MCP Apps sandbox: serve the proxy from a separate origin (SEP-1865 requires Host and Sandbox to differ)

Summary

The MCP Apps sandbox proxy is currently loaded via srcdoc, which makes the sandbox same-origin as the host. SEP-1865 requires the opposite: the Host and the Sandbox MUST have different origins.

What the spec requires

From the SEP-1865 security model (spec 2026-01-26/apps.mdx):

• "The Sandbox MUST have the following permissions: allow-scripts, allow-same-origin."
• "The Host and the Sandbox MUST have different origins."
• "If the Host is a web page, it MUST wrap the View and communicate with it through an intermediate Sandbox proxy."

allow-same-origin is correct and required. It is safe only when the Sandbox is a different origin from the host: then it gives the View its own stable, isolated origin (storage, cookies) while the different origin prevents it from touching the host. The double-iframe proxy relays JSON-RPC across that origin boundary.

Current behavior (pre-existing, from #6707)

buildSandboxHTML is loaded with iframe.srcdoc = ..., and the inner widget iframe is likewise inner.srcdoc = html, both with allow-scripts allow-same-origin. A srcdoc iframe with allow-same-origin inherits the embedder's (host) origin. So today the View runs with the host origin: it can reach host cookies/localStorage, and with allow-scripts + allow-same-origin it can escape into the host DOM. This is the "host-origin access" risk CodeRabbit flagged on #6884.

This is not introduced by the shared-package extraction (#6884) - buildSandboxHTML is verbatim from #6707 - but the extraction is the natural place to fix it once, for all three frontends.

Proposed fix

Serve the sandbox proxy from a separate origin (a dedicated sandbox domain/subdomain) via iframe.src = "https://<sandbox-origin>/..." instead of srcdoc, so the Host and Sandbox are genuinely cross-origin per the spec. Keep allow-scripts allow-same-origin on the sandbox (required), and keep the double-iframe proxy relay. This needs host infrastructure (a distinct origin to serve the proxy) and a fallback story for local/dev.

Scope

• Applies to all frontends once the shared @copilotkit/mcp-apps-renderer package owns buildSandboxHTML (#6823 / #6884).
• Add compatibility tests for same-origin-relying widgets when the origin changes.

Refs: #6884, #6823, #6707. Spec: https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/2026-01-26/apps.mdx