Europe 2026
Why MCP and ChatGPT Apps Use Double Iframes — Frédéric Barthelet, Alpic
Overview
This talk explores the technical reasons behind the double iFrame implementation used by ChatGPT and other MCP (Meta-Conversational Platform) applications to render third-party UIs. It delves into the security implications of Content Security Policy (CSP) and sandboxing, explaining why direct iFrame embedding or using source-doc attributes are problematic. The presentation highlights the double iFrame approach as a solution to isolate third-party code while enabling necessary functionalities.
Who should watch
- AI Engineers building applications for conversational agents like ChatGPT or Claude.
- Product Managers evaluating the technical feasibility of integrating interactive UIs into AI chat platforms.
- Developers encountering issues with cross-origin resource sharing or CSP directives when embedding external content.
- Builders seeking to understand the underlying architecture of how third-party UIs function within AI chat interfaces.
Key takeaways
- MCP apps enable interactive UIs within conversational agents, rendered as HTML views triggered by tool calls.
- Directly embedding third-party UI using iFrames within ChatGPT is restricted by Content Security Policy (CSP) directives like script-src and frame-src.
- Using the iFrame `sandbox` attribute with `allow-same-origin` negates the sandboxing effect, allowing access to parent DOM and storage.
- The `source-doc` attribute for iFrames shares the parent's origin and CSP, preventing script execution and posing security risks.
- A common approach involves a proxy-controlled domain that serves as a single point of entry, downloading and exposing MCP server resources.
- The double iFrame mechanism involves an outer iFrame with a dedicated domain for isolation, which then loads an inner iFrame using `source-doc` for the actual application content.
- This nested structure ensures that the inner iFrame's scripts operate in a more controlled environment, preventing direct access to the parent's origin and data.
- Developers must declare all external domains their application depends on within the MCP app spec's metadata (e.g., `connect-src`, `script-src`) to ensure correct CSP handling in nested iFrames.
Notable quotes
*The double iFrame mechanism is a solution to isolate third-party code while enabling necessary functionalities.*
*Builders life is made better by efforts in the ecosystem to make builders life better.*
Unofficial community note. Prefer the recording for nuance.