docs(spec): clarify ui.domain is host-dependent - #309
Merged
Conversation
@modelcontextprotocol/ext-apps
@modelcontextprotocol/server-basic-react
@modelcontextprotocol/server-basic-vanillajs
@modelcontextprotocol/server-budget-allocator
@modelcontextprotocol/server-cohort-heatmap
@modelcontextprotocol/server-customer-segmentation
@modelcontextprotocol/server-map
@modelcontextprotocol/server-pdf
@modelcontextprotocol/server-scenario-modeler
@modelcontextprotocol/server-shadertoy
@modelcontextprotocol/server-sheet-music
@modelcontextprotocol/server-system-monitor
@modelcontextprotocol/server-threejs
@modelcontextprotocol/server-transcript
@modelcontextprotocol/server-video-resource
@modelcontextprotocol/server-wiki-explorer
commit: |
Update the spec to clarify that: - ui.domain format and validation rules are host-dependent - Servers must consult host-specific documentation for expected format - Common patterns: hash-based subdomains, URL-derived subdomains - Updated examples to reflect realistic host-controlled domains This addresses the gap between the spec's previous implied flexibility (arbitrary domains like weather-widget.example.com) and real-world constraints where hosts must control sandbox domains for security.
ochafik
force-pushed
the
ochafik/spec-ui-domain-clarification
branch
from
January 20, 2026 13:39
e2e256d to
8382c7d
Compare
ochafik
marked this pull request as ready for review
January 20, 2026 13:42
jonathanhefner
approved these changes
Jan 21, 2026
jonathanhefner
left a comment
jonathanhefner
left a comment
Member
There was a problem hiding this comment.
What mechanism should apps use to switch between different ui.domain values? For example, an MCP App written to run in either Claude or ChatGPT.
Contributor
Author
@jonathanhefner Servers should switch on |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Clarifies that
ui.domainformat and validation rules are host-dependent, addressing the gap between the spec's previous implied flexibility and real-world constraints.Fixes: Addresses feedback from https://github.com/anthropics/apps/pull/19201#issuecomment-3769736628
Changes
Updates the
ui.domainfield documentation to:ui.domainare determined by each host{hash}.claudemcpcontent.com)www-example-com.oaiusercontent.com)https://weather-widget.example.comwith actual host-controlled domain patternsRationale
The previous spec example
https://weather-widget.example.comimplied servers could specify arbitrary domains. In practice, hosts cannot serve UI from arbitrary domains - they must control the domain for security. Each host determines its own domain format and validation rules.This change sets realistic expectations for server developers while keeping the spec generic enough to accommodate different host implementations.