From 8382c7da2c90d9f49c5bf23aabf3e9fb3972bb9c Mon Sep 17 00:00:00 2001 From: Olivier Chafik Date: Tue, 20 Jan 2026 10:53:24 +0000 Subject: [PATCH] docs(spec): clarify ui.domain is host-dependent Update the spec to clarify that: - ui.domain format and validation rules are host-dependent - Servers must consult host-specific documentation for expected format - Common patterns: hash-based subdomains, URL-derived subdomains - Updated examples to reflect realistic host-controlled domains This addresses the gap between the spec's previous implied flexibility (arbitrary domains like weather-widget.example.com) and real-world constraints where hosts must control sandbox domains for security. --- specification/draft/apps.mdx | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/specification/draft/apps.mdx b/specification/draft/apps.mdx index 272ba3f4d..57759095d 100644 --- a/specification/draft/apps.mdx +++ b/specification/draft/apps.mdx @@ -198,12 +198,20 @@ interface UIResourceMeta { * Dedicated origin for widget * * Optional domain for the widget's sandbox origin. Useful when widgets need - * dedicated origins for API key allowlists or cross-origin isolation. + * stable, dedicated origins for OAuth callbacks, CORS policies, or API key allowlists. * - * If omitted, Host uses default sandbox origin. + * **Host-dependent:** The format and validation rules for this field are + * determined by each host. Servers MUST consult host-specific documentation + * for the expected domain format. Common patterns include: + * - Hash-based subdomains (e.g., `{hash}.claudemcpcontent.com`) + * - URL-derived subdomains (e.g., `www-example-com.oaiusercontent.com`) * + * If omitted, Host uses default sandbox origin (typically per-conversation). + * + * @example + * "a904794854a047f6.claudemcpcontent.com" * @example - * "https://weather-widget.example.com" + * "www-example-com.oaiusercontent.com" */ domain?: string, /**