[BUG] MCP Apps `media-src` missing in iframe CSP

[aharvard]

Issue

I have an MCP app that loads audio. I noticed that themedia-src CSP is not getting set properly.

How to reproduce

Open the Electron/Chrome dev tools inspector and look at the meta tag in the iframe. Note that the resource domain is getting set for some CSP but not media source.

Expected Behavior

I expect my resource domains to get applied to all CSP attributes.

Platform

[dosubot]

The root cause is that the CSP meta tag generated for MCP App iframes does not include a media-src directive, so your declared resource domains aren't applied to audio/video sources. The CSP builder in server/routes/mcp/sandbox-proxy.html currently maps resourceDomains to script-src, style-src, img-src, and font-src, but omits media-src entirely. This means browsers block media loads even if you've set the correct domains in your widget metadata (source).

To fix this, update the buildCSP function so it adds a media-src directive using the same resourceDomains logic as the other resource directives. The debug panel (csp-debug-panel.tsx) already expects media-src to be handled this way and will show correct suggestions once the CSP is generated properly (source).

A minimal patch would look like:

// In buildCSP (server/routes/mcp/sandbox-proxy.html)
return [
  "default-src 'none'",
  "script-src 'unsafe-inline' " + resourceSrc,
  "style-src 'unsafe-inline' " + resourceSrc,
  "img-src " + resourceSrc,
  "font-src " + resourceSrc,
  "media-src " + resourceSrc, // <-- Add this line
  "connect-src " + connectSrc,
  "frame-src 'none'",
  "object-src 'none'",
  "base-uri 'none'",
].join("; ");

This will allow your declared resource domains to apply to audio and video elements as expected.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[chelojimenez]

hi @aharvard! i think the spec doesn't mention media-src anywhere (i see you're adding an issue about it), but i agree we the csp should include it. theres an open issue that ido pointed me about finalizing how to handle capability negotiation. thoughts?

[aharvard]

Hey @chelojimenez, yeah, I think media-src might have been a miss in the spec draft. I did find it in some of the ext-apps example code. Just opened a corresponding PR as well.

Thanks for linking me to the other open issue. It seems like the main goal there is to make sure hosts communicate well with servers about things that could affect the user experience. I don’t think that whether a media source is present or not makes that big of a difference for the end user. So, whether a server needs to know if a host allows media to load isn't that important. Still, I think there’s a lot of value in hosts telling servers what kinds of resources they’re willing to allow in the CSP. That could at least allow server authors to potentially provide adaptive designs.

[chelojimenez]

@aharvard on our end, we're not opposed to adding it to our sandbox since its a small lift. we're adding a CSP toggle in our builder that lets you choose between a "permissive" (for dev) or "strict" (per the spec) csp. i think we can make the permissive mode include the other directives as well

[aharvard]

i think we can make the permissive mode include the other directives as well

Sounds great, thanks!

[idosal]

It was indeed accidentally omitted from the example CSP. Fixed now, thanks to @aharvard's contribution. :)

[chelojimenez]

super fast 🏎️ , ill get this in our next deploy

[chelojimenez]

@aharvard v1.3.8 is out! could you confirm this change is working on your end?

[aharvard]

Works great! Thanks @chelojimenez and @idosal for the awesome collab on this. Y'all rock!