Repository navigation
mcp-app-lint: read CSS url() only from CSS, hint at unkeyed URLs - #16
Merged
Merged
Conversation
mcp-app-lint: the CSS url() pattern was case-insensitive and ran over the
whole document, so `new URL("https://github.com/cfworker")` in a bundled
JSON Schema validator came out of --suggest-csp as a needed resource origin
(and would feed MCPAPP001's suggestion and MCPAPP021). url() and @import are
now read from <style> blocks and style attributes only.
A bundle that hands a URL string to a library (the ext-apps map example:
a Cesium base URL in a template literal, an OpenStreetMap tile template)
was reported as needing no CSP. Such origins are now listed as hints whose
key cannot be told statically: a text line, a stderr note next to the JSON
(stdout keeps the 0.1.7 shape), and `mentioned` in the suggest_csp tool.
Link targets, XML namespaces, framework documentation hosts and
placeholders are left out. Checked on the published ext-apps map,
basic-react, budget-allocator and pdf packages and the built Vue example.
shteynu
pushed a commit
that referenced
this pull request
Oct 14, 2026
All seven packages and the Claude Code plugin at 0.1.8; CHANGELOG dated 2026-10-14. Lockfile: only the workspace versions changed. Changes since 0.1.7: mcp-app-lint only (PR #16). --suggest-csp no longer reads `new URL()` in script as a CSS url(), and lists absolute URLs with no known key (map tiles, a CDN base URL) as hints instead of reporting such a UI as needing no CSP. The other packages are unchanged. npm run check green on these versions (Chromium proofs, corpus 54/54 and 24/24). From a clean install of the mcp-app-lint tarball: the built Vue example needs no CSP, and the published ext-apps map bundle gives the hint https://cesium.com https://tile.openstreetmap.org.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two problems in
--suggest-cspfrom 0.1.7, found by running it on built MCP App bundles.A false origin. The CSS
url()pattern ignored case and ran over the whole document. Sonew URL("https://github.com/cfworker")in a bundled JSON Schema validator came out as a neededresourceDomainsorigin, and could also feed MCPAPP001's suggestion and MCPAPP021.url()and@importare now read only from<style>blocks andstyleattributes.Missed origins. A bundle that hands a URL string to a library was reported as needing no CSP. The ext-apps map example is one: a Cesium base URL in a template literal and an OpenStreetMap tile template. The key such a URL needs cannot be told from the code, so these origins are now listed as hints, never put into the declaration:
--format text;mentionedin thesuggest_cspMCP tool's result.Link targets, XML namespaces, framework documentation hosts and placeholders such as
*.example.comare left out.mentionedOriginsis exported.Verification
npm test(mcp-app-lint 55, including new cases for both problems),npm run typecheck,npm run build,npm run test:census.basic-server-vue/dist/mcp-app.html): needs no CSP; before the fix it was givenhttps://github.com.@modelcontextprotocol/server-map@2.0.3: the hint lists exactlyhttps://cesium.comandhttps://tile.openstreetmap.org.server-basic-react,server-budget-allocatorandserver-pdf: unchanged.