Thoughts about a mimeType equivalent to text/uri-list

[chrisbmatthews]

Thanks for the well thought-out spec.
I know that for the MVP, the focus is on serving HTML via the text/html;profile=mcp-app mimeType.

And I know that you have left the spec open for extension later on ("other content types are reserved for future extensions").

MCP-UI supports: mimeType: 'text/uri-list' → Render in a sandboxed iframe using src

Do you envision that iframing a straight uri like this may ever be a post-MVP feature, or do you see technical or security reasons why that would never be advisable?

Btw, I did read the conversation here about the ability of a Host to pre-cache HTML-based resources, and that is a fairly good argument for why you've started with text/html:
#298

Thanks!

[idosal]

Hey @chrisbmatthews, thanks for raising this. A few large hosts were unlikely to directly support this, which is why it was originally deferred. However, there are a few alternatives that have been accepted into the spec since then -

1. Negotiate frameDomains in the CSP to render your iframe in the text/html;profile=mcp-app response.
2. Fetch the HTML from the external URL (to be returned as text/html;profile=mcp-app). Negotiate baseUri in the CSP and rewrite the URLs with a <base> tag.
   Please note that the Host may reject CSP negotiation, and some Hosts (like ChatGPT) have declared frameDomain support will be limited to select apps.

Do these answer your use case?

[chrisbmatthews]

Thanks for the suggestion, @idosal

I tried the first option (frameDomains)

This indeed will work. I am building out a host app and exploring options for supporting iframed MCP Apps. Some local testing has verified that this can work, but I certainly see your point that not every host app will support this.

Btw, I think this is what you meant:

Host
  +- Sandbox iframe
    +- MCP App html blob (which happens to contain its own iframe in the html; the `frameDomains` for this resource allows me to iframe my final target)
      +- target iframe url

...that's a lot of iframes.

It's worth pointing out that if your final target url is the "true" app that will be responding to protocol messages, the "MCP App html blob" above will need some JS to forward the messages between the Sandbox <-> target iframe url.

I'll continue to explore what my other options are as well. I had tried your 2nd option earlier, but didn't notice the baseUriDomains section in the CSP section, so I'll revisit that attempt.

The most ideal solution would be one that most host apps will support, and your 2nd option may do that

Thanks again for your help!

[idosal]

@chrisbmatthews if it helps, I added an example that uses baseUri. It's a little complex because I had to resolve some import issues with a domain I don't control, but it should point you in the right direction.