck?

* origin/main: (60 commits) chore: incorporate LF feedback (#5787) docs: quick launcher (#5779) Bump auto scroll threshold (#5738) fix: add one-time cleanup for linux hermit locking issues (#5742) Don't show update tray icon if GOOSE_VERSION is set (#5750) fix: get win node path from registry (#5731) Handle spaces in extension names also (#5770) Remove empty settings card for Scheduling Engine (#5771) fix windows cli build (#5768) fix: Implement a CredentialStore for auth (#5741) blog post: How to Successfully Migrate Your App with an AI Agent (#5762) Simplify finding `goosed` (#5739) More time for goosed (#5746) Match lower case (#5763) scan recipe for security when saving recipe (#5747) feat: trying grok for live test (#5732) Platform Extension MOIM (Minus One Info Message) (#5027) docs: remove hackathon banner (#5756) Fix: Recipes respect the quiet flag (#5743) docs: update cli commands (#5744) ...

dismissing stale review to unblock merge checks

Copilot

Pull Request Overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

ui/desktop/package-lock.json: Language not supported

ui/desktop/src/proxy.ts

crates/goose-server/src/routes/templates/mcp_ui_proxy.html

aharvard · 2025-11-18T16:15:43Z

would that live mcp sampling test have anytihng to do with this - or just bad luck?

FYI gpt-5-mini sampling test kept failing. I got it to pass on the second manual re-run.

All checks passed.

Ready to merge?

zanesq · 2025-11-18T19:05:11Z

Ran copilot security review and this came up as potentially important. Wondering if worth addressing @alexhancock or @DOsinga

**Secret in query string (critical)**
You place the secret in the proxy URL query (…/mcp-ui-proxy?secret=...), then load that page and—if it embeds an external target iframe—the external target can receive the proxy page URL as the referrer (document.referrer / Referer header). That means the secret can leak to third-party sites when the proxy iframe loads external URLs. This is a high-risk leak.
Recommendation: never put long-lived secrets in the URL. Use one of:
Deliver short-lived session token via a Set-Cookie (HTTP-only) from the server and read it via State on the proxy endpoint.
POST the secret to the proxy page (i.e. open a small HTML page that receives the secret via POST and stores it in JS memory), or have the server render the proxy page without the secret in the URL and provide the secret to the iframe via a safer channel (cookie, server session).
Use a one-time ephemeral token generated server-side for that UI session, not your main secret key.
At minimum, set Referrer-Policy to no-referrer on the proxy HTML and send Referrer-Policy response header so the browser won't send the full URL as the referer — but this is still weaker than avoiding secrets in URLs.

**Solution**
Remove secret from the query string. Provide the secret via:
a short-lived token (server-generated) embedded in the proxy page or a cookie, or
by having Electron call the proxy page and then postMessage the secret into it after load (so it’s never in the URL).

zanesq · 2025-11-18T19:05:34Z

Copilot also mentioned this, created a PR for this change, @aharvard is testing it out

Add a Referrer-Policy header/meta tag (e.g. no-referrer) on the proxy HTML to help prevent accidental leak if secret is ever in the URL.

Co-authored-by: Andrew Harvard <aharvard@squareup.com>

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

…xt-test * 'main' of github.com:block/goose: chore: Add Adrian Cole to Maintainers (#5815) [MCP-UI] Proxy and Better Message Handling (#5487) Release 1.15.0 Document New Window menu in macOS dock (#5811) Catch cron errors (#5707) feat/fix Re-enabled WAL with commit transaction management (Linux Verification Requested) (#5793) chore: remove autopilot experimental feature (#5781) Read paths from an interactive & login shell (#5774) docs: acp clients (#5800)

* main: (33 commits) fix: support Gemini 3's thought signatures (#5806) chore: Add Adrian Cole to Maintainers (#5815) [MCP-UI] Proxy and Better Message Handling (#5487) Release 1.15.0 Document New Window menu in macOS dock (#5811) Catch cron errors (#5707) feat/fix Re-enabled WAL with commit transaction management (Linux Verification Requested) (#5793) chore: remove autopilot experimental feature (#5781) Read paths from an interactive & login shell (#5774) docs: acp clients (#5800) Provider error proxy for simulating various types of errors (#5091) chore: Add links to maintainer profiles (#5788) Quick fix for community all stars script (#5798) Document Mistral AI provider (#5799) docs: Add Community Stars recipe script and txt file (#5776) chore: incorporate LF feedback (#5787) docs: quick launcher (#5779) Bump auto scroll threshold (#5738) fix: add one-time cleanup for linux hermit locking issues (#5742) Don't show update tray icon if GOOSE_VERSION is set (#5750) ...

* main: (48 commits) [fix] generic check for gemini compat (#5842) Add scheduler to diagnostics (#5849) Cors and token (#5850) fix sessions coming back with empty messages (#5841) markdown export from URL (#5830) Next camp refactor live (#5706) Add out of context compaction test via error proxy (#5805) fix: Add backward compatibility for conversationCompacted message type (#5819) Add /agent/stop endpoint, make max active agents configurable (#5826) Handle 404s (#5791) Persist provider name and model config in the session (#5419) Comment out the flaky mcp callers (#5827) Slash commands (#5718) fix: remove setx calls to not permanently edit the windows shell PATH (#5821) fix: Parse maas models for gcp vertex provider (#5816) fix: support Gemini 3's thought signatures (#5806) chore: Add Adrian Cole to Maintainers (#5815) [MCP-UI] Proxy and Better Message Handling (#5487) Release 1.15.0 Document New Window menu in macOS dock (#5811) ...

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Alex Hancock <alexhancock@block.xyz> Co-authored-by: Zane <75694352+zanesq@users.noreply.github.com> Signed-off-by: Blair Allan <Blairallan@icloud.com>

aharvard added 4 commits October 30, 2025 13:39

upgrade @mcp-ui/client

a828eac

declare supported content types

02b3d7c

simplify ui action handling

8da9d52

set up self-host proxy for UIResourceRenderer

be436f7

michaelneale reviewed Oct 30, 2025

View reviewed changes

add media-src CSP to mcp-ui-proxy

b49fd9c

aharvard commented Oct 31, 2025

View reviewed changes

aharvard marked this pull request as ready for review October 31, 2025 13:32

aharvard requested a review from michaelneale October 31, 2025 13:45

aharvard added 7 commits October 31, 2025 10:53

relax script-src CSP on MCP-UI Proxy

8f877fa

Enhance MCP-UI proxy server security with token validation and origin…

0ce5a8a

… checks. Update related comments and variable names for clarity.

update console errors for clarity

94d2162

Revert "Enhance MCP-UI proxy server security with token validation an…

745f2eb

…d origin checks. Update related comments and variable names for clarity." This reverts commit 0ce5a8a.

fix static path issue for builds

715c09a

bring back MCP-UI proxy security

c42f12b

remove troubleshooting text in UI

72f1ef1

liady approved these changes Oct 31, 2025

View reviewed changes

idosal reviewed Nov 1, 2025

View reviewed changes

angiejones requested a review from Copilot November 2, 2025 19:16

Copilot AI reviewed Nov 2, 2025

View reviewed changes

Update ui/desktop/src/components/MCPUIResourceRenderer.tsx

7677e76

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings November 3, 2025 13:08

Copilot AI reviewed Nov 3, 2025

View reviewed changes

ui/desktop/src/main.ts Outdated Show resolved Hide resolved

ui/desktop/src/components/MCPUIResourceRenderer.tsx Outdated Show resolved Hide resolved

ui/desktop/src/components/MCPUIResourceRenderer.tsx Outdated Show resolved Hide resolved

aharvard and others added 2 commits November 3, 2025 08:17

fix: use consistent lowercase casing for mcp-ui-proxy-token header

5af7c66

Use lowercase 'x-mcp-ui-proxy-token' when injecting header to match Express's normalized header names for consistency and clarity.

Update ui/desktop/src/components/MCPUIResourceRenderer.tsx

949f9b4

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings November 3, 2025 13:21

Copilot AI reviewed Nov 3, 2025

View reviewed changes

ui/desktop/static/mcp-ui-proxy.html Outdated Show resolved Hide resolved

Copilot AI review requested due to automatic review settings November 10, 2025 22:02

Copilot started reviewing on behalf of aharvard November 10, 2025 22:03 View session

Copilot finished reviewing on behalf of aharvard November 10, 2025 22:06

Copilot AI reviewed Nov 10, 2025

View reviewed changes

ui/desktop/src/proxy.ts Outdated Show resolved Hide resolved

ui/desktop/src/proxy.ts Outdated Show resolved Hide resolved

ui/desktop/static/mcp-ui-proxy.html Show resolved Hide resolved

feat: MCP UI proxy to goose-server (#5749)

b6740fb

Copilot AI review requested due to automatic review settings November 18, 2025 13:26

Copilot started reviewing on behalf of aharvard November 18, 2025 13:27 View session

Copilot finished reviewing on behalf of aharvard November 18, 2025 13:28

Copilot AI reviewed Nov 18, 2025

View reviewed changes

ui/desktop/src/proxy.ts Outdated Show resolved Hide resolved

crates/goose-server/src/routes/templates/mcp_ui_proxy.html Show resolved Hide resolved

remove old proxy files from client

7aef5a2

zanesq mentioned this pull request Nov 18, 2025

[MCP-UI] proxy add Referrer-Policy HTTP response header #5797

Merged

[MCP-UI] proxy add Referrer-Policy HTTP response header (#5797)

e9e18d7

Co-authored-by: Andrew Harvard <aharvard@squareup.com>

Copilot AI review requested due to automatic review settings November 18, 2025 19:31

Copilot AI reviewed Nov 18, 2025

View reviewed changes

zanesq approved these changes Nov 19, 2025

View reviewed changes

zanesq merged commit 9d5d8c0 into main Nov 19, 2025
24 of 26 checks passed

github-actions bot mentioned this pull request Nov 25, 2025

chore(release): release version 1.16.0 (minor) #5867

Closed

github-actions bot mentioned this pull request Dec 4, 2025

chore(release): release version 1.16.0 (minor) #5985

Merged

Conversation

aharvard commented Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Demo

Type of Change

Testing

Related Issues

Uh oh!

michaelneale Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

aharvard Oct 31, 2025

Choose a reason for hiding this comment

Uh oh!

aharvard Oct 31, 2025

Choose a reason for hiding this comment

Uh oh!

aharvard commented Oct 31, 2025

Uh oh!

liady commented Oct 31, 2025

Uh oh!

aharvard commented Oct 31, 2025

Uh oh!

idosal left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aharvard commented Nov 13, 2025

Uh oh!

aharvard commented Nov 17, 2025

Uh oh!

michaelneale commented Nov 18, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

aharvard commented Nov 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zanesq commented Nov 18, 2025

Uh oh!

zanesq commented Nov 18, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

aharvard commented Oct 30, 2025 •

edited

Loading

aharvard commented Nov 18, 2025 •

edited

Loading