{
  "title": "MCP Apps CSP and Permissions Matrix",
  "schemaVersion": "1.0",
  "researchFreeze": "2026-08-26",
  "protocolRevision": "MCP Apps 2026-01-26 / ext-apps SDK v1.7.5 / MCP core 2026-07-28",
  "sourcePackage": "research/9",
  "integrityNote": "The 93 ordinary archive entries verify. Two self-referential bookkeeping entries have disclosed stale final rows; public corrections do not modify the raw archive.",
  "count": 14,
  "records": [
    {
      "Control": "Sandboxed iframe",
      "Layer": "Host/browser",
      "Purpose": "Isolate active app code from parent DOM and origin",
      "App request?": "No; mandatory host behavior",
      "Host discretion": "May impose stricter sandbox",
      "Principal failure mode": "Over-broad sandbox flags or host implementation bug",
      "Sources": "S004 S006 S060",
      "id": "R9-CSP001",
      "packageSourceIds": [
        "S004",
        "S006",
        "S060"
      ],
      "sourceIds": [
        "S390",
        "S136",
        "S436"
      ]
    },
    {
      "Control": "connectDomains",
      "Layer": "CSP",
      "Purpose": "Allow network connections",
      "App request?": "Declared by server",
      "Host discretion": "May restrict further",
      "Principal failure mode": "Exfiltration or broken app when incomplete",
      "Sources": "S004 S010 S062",
      "id": "R9-CSP002",
      "packageSourceIds": [
        "S004",
        "S010",
        "S062"
      ],
      "sourceIds": [
        "S390",
        "S395",
        "S438"
      ]
    },
    {
      "Control": "resourceDomains",
      "Layer": "CSP",
      "Purpose": "Allow external scripts/styles/fonts/images/media",
      "App request?": "Declared by server",
      "Host discretion": "May restrict further",
      "Principal failure mode": "Supply-chain compromise or blocked assets",
      "Sources": "S004 S010 S065",
      "id": "R9-CSP003",
      "packageSourceIds": [
        "S004",
        "S010",
        "S065"
      ],
      "sourceIds": [
        "S390",
        "S395",
        "S441"
      ]
    },
    {
      "Control": "frameDomains",
      "Layer": "CSP",
      "Purpose": "Allow nested frames",
      "App request?": "Declared by server",
      "Host discretion": "May restrict or fail to implement",
      "Principal failure mode": "Clickjacking/embedded third-party risk or compatibility failure",
      "Sources": "S004 S080",
      "id": "R9-CSP004",
      "packageSourceIds": [
        "S004",
        "S080"
      ],
      "sourceIds": [
        "S390",
        "S456"
      ]
    },
    {
      "Control": "baseUriDomains",
      "Layer": "CSP",
      "Purpose": "Restrict document base URI",
      "App request?": "Declared by server",
      "Host discretion": "May restrict further",
      "Principal failure mode": "Relative URL rewriting or injection",
      "Sources": "S004 S067",
      "id": "R9-CSP005",
      "packageSourceIds": [
        "S004",
        "S067"
      ],
      "sourceIds": [
        "S390",
        "S443"
      ]
    },
    {
      "Control": "Dedicated domain",
      "Layer": "Origin/CORS",
      "Purpose": "Stable origin for OAuth callbacks and API allowlists",
      "App request?": "Declared by server",
      "Host discretion": "Host-specific format",
      "Principal failure mode": "Origin collision, weak validation or portability loss",
      "Sources": "S004 S010",
      "id": "R9-CSP006",
      "packageSourceIds": [
        "S004",
        "S010"
      ],
      "sourceIds": [
        "S390",
        "S395"
      ]
    },
    {
      "Control": "CORS",
      "Layer": "Remote API",
      "Purpose": "Permit app origin to read responses",
      "App request?": "No; API operator configures",
      "Host discretion": "None beyond origin selection",
      "Principal failure mode": "CSP allows request but API blocks response",
      "Sources": "S010 S063",
      "id": "R9-CSP007",
      "packageSourceIds": [
        "S010",
        "S063"
      ],
      "sourceIds": [
        "S395",
        "S439"
      ]
    },
    {
      "Control": "camera",
      "Layer": "Permissions Policy/browser permission",
      "Purpose": "Capture video",
      "App request?": "Yes",
      "Host discretion": "May deny",
      "Principal failure mode": "Privacy invasion",
      "Sources": "S004 S066",
      "id": "R9-CSP008",
      "packageSourceIds": [
        "S004",
        "S066"
      ],
      "sourceIds": [
        "S390",
        "S442"
      ]
    },
    {
      "Control": "microphone",
      "Layer": "Permissions Policy/browser permission",
      "Purpose": "Capture audio",
      "App request?": "Yes",
      "Host discretion": "May deny",
      "Principal failure mode": "Eavesdropping/privacy harm",
      "Sources": "S004 S066",
      "id": "R9-CSP009",
      "packageSourceIds": [
        "S004",
        "S066"
      ],
      "sourceIds": [
        "S390",
        "S442"
      ]
    },
    {
      "Control": "geolocation",
      "Layer": "Permissions Policy/browser permission",
      "Purpose": "Access location",
      "App request?": "Yes",
      "Host discretion": "May deny",
      "Principal failure mode": "Location privacy leakage",
      "Sources": "S004 S066",
      "id": "R9-CSP010",
      "packageSourceIds": [
        "S004",
        "S066"
      ],
      "sourceIds": [
        "S390",
        "S442"
      ]
    },
    {
      "Control": "clipboardWrite",
      "Layer": "Permissions Policy/browser permission",
      "Purpose": "Write clipboard data",
      "App request?": "Yes",
      "Host discretion": "May deny",
      "Principal failure mode": "Clipboard manipulation",
      "Sources": "S004 S066",
      "id": "R9-CSP011",
      "packageSourceIds": [
        "S004",
        "S066"
      ],
      "sourceIds": [
        "S390",
        "S442"
      ]
    },
    {
      "Control": "Tool visibility",
      "Layer": "Host/tool policy",
      "Purpose": "Separate model-visible and app-callable tools",
      "App request?": "Server metadata",
      "Host discretion": "Must enforce declared visibility; may restrict more",
      "Principal failure mode": "App calls unintended tool",
      "Sources": "S004",
      "id": "R9-CSP012",
      "packageSourceIds": [
        "S004"
      ],
      "sourceIds": [
        "S390"
      ]
    },
    {
      "Control": "User confirmation",
      "Layer": "Host UX",
      "Purpose": "Confirm sensitive operations",
      "App request?": "No",
      "Host discretion": "Yes",
      "Principal failure mode": "Confusing or missing approval",
      "Sources": "S002 S037 S041",
      "id": "R9-CSP013",
      "packageSourceIds": [
        "S002",
        "S037",
        "S041"
      ],
      "sourceIds": [
        "S059",
        "S140",
        "S420"
      ]
    },
    {
      "Control": "Underlying authorization",
      "Layer": "MCP server/upstream system",
      "Purpose": "Enforce object and tenant permissions",
      "App request?": "No",
      "Host discretion": "No substitute",
      "Principal failure mode": "Privilege escalation",
      "Sources": "S042 S055 S083",
      "id": "R9-CSP014",
      "packageSourceIds": [
        "S042",
        "S055",
        "S083"
      ],
      "sourceIds": [
        "S145",
        "S431",
        "S457"
      ]
    }
  ]
}