@n8n/mcp-apps 0.6.1 → 0.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/README.md +7 -5
  2. package/dist/apps/workflow-preview.html +68 -68
  3. package/dist/build.tsbuildinfo +1 -1
  4. package/dist/server/constants.d.ts +1 -1
  5. package/dist/server/constants.js +1 -6
  6. package/dist/server/constants.js.map +1 -1
  7. package/dist/server/register-mcp-app-tool.js +2 -2
  8. package/dist/server/register-mcp-app-tool.js.map +1 -1
  9. package/package.json +5 -5
package/README.md CHANGED
@@ -85,11 +85,13 @@ URL handling is locked down by `isAllowedWorkflowUrl` in
85
85
  host are accepted, both when reading the tool result and right before calling
86
86
  `openLink`. This is defense in depth on top of the host's own validation.
87
87
 
88
- The workflow preview iframe uses a server-provided `previewUrl` when available.
89
- Otherwise it uses the existing n8n preview service because instance routes are
90
- commonly blocked or unreachable from MCP hosts. The resource metadata declares
91
- broad `frameDomains` for `http` and `https` so hosts that enforce MCP Apps CSP
92
- can load instance-specific or configured preview URLs. The framed n8n server's
88
+ The workflow preview iframe loads the shared n8n preview service
89
+ (`WORKFLOW_PREVIEW_ORIGIN`). The preview is instance-agnostic: the workflow
90
+ graph is pushed into the iframe via `postMessage` rather than fetched from the
91
+ instance, so a single origin renders both cloud and self-hosted workflows. The
92
+ resource metadata therefore declares exactly one `frameDomains` entry — the
93
+ preview-service origin. Keep this list narrow: MCP hosts (e.g. the ChatGPT
94
+ connector review) reject broad or wildcard frame domains. The framed server's
93
95
  own frame policy still applies, so the app falls back to the open-workflow
94
96
  button when the preview cannot load.
95
97