Variable McpUiResourceCspSchemaConst
McpUiResourceCspSchema: ZodObject<
{
baseUriDomains: ZodOptional<ZodArray<ZodString>>;
connectDomains: ZodOptional<ZodArray<ZodString>>;
frameDomains: ZodOptional<ZodArray<ZodString>>;
resourceDomains: ZodOptional<ZodArray<ZodString>>;
},
$strip,
> = ...
Description
Content Security Policy configuration for UI resources.
Servers declare which origins their UI requires. Hosts use this to enforce appropriate CSP headers.
MCP App HTML runs in a sandboxed iframe with no same-origin server. All origins must be declared—including where your bundled JS/CSS is served from (
localhostin dev, your CDN in production).