Expired50% confidenceFactTime unknown
MCP Apps chose iframes over WebComponents or Shadow DOM for rendering because iframes provide process-level isolation that prevents security vulnerabilities from breaching the host page's security boundary
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
7/2/2026
First Seen
Valid until: 9/30/2026(expired)
Sources
MCP Apps Deep Dive: AI Tools Move from Text Exchange to Interactive Collaboration
bilibili懒耶耶努力Building
Related Claims
UnverifiedClients like Claude and ChatGPT render MCP Apps UI in a sandboxed iframe that fetches the HTML file at the UI address60% similarUnverified无JS页面天然规避了跨站脚本（XSS）攻击面，在安全敏感的内容展示场景下是有意义的架构选择57% similarUnverifiedchrome-devtools-mcp enables AI coding assistants to open web pages, take screenshots, read DOM structures, and inspect element styles.56% similarUnverifiedMarkdown 解析器渲染 HTML 时的主要安全威胁是跨站脚本攻击（XSS），因标准 Markdown 允许内嵌原生 HTML56% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/56200API
curl https://kongchang.com/api/v1/knowledge/claims/56200MCP
get_claim(id=56200)