feat(apps): Integrate AppRenderer from @mcp-ui/client SDK #7013

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

aharvard merged 60 commits into main from aharvard/mcp-ui-client-apprenderer

Feb 12, 2026

-Original file line number
+Diff line change
@@ Expand Up / @@ -138,7 +138,7 @@ @@
               .parent
               .postMessage({
                 jsonrpc: '2.0',
-                method: 'ui/notifications/sandbox-ready',
+                method: 'ui/notifications/sandbox-proxy-ready',
                 params: {}
               }, '*');
           })();
@@ Expand Down @@

crates/goose/src/goose_apps/resource.rs

-Original file line number
+Diff line change
@@ Expand Up / @@ -12,6 +12,12 @@ pub struct CspMetadata { @@
         /// Domains allowed for resource loading (scripts, styles, images, fonts, media)
         #[serde(skip_serializing_if = "Option::is_none")]
         pub resource_domains: Option<Vec<String>>,
+        /// Domains allowed for frame-src (nested iframes)
+        #[serde(skip_serializing_if = "Option::is_none")]
+        pub frame_domains: Option<Vec<String>>,
+        /// Domains allowed for base-uri
+        #[serde(skip_serializing_if = "Option::is_none")]
+        pub base_uri_domains: Option<Vec<String>>,
     }
     /// Sandbox permissions for MCP Apps
@@ Expand Down @@

ui/desktop/openapi.json

-Original file line number
+Diff line change
@@ Expand Up / @@ -3672,6 +3672,14 @@ @@
             "type": "object",
             "description": "Content Security Policy metadata for MCP Apps\nSpecifies allowed domains for network connections and resource loading",
             "properties": {
+              "baseUriDomains": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                },
+                "description": "Domains allowed for base-uri",
+                "nullable": true
+              },
               "connectDomains": {
                 "type": "array",
                 "items": {
@@ Expand All / @@ -3680,6 +3688,14 @@ @@
                 "description": "Domains allowed for connect-src (fetch, XHR, WebSocket)",
                 "nullable": true
               },
+              "frameDomains": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                },
+                "description": "Domains allowed for frame-src (nested iframes)",
+                "nullable": true
+              },
               "resourceDomains": {
                 "type": "array",
                 "items": {
@@ Expand Down @@

Provide feedback