Class McpUiResourceCsp

Namespace

ModelContextProtocol.Extensions.Apps

Assembly

ModelContextProtocol.Extensions.Apps.dll

Represents the Content Security Policy (CSP) domain allowlists for an MCP Apps UI resource.

[Experimental("MCPEXP003", UrlFormat = "https://github.com/modelcontextprotocol/csharp-sdk/blob/main/docs/list-of-diagnostics.md#mcpexp003")]
public sealed class McpUiResourceCsp

Inheritance

object

McpUiResourceCsp

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

These allowlists are used by the MCP host to construct the Content-Security-Policy HTTP header for the sandboxed iframe that hosts the UI resource.

Each list contains origins (e.g., "https://api.example.com") that are permitted for the corresponding CSP directive.

Properties

BaseUris

Gets or sets the list of allowed base URIs (base-uri CSP directive).

[JsonPropertyName("baseUris")]
public IList<string>? BaseUris { get; set; }

Property Value

IList<string>

ConnectDomains

Gets or sets the list of origins allowed for fetch, XMLHttpRequest, WebSocket, and EventSource connections (connect-src CSP directive).

[JsonPropertyName("connectDomains")]
public IList<string>? ConnectDomains { get; set; }

Property Value

IList<string>

FrameDomains

Gets or sets the list of origins allowed for loading nested frames (frame-src CSP directive).

[JsonPropertyName("frameDomains")]
public IList<string>? FrameDomains { get; set; }

Property Value

IList<string>

ResourceDomains

Gets or sets the list of origins allowed for loading scripts, stylesheets, images, and fonts (script-src, style-src, img-src, font-src CSP directives).

[JsonPropertyName("resourceDomains")]
public IList<string>? ResourceDomains { get; set; }

Property Value

IList<string>