review-mcp-app-host

name	review-mcp-app-host
description	Implement or audit CharaDock's MCP Apps host, embedded MCP UI cards, bridge methods, sandbox policy, automatic PC/remote presentation, or MCP App regressions. Use for any change involving ui:// resources, _meta.ui.resourceUri, openai/outputTemplate, tools/call from a card, or the MCP App preview.

Review the CharaDock MCP Apps host

Keep MCP Apps portable, safe, and secondary to the character conversation.

Establish the current contract

1. Fetch the current official MCP Apps and OpenAI UI references before changing protocol behavior. Do not rely on remembered method names or metadata shapes.
2. Prefer the open MCP Apps bridge and _meta.ui.resourceUri; support openai/outputTemplate and window.openai only as compatibility aliases.
3. Inventory standard and compatibility features separately. Never advertise a host capability that is not implemented end to end.

Preserve the trust boundary

• Treat resource HTML, tool input/results, card messages, URLs, and JSON-RPC parameters as untrusted.
• Render each card in a script-only sandbox with a restrictive CSP derived from declared connectDomains, resourceDomains, and frameDomains.
• Keep tool arguments, results, resource HTML, credentials, and hidden _meta out of remote public state. Retrieve them through authenticated, CSRF-protected endpoints.
• Allow card tool calls only for the originating MCP server and app-visible tools. Require an existing approval path for mutating, destructive, or open-world actions; otherwise fail closed.
• Validate external links against HTTP(S) and declared redirect policy. Never let card content navigate an app window or invoke native APIs directly.
• Bound HTML, messages, widget state, resource lists, and retained card instances.

Preserve one conversation