@agent-native/core 0.72.2 → 0.72.4

package/corpus/core/src/mcp-client/config.ts

@@ -45,6 +45,18 @@ export interface McpHttpServerConfig {
   url: string;
   /** Extra headers to send with every request (e.g. Authorization). */
   headers?: Record<string, string>;
+  /**
+   * Trusted first-party Agent-Native app. This is set only by framework-owned
+   * org-scoped registrations, not by raw file/env config.
+   */
+  firstParty?: boolean;
+  /** Canonical first-party app id from the org directory, e.g. `assets`. */
+  firstPartyAppId?: string;
+  /**
+   * Org id the first-party server is trusted for. Runtime-only metadata set by
+   * framework-owned registrations; raw file/env config cannot provide it.
+   */
+  firstPartyOrgId?: string;
   /** Human-readable description (optional, shown in /mcp/status) */
   description?: string;
 }

package/corpus/core/src/mcp-client/index.ts

@@ -24,6 +24,8 @@ export {
 export {
   listRemoteServers,
   addRemoteServer,
+  addFirstPartyRemoteServer,
+  isFirstPartyRemoteEndpointTrusted,
   removeRemoteServer,
   validateRemoteUrl,
   normalizeServerName,

package/corpus/core/src/mcp-client/manager.ts

@@ -11,6 +11,10 @@
 import type { McpConfig, McpServerConfig } from "./config.js";
 import { formatMcpConnectError } from "./errors.js";
 import { MCP_APP_EXTENSION_ID, MCP_APP_MIME_TYPE } from "../action.js";
+import {
+  isFirstPartyRemoteEndpointTrusted,
+  parseMergedKey,
+} from "./remote-store.js";
 
 export const MCP_TOOL_PREFIX = "mcp__";
 
@@ -93,7 +97,10 @@ function sameServerConfig(a: McpServerConfig, b: McpServerConfig): boolean {
   if (typeA === "http" && b.type === "http" && a.type === "http") {
     return (
       a.url === b.url &&
-      JSON.stringify(a.headers ?? {}) === JSON.stringify(b.headers ?? {})
+      JSON.stringify(a.headers ?? {}) === JSON.stringify(b.headers ?? {}) &&
+      a.firstParty === b.firstParty &&
+      a.firstPartyAppId === b.firstPartyAppId &&
+      a.firstPartyOrgId === b.firstPartyOrgId
     );
   }
   if (a.type !== "http" && b.type !== "http") {
@@ -140,6 +147,38 @@ type SdkModules = {
   StreamableHTTPClientTransport: any | null;
 };
 
+const DEFAULT_MCP_CONNECT_TIMEOUT_MS = 5_000;
+
+function mcpConnectTimeoutMs(): number {
+  const raw =
+    typeof process !== "undefined"
+      ? process.env.AGENT_NATIVE_MCP_CLIENT_CONNECT_TIMEOUT_MS ||
+        process.env.MCP_CLIENT_CONNECT_TIMEOUT_MS
+      : undefined;
+  const parsed = raw ? Number(raw) : NaN;
+  if (Number.isFinite(parsed) && parsed >= 0) return parsed;
+  return DEFAULT_MCP_CONNECT_TIMEOUT_MS;
+}
+
+async function withConnectTimeout<T>(
+  work: Promise<T>,
+  label: string,
+  timeoutMs: number,
+): Promise<T> {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) return work;
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const timeout = new Promise<never>((_resolve, reject) => {
+    timer = setTimeout(() => {
+      reject(new Error(`${label} timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+  });
+  try {
+    return await Promise.race([work, timeout]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
 export class McpClientManager {
   private readonly servers: Map<string, ServerEntry> = new Map();
   private readonly debug: boolean;
@@ -335,12 +374,33 @@ export class McpClientManager {
         throw new Error("HTTP transport not available");
       }
       const requestInit: Record<string, unknown> = {};
-      if (cfg.headers && Object.keys(cfg.headers).length > 0) {
-        requestInit.headers = cfg.headers;
+      const staticHeaders = { ...(cfg.headers ?? {}) };
+      const transportOptions: Record<string, unknown> = { requestInit };
+      if (this.shouldInjectFirstPartyIdentity(entry)) {
+        const baselineHeaders = { ...staticHeaders };
+        removeAuthorizationHeaders(baselineHeaders);
+        if (Object.keys(baselineHeaders).length > 0) {
+          requestInit.headers = baselineHeaders;
+        }
+        if (typeof fetch === "function") {
+          const nativeFetch = fetch.bind(globalThis);
+          transportOptions.fetch = async (input: unknown, init?: unknown) =>
+            nativeFetch(
+              input as Parameters<typeof fetch>[0],
+              await buildFirstPartyRequestInit(
+                staticHeaders,
+                init,
+                this.firstPartyTrust(entry),
+              ),
+            );
+        }
+      } else if (Object.keys(staticHeaders).length > 0) {
+        requestInit.headers = staticHeaders;
       }
-      transport = new sdk.StreamableHTTPClientTransport(new URL(cfg.url), {
-        requestInit,
-      });
+      transport = new sdk.StreamableHTTPClientTransport(
+        new URL(cfg.url),
+        transportOptions,
+      );
     } else {
       if (!sdk.StdioClientTransport) {
         throw new Error(
@@ -411,8 +471,17 @@ export class McpClientManager {
     // process (stdio) or pending HTTP session — otherwise repeated failures
     // leak transports. Assign to the entry only after the handshake succeeds.
     try {
-      await client.connect(transport);
-      const listed = await client.listTools();
+      const timeoutMs = mcpConnectTimeoutMs();
+      await withConnectTimeout(
+        Promise.resolve(client.connect(transport)),
+        `MCP server ${entry.id} connect`,
+        timeoutMs,
+      );
+      const listed = await withConnectTimeout(
+        Promise.resolve(client.listTools()),
+        `MCP server ${entry.id} tools/list`,
+        timeoutMs,
+      );
       const rawTools: Array<{
         name: string;
         title?: string;
@@ -509,7 +578,9 @@ export class McpClientManager {
       } else if (!sameServerConfig(prevServers[id], nextServers[id])) {
         reconnected.push(id);
       } else {
-        unchanged.push(id);
+        const entry = this.servers.get(id);
+        if (entry?.error) reconnected.push(id);
+        else unchanged.push(id);
       }
     }
     for (const id of Object.keys(nextServers)) {
@@ -704,4 +775,192 @@ export class McpClientManager {
       errors,
     };
   }
+
+  private shouldInjectFirstPartyIdentity(entry: ServerEntry): boolean {
+    return this.firstPartyTrust(entry) !== null;
+  }
+
+  private firstPartyTrust(
+    entry: ServerEntry,
+  ): { orgId: string; appId: string; url: string } | null {
+    if (entry.config.type !== "http" || entry.config.firstParty !== true) {
+      return null;
+    }
+    const parsed = parseMergedKey(entry.id);
+    if (parsed?.scope !== "org") return null;
+    return {
+      orgId: entry.config.firstPartyOrgId ?? parsed.owner,
+      appId: entry.config.firstPartyAppId ?? parsed.name,
+      url: entry.config.url,
+    };
+  }
+}
+
+function removeAuthorizationHeaders(headers: Record<string, string>): void {
+  for (const key of Object.keys(headers)) {
+    if (key.toLowerCase() === "authorization") delete headers[key];
+  }
+}
+
+function headersToRecord(value: unknown): Record<string, string> {
+  if (!value) return {};
+  if (typeof Headers !== "undefined" && value instanceof Headers) {
+    return Object.fromEntries(value.entries());
+  }
+  if (Array.isArray(value)) {
+    return Object.fromEntries(
+      value
+        .filter((entry) => Array.isArray(entry) && entry.length >= 2)
+        .map(([key, headerValue]) => [String(key), String(headerValue)]),
+    );
+  }
+  if (typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value as Record<string, unknown>).map(
+        ([key, headerValue]) => [key, String(headerValue)],
+      ),
+    );
+  }
+  return {};
+}
+
+async function buildFirstPartyRequestInit(
+  staticHeaders: Record<string, string>,
+  rawInit: unknown,
+  trust: { orgId: string; appId: string; url: string } | null,
+): Promise<RequestInit> {
+  const init =
+    rawInit && typeof rawInit === "object" ? (rawInit as RequestInit) : {};
+  const headers = {
+    ...headersToRecord(staticHeaders),
+    ...headersToRecord(init.headers),
+  };
+  removeAuthorizationHeaders(headers);
+  const token = await mintFirstPartyMcpIdentityToken(trust).catch(() => null);
+  if (token) headers.Authorization = `Bearer ${token}`;
+  headers["x-agent-native-mcp-inline-apps"] = "1";
+  return { ...init, headers };
+}
+
+function randomJti(): string {
+  return (
+    globalThis.crypto?.randomUUID?.() ??
+    `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`
+  );
+}
+
+const FIRST_PARTY_TRUST_TTL_MS = 60_000;
+const FIRST_PARTY_TRUST_FAILURE_TTL_MS = 10_000;
+const ORG_SIGNING_CONTEXT_TTL_MS = 60_000;
+
+const firstPartyTrustCache = new Map<
+  string,
+  { ok: boolean; expiresAt: number }
+>();
+const orgSigningContextCache = new Map<
+  string,
+  { orgDomain?: string; orgSecret?: string; expiresAt: number }
+>();
+
+async function isFirstPartyTrustCached(trust: {
+  orgId: string;
+  appId: string;
+  url: string;
+}): Promise<boolean> {
+  const key = `${trust.orgId}\n${trust.appId}\n${trust.url}`;
+  const cached = firstPartyTrustCache.get(key);
+  if (cached && cached.expiresAt > Date.now()) return cached.ok;
+  const result = await isFirstPartyRemoteEndpointTrusted(
+    trust.orgId,
+    trust.appId,
+    trust.url,
+  );
+  const ok = result.ok === true;
+  firstPartyTrustCache.set(key, {
+    ok,
+    expiresAt:
+      Date.now() +
+      (ok ? FIRST_PARTY_TRUST_TTL_MS : FIRST_PARTY_TRUST_FAILURE_TTL_MS),
+  });
+  return ok;
+}
+
+async function resolveOrgSigningContext(orgId: string): Promise<{
+  orgDomain?: string;
+  orgSecret?: string;
+}> {
+  const cached = orgSigningContextCache.get(orgId);
+  if (cached && cached.expiresAt > Date.now()) {
+    return { orgDomain: cached.orgDomain, orgSecret: cached.orgSecret };
+  }
+  let orgDomain: string | undefined;
+  let orgSecret: string | undefined;
+  try {
+    const { getOrgDomain, getOrgA2ASecret } = await import("../org/context.js");
+    orgDomain = (await getOrgDomain(orgId)) ?? undefined;
+    orgSecret = (await getOrgA2ASecret(orgId)) ?? undefined;
+  } catch {
+    // Global A2A_SECRET remains the hosted/common path.
+  }
+  orgSigningContextCache.set(orgId, {
+    orgDomain,
+    orgSecret,
+    expiresAt: Date.now() + ORG_SIGNING_CONTEXT_TTL_MS,
+  });
+  return { orgDomain, orgSecret };
+}
+
+async function mintFirstPartyMcpIdentityToken(
+  trust: { orgId: string; appId: string; url: string } | null,
+): Promise<string | null> {
+  if (!trust) return null;
+  const [{ getRequestOrgId, getRequestUserEmail }, { signA2AToken }] =
+    await Promise.all([
+      import("../server/request-context.js"),
+      import("../a2a/client.js"),
+    ]);
+  const userEmail = getRequestUserEmail();
+  const requestOrgId = getRequestOrgId();
+  if (requestOrgId && requestOrgId !== trust.orgId) {
+    return null;
+  }
+  const orgId = requestOrgId ?? trust.orgId;
+  if (!orgId) return null;
+  if (!(await isFirstPartyTrustCached({ ...trust, orgId }))) return null;
+
+  const { orgDomain, orgSecret } = await resolveOrgSigningContext(orgId);
+  const subject =
+    userEmail && requestOrgId
+      ? userEmail
+      : (await import("../mcp/connect-store.js")).serviceIdentityEmail(
+          "mcp-client",
+          orgId,
+        );
+
+  return signA2AToken(subject, orgDomain, orgSecret, {
+    expiresIn: "5m",
+    audience: firstPartyMcpAudienceForUrl(trust.url),
+    preferGlobalSecret: !orgSecret,
+    extraClaims: {
+      jti: randomJti(),
+      scope: "mcp-connect",
+      org_id: orgId,
+      agent_native_first_party_mcp: true,
+    },
+  });
+}
+
+function firstPartyMcpAudienceForUrl(rawUrl: string): string | undefined {
+  try {
+    const url = new URL(rawUrl);
+    const pathname = url.pathname.replace(/\/+$/, "");
+    url.pathname = pathname.endsWith("/_agent-native/mcp")
+      ? pathname
+      : `${pathname}/_agent-native/mcp`;
+    url.search = "";
+    url.hash = "";
+    return url.toString().replace(/\/+$/, "");
+  } catch {
+    return undefined;
+  }
 }

package/corpus/core/src/mcp-client/remote-store.ts

@@ -69,6 +69,14 @@ export interface StoredRemoteMcpServer {
    * supplied (or for legacy cleartext rows).
    */
   headerSecretKey?: string;
+  /**
+   * Trusted first-party Agent-Native app. Only framework-controlled
+   * registrations should set this; management routes intentionally do not
+   * expose it for arbitrary user-added MCP servers.
+   */
+  firstParty?: boolean;
+  /** Canonical first-party app id from the org directory, e.g. `assets`. */
+  firstPartyAppId?: string;
   /** Optional description shown in the UI. */
   description?: string;
   /** ms since epoch. */
@@ -316,12 +324,66 @@ export async function addRemoteServer(
     url: string;
     headers?: Record<string, string>;
     description?: string;
+    firstParty?: boolean;
+  },
+): Promise<
+  { ok: true; server: StoredRemoteMcpServer } | { ok: false; error: string }
+> {
+  if (input.firstParty) {
+    return {
+      ok: false,
+      error:
+        "First-party MCP servers must be registered through the trusted first-party registration path",
+    };
+  }
+  return addRemoteServerInternal(scope, scopeId, input);
+}
+
+export async function addFirstPartyRemoteServer(
+  orgId: string,
+  input: {
+    appId: string;
+    name: string;
+    url: string;
+    description?: string;
+  },
+): Promise<
+  { ok: true; server: StoredRemoteMcpServer } | { ok: false; error: string }
+> {
+  const trust = await isFirstPartyRemoteEndpointTrusted(
+    orgId,
+    input.appId,
+    input.url,
+  );
+  if (!trust.ok) return { ok: false, error: trust.error };
+  return addRemoteServerInternal("org", orgId, {
+    name: input.name,
+    url: input.url,
+    description: input.description,
+    firstParty: true,
+    firstPartyAppId: input.appId.trim().toLowerCase(),
+  });
+}
+
+async function addRemoteServerInternal(
+  scope: RemoteMcpScope,
+  scopeId: string,
+  input: {
+    name: string;
+    url: string;
+    headers?: Record<string, string>;
+    description?: string;
+    firstParty?: boolean;
+    firstPartyAppId?: string;
   },
 ): Promise<
   { ok: true; server: StoredRemoteMcpServer } | { ok: false; error: string }
 > {
   const name = normalizeServerName(input.name);
   if (!name) return { ok: false, error: "Name is required" };
+  if (input.firstParty && scope !== "org") {
+    return { ok: false, error: "First-party MCP servers must be org-scoped" };
+  }
   const urlCheck = validateRemoteUrl(input.url);
   if (!urlCheck.ok) return { ok: false, error: urlCheck.error ?? "Bad URL" };
 
@@ -360,6 +422,10 @@ export async function addRemoteServer(
     url: urlCheck.url!.toString(),
     headers: cleartext,
     headerSecretKey,
+    ...(input.firstParty ? { firstParty: true } : {}),
+    ...(input.firstPartyAppId
+      ? { firstPartyAppId: input.firstPartyAppId }
+      : {}),
     description: input.description?.trim() || undefined,
     createdAt: Date.now(),
   };
@@ -367,6 +433,83 @@ export async function addRemoteServer(
   return { ok: true, server };
 }
 
+function normalizeEndpointPath(pathname: string): string {
+  return pathname.replace(/\/+$/, "") || "/";
+}
+
+function expectedFirstPartyMcpUrl(appUrl: string): URL | null {
+  try {
+    return new URL(`${appUrl.replace(/\/+$/, "")}/_agent-native/mcp`);
+  } catch {
+    return null;
+  }
+}
+
+function sameFirstPartyMcpEndpoint(endpointUrl: URL, appUrl: string): boolean {
+  const expected = expectedFirstPartyMcpUrl(appUrl);
+  if (!expected) return false;
+  return (
+    endpointUrl.origin === expected.origin &&
+    normalizeEndpointPath(endpointUrl.pathname) ===
+      normalizeEndpointPath(expected.pathname) &&
+    endpointUrl.search === expected.search
+  );
+}
+
+export async function isFirstPartyRemoteEndpointTrusted(
+  orgId: string,
+  appId: string,
+  endpoint: string,
+): Promise<{ ok: true } | { ok: false; error: string }> {
+  const normalizedAppId = appId.trim().toLowerCase();
+  if (!orgId.trim()) {
+    return { ok: false, error: "Organization id is required" };
+  }
+  if (!normalizedAppId) {
+    return { ok: false, error: "First-party app id is required" };
+  }
+
+  let endpointUrl: URL;
+  try {
+    endpointUrl = new URL(endpoint);
+  } catch {
+    return { ok: false, error: "Not a valid URL" };
+  }
+
+  try {
+    const { getRequestOrgId } = await import("../server/request-context.js");
+    const requestOrgId = getRequestOrgId();
+    if (requestOrgId && requestOrgId !== orgId) {
+      return {
+        ok: false,
+        error:
+          "First-party MCP server org does not match the active request organization",
+      };
+    }
+  } catch {
+    // No request context helper available: the org-directory lookup below will
+    // still fail closed if it cannot authenticate a first-party app list.
+  }
+
+  const { fetchOrgApps } = await import("../mcp/org-directory.js");
+  const apps = await fetchOrgApps({ serviceOrgId: orgId });
+  const app = apps.find((candidate) => candidate.id === normalizedAppId);
+  if (!app) {
+    return {
+      ok: false,
+      error: "Could not verify the first-party app in the org directory",
+    };
+  }
+  if (!sameFirstPartyMcpEndpoint(endpointUrl, app.url)) {
+    return {
+      ok: false,
+      error:
+        "First-party MCP URL does not match the org-directory app endpoint",
+    };
+  }
+  return { ok: true };
+}
+
 export async function removeRemoteServer(
   scope: RemoteMcpScope,
   scopeId: string,
@@ -463,6 +606,10 @@ export function toHttpServerConfig(
     type: "http",
     url: stored.url,
     headers: stored.headers,
+    ...(stored.firstParty ? { firstParty: true } : {}),
+    ...(stored.firstPartyAppId
+      ? { firstPartyAppId: stored.firstPartyAppId }
+      : {}),
     description: stored.description,
   };
 }
@@ -484,6 +631,13 @@ export async function toHttpServerConfigAsync(
     type: "http",
     url: stored.url,
     headers: await materializeHeaders(scope, scopeId, stored),
+    ...(stored.firstParty ? { firstParty: true } : {}),
+    ...(stored.firstPartyAppId
+      ? { firstPartyAppId: stored.firstPartyAppId }
+      : {}),
+    ...(stored.firstParty && scope === "org"
+      ? { firstPartyOrgId: scopeId }
+      : {}),
     description: stored.description,
   };
 }

package/corpus/core/src/mcp-client/routes.ts

@@ -97,6 +97,7 @@ function projectForClient(
     url: stored.url,
     headers: redactHeaders(stored.headers),
     description: stored.description,
+    firstParty: stored.firstParty === true,
     createdAt: stored.createdAt,
     mergedId: mergedConfigKey(scope, stored, ownerId),
     status,
@@ -110,6 +111,7 @@ export interface ClientServer {
   url: string;
   headers?: Record<string, { set: true }>;
   description?: string;
+  firstParty?: boolean;
   createdAt: number;
   /** The key under which this server is registered in the running MCP manager. */
   mergedId: string;

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -8043,6 +8043,14 @@ export function getGlobalMcpManager(): McpClientManager | null {
   return _globalMcpManager;
 }
 
+/** Internal: reload the process's MCP client manager after persisted settings change. */
+export async function refreshGlobalMcpManager(): Promise<boolean> {
+  const manager = getGlobalMcpManager();
+  if (!manager) return false;
+  await manager.reconfigure(await buildMergedConfig());
+  return true;
+}
+
 function mountMcpHubStatusRoute(nitroApp: any): void {
   const mountedApps: WeakSet<object> = ((
     globalThis as any

package/corpus/core/src/server/index.ts

@@ -162,6 +162,7 @@ export type { GoogleAuthMode } from "./google-auth-mode.js";
 export {
   createAgentChatPlugin,
   defaultAgentChatPlugin,
+  refreshGlobalMcpManager,
   type AgentChatPluginOptions,
 } from "./agent-chat-plugin.js";
 export {

package/corpus/core/src/shared/mcp-embed-headers.ts

@@ -1,10 +1,16 @@
 export const MCP_EMBED_CORS_ALLOW_HEADERS =
-  "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
+  "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
 export const EMBED_TRANSPLANT_HEADER = "x-agent-native-embed-transplant";
 
 const CLAUDE_MCP_CONTENT_HOST_RE = /^[a-f0-9]{32}\.claudemcpcontent\.com$/i;
 const CHATGPT_MCP_SANDBOX_HOST_RE =
   /^(?:[^.]+\.)?web-sandbox\.oaiusercontent\.com$/i;
+const AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX = ".agent-native.com";
+const MCP_PRODUCT_HOST_ORIGINS = new Set([
+  "https://chat.openai.com",
+  "https://chatgpt.com",
+  "https://claude.ai",
+]);
 
 export function isLocalMcpEmbedOrigin(
   origin: string | null | undefined,
@@ -50,6 +56,37 @@ export function isChatGptMcpSandboxOrigin(
   }
 }
 
+export function isMcpProductHostOrigin(
+  origin: string | null | undefined,
+): boolean {
+  if (!origin) return false;
+  try {
+    return MCP_PRODUCT_HOST_ORIGINS.has(new URL(origin).origin);
+  } catch {
+    return false;
+  }
+}
+
+export function isAgentNativeFirstPartyAppOrigin(
+  origin: string | null | undefined,
+): boolean {
+  if (!origin) return false;
+  try {
+    const url = new URL(origin);
+    const hostname = url.hostname.toLowerCase();
+    return (
+      url.protocol === "https:" &&
+      !url.username &&
+      !url.password &&
+      !url.port &&
+      hostname.endsWith(AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX) &&
+      hostname.length > AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX.length
+    );
+  } catch {
+    return false;
+  }
+}
+
 export function isMcpEmbedCorsOrigin(
   origin: string | null | undefined,
 ): boolean {
@@ -57,7 +94,9 @@ export function isMcpEmbedCorsOrigin(
     origin === "null" ||
     isLocalMcpEmbedOrigin(origin) ||
     isClaudeMcpContentOrigin(origin) ||
-    isChatGptMcpSandboxOrigin(origin)
+    isChatGptMcpSandboxOrigin(origin) ||
+    isMcpProductHostOrigin(origin) ||
+    isAgentNativeFirstPartyAppOrigin(origin)
   );
 }
 
@@ -67,7 +106,9 @@ export function shouldAllowMcpEmbedCredentials(
   return (
     origin !== "null" &&
     !isClaudeMcpContentOrigin(origin) &&
-    !isChatGptMcpSandboxOrigin(origin)
+    !isChatGptMcpSandboxOrigin(origin) &&
+    !isMcpProductHostOrigin(origin) &&
+    !isAgentNativeFirstPartyAppOrigin(origin)
   );
 }