modelcontextprotocol / modelcontextprotocol/ext-apps
SEP: Sandbox capabilities
Open
@idosal is already working on this.
Since Dec 1, 2025.
- Dominant language
- TypeScript
- Stars
- 2.9k
- Forks
- 387
- Avg merge
- 3h 21m
- Merged PRs (30d)
- 6
Description
Currently, the SEP sets the minimum required permissions for the app runtime (allow-scripts allow-same-origin). However, it doesn't address -
- Additional capabilities like camera and microphone (@yannj-fr and others)
- Hardening like
base-uri(which can affect capabilities like translations between web apps and raw HTML) or nested iframes (which might also requireui: csp: frameDomains).
These can fundamentally alter the content the server chooses to advertise or return.
We need to define the negotiation for these capabilities.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.