Grok host: MCP Apps iframe rendering unstable for Paybox connector (custom BYO MCP)

Summary

Paybox (MoonPay) reports that Grok’s MCP Apps iframe host is extremely buggy when rendering Paybox’s in-chat UI widgets via a custom BYO MCP connector (https://mcp.paybox.sh or equivalent production endpoint).

The same Paybox MCP App UI resource renders on other major hosts (ChatGPT, Claude with correct handshake/CSP), but Grok’s iframe lifecycle is unreliable enough to block normal Paybox flows (signing, approvals, balance updates).

Reporter

MoonPay Paybox team (internal escalation from Paybox engineering)

Environment

• Host: Grok web (grok.com) — custom MCP connector (Bring Your Own MCP)
• MCP server: Paybox MCP (wallet / approvals / signing UI)
• UI: MCP Apps HTML resources (text/html;profile=mcp-app) served from Paybox iframe surfaces (app.paybox.sh)
• Protocol: MCP Apps / io.modelcontextprotocol/ui capability

Observed problems (high level)

Paybox engineers report Grok’s iframe support is extremely buggy compared to Claude and ChatGPT. Symptoms align with known MCP Apps host-integration failure modes:

1. Stale / non-updating UI — iframe continues showing prior state (e.g. pending approval button) after the underlying transaction completes; host does not deliver updated tool-result / lifecycle notifications reliably.
2. Signing window failures — signing / passkey approval surfaces fail to load or hang inside Grok’s embedded iframe.
3. Multiple concurrent iframes — duplicate widget instances for a single logical action (e.g. several signer-key regeneration iframes in one session), with poor cross-iframe state coordination.
4. General iframe lifecycle instability — intermittent blank/hidden widgets, missed ui/initialize / ui/notifications/initialized handshakes, or postMessage delivery gaps (similar symptoms documented for other hosts in ext-apps issues, but Grok-specific regressions appear worse / more frequent for Paybox).

Expected behavior

Per MCP Apps host requirements:

1. Host calls tools/call and receives structuredContent + UI linkage via _meta.ui.resourceUri
2. Host fetches HTML via resources/read and mounts sandboxed iframe
3. Host completes UI handshake and delivers tool-input / tool-result notifications
4. Widget updates reflect server state changes without requiring the user to ask the model to “verify” or open external approval links

Actual behavior

Grok intermittently fails steps 2–4. Users see broken, stale, or duplicated Paybox UI inside Grok chat while the same flows work on other MCP hosts.

References / related issues

• Cross-host MCP Apps rendering debugging: https://github.com/modelcontextprotocol/ext-apps/issues/671
• Working minimal demo that renders on ChatGPT + Grok + Claude (when handshake fixed): https://github.com/primevalsoup/mcp-apps-claude-demo
• Paybox parallel report (Claude stale UI after successful swap): internal Paybox eng Slack 2026-08-19

Request for xAI / Grok host team

Please investigate Grok’s MCP Apps iframe host implementation for custom connectors:

• iframe mount + visibility (ui/initialize / ui/notifications/initialized)
• delivery of tool-result and lifecycle notifications after state changes
• handling multiple widgets in one conversation
• CSP / sandbox / postMessage bridge for third-party MCP App origins

Happy to provide repro videos, connector URL, and server logs on request.

Start by reviewing the cross-host MCP Apps debugging discussion in ext-apps issue 671 and the linked minimal demo. Reproduce the Paybox flow through the custom MCP connector, focusing on iframe mounting, handshake, lifecycle notifications, and concurrent widgets. Done means the embedded UI reliably loads, updates after tool results, and avoids duplicate or blank instances.