[v2] [Web] MCP App renderer reads UI resource metadata from _meta instead of _meta.ui #2055

Which version line?

v2 — current (@modelcontextprotocol/inspector@latest)

Which client?

Web

Inspector version

2.2.0

Node version

v22.19.0

Operating system

macOS, Chrome

Transport

Streamable HTTP

MCP server under inspection

Any MCP App server declaring UI resource metadata under _meta.ui (e.g. _meta.ui.csp with connectDomains or _meta.ui.permissions).

Steps to reproduce

1. Start an MCP server that serves an MCP App UI resource declaring network permissions under _meta.ui.csp (e.g., connectDomains: ["https://api.example.com"]).
2. Launch the MCP Inspector web client and connect to the server.
3. Open the Apps screen and open the app.
4. The running view attempts to execute a fetch() request to an allowlisted domain in connectDomains.

Expected behavior

Per the MCP Apps specification (apps.mdx and spec.types.ts), the host reads _meta.ui.csp and _meta.ui.permissions from the UI resource content block (or result level), parses connectDomains, and applies them to the generated CSP <meta> header in the inner iframe.

Actual behavior

In clients/web/src/components/elements/AppRenderer/createAppBridgeFactory.ts, extractHtmlAndMeta reads content._meta directly as McpUiResourceMeta:

meta: content._meta as McpUiResourceMeta | undefined,

Because the spec defines the metadata under _meta.ui, meta.csp and meta.permissions evaluate to undefined. approveCspSources(undefined) produces {} and buildSandboxCspPolicy generates connect-src 'none', blocking outgoing network requests.

Already prototyped a fix?

Prompt to reproduce:

In clients/web/src/components/elements/AppRenderer/createAppBridgeFactory.ts, update extractHtmlAndMeta to extract UI resource metadata from content._meta?.ui (falling back to result._meta?.ui), rather than casting content._meta directly. Update the uiResource test fixture helper in createAppBridgeFactory.test.ts to wrap supplied metadata in { _meta: { ui: meta } } to match the spec.

Verified behavior:

• createAppBridgeFactory.ts extracts csp and permissions from _meta.ui.
• createAppBridgeFactory.test.ts passes with the spec-compliant { _meta: { ui: ... } } structure.