Why MCP and ChatGPT Apps Use Double Iframes
summary
Diagnoses why a double iframe is the practical outcome: srcdoc shares parent origin so ChatGPT’s CSP blocks third‑party scripts; relaxing CSP lets an app read ChatGPT localStorage and cookies; sandboxing removes origin‑indexed storage and adding allow‑same‑origin recreates the sandbox escape. The deployed pattern uses an outer iframe on per‑app subdomains that runs one loader script and an inner srcdoc iframe with the app HTML, which forces listing every external domain in MCP metadata and motivates tools like Skybridge’s CSP inspector.
AI-written summary · about
chapters (8)
- 0:00Introduction to MCP apps
- 2:02How MCP views work
- 3:34The double iframe challenge
- 6:56Security and isolation
- 10:17Implementing the solution
- 13:29Developer requirements
- 15:16Improving developer experience
- 16:53Demo and conclusion
related talks
22mNuances of Iframe: Lessons from Contentstack Live Preview
21miframe abuse
42mIframe v Script
44mIFRAME
38mEvolving AI chat with MCP Apps
29mMCP Apps: Primitives, discovery, and the Future of Software
29miframes: A look in to the black heart of the browsers
27mLocal frames: exploiting inherited origins to bypass content blockers