Skip to content

feat: add UI resource metadata types for CSP and rendering config #65

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ochafik merged 1 commit into from
Dec 3, 2025
Merged

feat: add UI resource metadata types for CSP and rendering config #65

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions src/types.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -823,3 +823,38 @@ type _VerifyInitializedNotification = VerifySchemaMatches<
typeof McpUiInitializedNotificationSchema,
McpUiInitializedNotification
>;

// =============================================================================
// UI Resource Metadata Types
// =============================================================================

/**
* Content Security Policy configuration for UI resources.
*
* Servers declare which external origins their UI needs to access.
* Hosts use this to enforce appropriate CSP headers.
*/
export const McpUiResourceCspSchema = z.object({
Copy link
Collaborator

@idosal idosal Dec 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@antonpk1 What do you think about add describes to the fields?

Copy link
Collaborator

@ochafik ochafik Dec 2, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note I've been toying w/ generating the zod schemas (in this branch), I think we should focus on clean types and automate the rest. (I wouldn't even put comments on the schemas to stay consistent w/ current state of this file, to avoid comment duplication)

/** Origins for network requests (fetch/XHR/WebSocket). Maps to CSP connect-src */
connectDomains: z.array(z.string()).optional(),
/** Origins for static resources (images, scripts, stylesheets, fonts). Maps to CSP img-src, script-src, style-src, font-src */
resourceDomains: z.array(z.string()).optional(),
});
export type McpUiResourceCsp = z.infer<typeof McpUiResourceCspSchema>;

/**
* UI Resource metadata for security and rendering configuration.
*
* Included in the `_meta.ui` field of UI resource content returned via `resources/read`.
*
* @see {@link McpUiResourceCspSchema} for CSP configuration
*/
export const McpUiResourceMetaSchema = z.object({
/** Content Security Policy configuration */
csp: McpUiResourceCspSchema.optional(),
/** Dedicated origin for widget sandbox */
domain: z.string().optional(),
/** Visual boundary preference - true if UI prefers a visible border */
prefersBorder: z.boolean().optional(),
});
export type McpUiResourceMeta = z.infer<typeof McpUiResourceMetaSchema>;