Security model for agent-rendered UI

Your View renders data that travelled: external service → MCP server → model → host → iframe. Every hop is a place content could have been shaped by someone who is not your user. Design accordingly.

The sandbox contract

• The View runs in a sandboxed iframe with no access to the host's DOM, cookies, localStorage, or origin.
• postMessage is the only channel, which makes every capability enumerable and auditable. That is a feature — do not try to widen it.
• CSP is deny-by-default. Anything not declared in _meta.ui.csp is blocked.
• Nested frames are blocked unless frameDomains opts in (and several hosts do not support frameDomains at all).

For mcp-ui's client renderer, the sandbox.url proxy origin is what enforces isolation. Never point it at your own application origin to make something work — that hands untrusted markup your session.