How it works
Inspect the complete boundary.
connectDomains covers fetch, XHR and WebSocket destinations. resourceDomains covers scripts, images, styles, fonts and media. frameDomains allows nested frames, while baseUriDomains controls document base URLs. Keep each list limited to origins the view actually uses.
The stable specification uses a restrictive default when CSP metadata is omitted. This checker rejects paths, query strings, broad stars and insecure HTTP because CSP metadata should identify secure origins, not arbitrary URLs.
Continue debugging
- Run the browser validator.
- Review sandbox CSP metadata.
- Resolve resource and metadata errors.
- Finish with the official conformance tooling and a supported MCP host.
MCP App Ready is independent and is not affiliated with the Model Context Protocol project.