[Bug]: MCP App CSP domains must be HTTPS origins (or loopback HTTP origins).

Summary

Hi, I am hitting message "MCP App CSP domains must be HTTPS origins (or loopback HTTP origins)." or an MCP app that does work in Mistral and Claude. Reading OpenWork code, the CSP domains should be properly reckognized as loopback so not sure what happens.

To Reproduce

1. Clone https://github.com/lbke/mcp-use-doom
2. Install (pnpm run install) and run (pnpm run dev)
3. Deploy the server
4. Plug to openwork

Expected behavior

Opens Doom

Actual behavior

Error:

Interactive view unavailable. The normal tool result is still available. MCP App CSP domains must be HTTPS origins (or loopback HTTP origins).

Retry
Copy these details when reporting the rendering problem.

Code: MCP_APP_RESOURCE_RESOLUTION_FAILED
Cause code: invalid_resource_csp
Stage: resource-resolution
Message: MCP App CSP domains must be HTTPS origins (or loopback HTTP origins).
Tool: mcp-doom_doom-css
Elapsed: 761 ms
Checkpoints: resolve-started -> resolve-failed-1+761ms

Note that the localhost version doesn't work at all either.

Screenshots (optional)

Deployed (tool doesn't run, CSP issue):

Localhost (tools run but no display):

OW version & Desktop info (optional)

• openwork-linux-x86_64-0.18.48
• Ubuntu 26

Additional context (optional)

No response