MCP Apps: explicitly allowed HTTP localhost iframe blocked by CSP
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 125k
- Forks
- 19.4k
- PR merge metrics
- PR metrics pending
Description
What version of the Codex App are you using (From “About Codex” dialog)?
26.908.70816
What subscription do you have?
Pro
What platform is your computer?
Darwin 25.6.0 arm64 arm
What issue are you seeing?
A static MCP Apps UI resource cannot fetch data or load images from an explicitly allowlisted HTTP localhost server.
What steps can reproduce the bug?
- Serve a directory containing
data.jsonandimage.png:
python3 -m http.server 58197 --bind 127.0.0.1
- Register this static UI resource and tool on an MCP server:
server.registerResource(
"localhost-test",
"ui://localhost-test/index.html",
{ mimeType: "text/html;profile=mcp-app" },
async () => ({
contents: [{
uri: "ui://localhost-test/index.html",
mimeType: "text/html;profile=mcp-app",
text: `
<!doctype html>
<html>
<body>
<img src="http://127.0.0.1:58197/image.png">
<pre id="result">Loading...</pre>
<script>
fetch("http://127.0.0.1:58197/data.json", {
mode: "no-cors"
})
.then(() => {
document.getElementById("result").textContent =
"Request completed";
})
.catch(error => {
document.getElementById("result").textContent =
String(error);
});
</script>
</body>
</html>
`,
_meta: {
ui: {
csp: {
connectDomains: ["http://127.0.0.1:58197"],
resourceDomains: ["http://127.0.0.1:58197"]
}
}
}
}]
})
);
server.registerTool(
"test_localhost",
{
description: "Open the localhost resource test",
inputSchema: {},
_meta: {
ui: { resourceUri: "ui://localhost-test/index.html" }
}
},
async () => ({
content: [{ type: "text", text: "Localhost test" }]
})
);
- Connect the MCP server to Codex and invoke
test_localhost. - Inspect the widget console and local server request logs.
The fetch uses no-cors solely to isolate CSP blocking from missing CORS response headers; it does not read the response body.
What is the expected behavior?
Support explicitly allowlisted HTTP localhost/127.0.0.1 origins, at least through a development setting or user permission.
The MCP Apps CSP documentation explicitly mentions declaring localhost during development. Requiring HTTPS and certificate trust setup adds significant friction for local plugins.
Additional information
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the MCP Apps resource with the provided Python HTTP server and JavaScript registration, then inspect the widget console and local server request logs. Trace how the Codex App builds and enforces iframe CSP for connectDomains and resourceDomains; done means explicitly allowlisted HTTP localhost/127.0.0.1 fetches and images are no longer blocked.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- desktop-dev, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 64/100