mcp-app-lint 0.1.2 → 0.1.4

package/README.md

@@ -54,7 +54,7 @@ npx mcp-app-lint --dir . --format sarif --out mcp-app-lint.sarif --fail-on error
 
 | Id | Name | Level | What it means |
 | --- | --- | --- | --- |
-| MCPAPP001 | csp-missing | warning | no `ui.csp`; a compliant host applies `default-src 'none'`, `connect-src 'none'`. For a package: it serves a UI resource and no domain list is found, literal or built at runtime |
+| MCPAPP001 | csp-missing | warning | no `ui.csp`, but the UI loads from or calls an external host (an attribute such as `src`/`href`, or an absolute URL in `fetch`, `WebSocket`, `EventSource`, XHR, `sendBeacon`, `import()`); a compliant host applies `default-src 'none'`, `connect-src 'none'` and blocks it. A self-contained UI needs no CSP and is not reported. For a package: it serves a UI resource, no domain list is found (literal or built at runtime), and one of its HTML documents references a host |
 | MCPAPP002 | csp-allows-every-host | error | `*` or a scheme-only entry (`https:`) expands to every host |
 | MCPAPP003 | csp-wildcard-host | warning | `*.example.com` allows every subdomain |
 | MCPAPP004 | csp-insecure-scheme | warning | `http:` origin other than loopback |
@@ -70,8 +70,8 @@ npx mcp-app-lint --dir . --format sarif --out mcp-app-lint.sarif --fail-on error
 | MCPAPP014 | html-form-action | note | a form that posts somewhere |
 | MCPAPP015 | html-external-host | note | scripts, styles, images or media from external hosts |
 | MCPAPP016 | html-sink-host | error | a URL in the document points at a sink host |
-| MCPAPP017 | meta-list-read-mismatch | warning | `resources/read` declares a different policy than `resources/list` |
-| MCPAPP018 | meta-read-wider-than-list | error | the read-time policy adds domains or wildcards the listing did not declare |
+| MCPAPP017 | meta-list-read-mismatch | warning | `resources/read` and `resources/list` both declare a field (`csp`, `permissions`, `domain`) with different values; a listing with no CSP is not a mismatch, since the SDK puts the CSP in the read result |
+| MCPAPP018 | meta-read-wider-than-list | error | both declare a CSP and the read-time one adds an entry (domain or wildcard) the listing did not declare under the same key |
 | MCPAPP019 | csp-sink-tenant-host | note | one bucket, worker or app on a storage or serverless service from the denylist (`acct.blob.core.windows.net`, `pub-<id>.r2.dev`); fine while the owner keeps the name |
 
 Hand-written means an inline script with short lines and not too many of them; bundles carry
@@ -82,7 +82,9 @@ In a package scan, domain lists are read where they are written: as a literal ar
 constant or shorthand defined in the same file (`resourceDomains: DOMAINS`, `{ connectDomains }`).
 Each CSP finding points at that file and line. A list built at runtime counts as declared, so it
 does not raise MCPAPP001, but its entries cannot be checked. Packages that only mention the MCP
-Apps MIME type or `ui://` (hosts, renderers, SDKs) are not treated as serving a UI resource.
+Apps MIME type or `ui://` (hosts, renderers, SDKs) are not treated as serving a UI resource. Hosts are
+looked for in the package's HTML documents only: a `fetch` in server code is not bound by the CSP,
+so it does not count.
 
 The rules come out of the [MCP Apps UI census](../../census) in this repository; the analyzer is
 shared. The HTML sink detection is `eslint-plugin-render-policy`'s `no-unsafe-innerhtml`. The sink

package/dist/analyze.d.mts

@@ -36,18 +36,23 @@ export declare function analyzeUiMeta(meta: unknown): {
 };
 /**
  * Does `resources/read` declare a different policy than `resources/list`? The host that checked list is then wrong.
+ * `mismatch` is any difference, for the census. A listing may stay silent: the MCP Apps SDK puts the CSP in the read
+ * result only. So `conflict` and `readWider`, which the rules use, compare a field (csp, permissions, domain) only
+ * when both sides declare it; `readWider` is a CSP entry at read time that the listing's same key does not have.
  * @param {unknown} listMeta `_meta` of the listing entry
  * @param {unknown} readMeta `_meta` of the read result's content item
  */
 export declare function compareListRead(listMeta: unknown, readMeta: unknown): {
     comparable: boolean;
     mismatch: boolean;
-    readWider?: undefined;
+    conflict: boolean;
+    readWider: boolean;
     listOnly?: undefined;
     readOnly?: undefined;
 } | {
     comparable: boolean;
     mismatch: boolean;
+    conflict: boolean;
     readWider: boolean;
     listOnly: boolean;
     readOnly: boolean;
@@ -130,6 +135,7 @@ export declare function analyzeHtml(html: unknown): {
     formsWithAction: number;
     metaCsp: boolean;
     externalHosts: string[];
+    networkHosts: string[];
     sinkHosts: string[];
 };
 /**

package/dist/analyze.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"analyze.d.mts","sourceRoot":"","sources":["../src/analyze.mjs"],"names":[],"mappings":"AAgBG,YAA+B,MAAM,GAA3B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAQ;AAEpC,YAAoF,MAAM,GAAhF,gBAAgB,GAAG,iBAAiB,GAAG,cAAc,GAAG,gBAAgB,CAAQ;AAK9F,eAAO,MAAM,OAAO,8BAA8B,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAHlB,OAGkB,GAFhB,MAAM,GAAG,IAAI,CAWzB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAFvB,OAEuB;;;;;;;;;;;;;;;;;;;;;;EAoBjC;AAeD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,OAG6B,EAAE,QAAQ,EAFvC,OAEuC;;;;;;;;;;;;EAajD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAFvB,OAEuB;;;;;;EAkBjC;AAED,+FAA+F;AAC/F,eAAO,MAAM,gBAAgB,UAA0G,CAAC;AAyDrI,YAA+D,eAAe,GAApE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAiB;AAI9E,YAAkB,QAAQ,GAC1B;IAAmB,IAAI,EAAZ,MAAM,CACjB;IAAmB,MAAM,EAAd,MAAM,CACjB;;;;IAAoB,WAAW,EAApB,OAAO,CAClB;;;;IAAoB,OAAO,EAAhB,OAAO,CAClB;IAAmB,OAAO,EAAf,MAAM,CACnB;CAAA,CAAA;AAZD;;;GAGG;AACH;;;;;;;;GAQG;AAEH;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B,eAAe,EAAE,CAc7B;AAGD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAFrB,OAEqB;;;;qBAMA,MAAM,EAAE;;;;;;;kBAOX,KAAK,CAAC,eAAe,GAAG;QAAE,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC;;;;WAIxD,QAAQ,EAAE;;;;;;mBAMF,MAAM,EAAE;eACZ,MAAM,EAAE;EA0DjC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAFvB,MAEuB,WAKjC;AAEG,YAA0C,YAAY,GAA5C,UAAU,CAAC,OAAO,WAAW,CAAC,CAAc;AAA1D,6DAA6D;AAE7D;;;;;GAKG;AACH,wBAAgB,aAAa,CAJc,CAAC,SAA9B;IAAE,aAAa,EAAE,MAAM,EAAE,CAAA;CAAK,EAId,QAAQ,EAH3B,CAG2B,GAFzB,CAAC,GAAG;IAAE,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAIvC"}
+{"version":3,"file":"analyze.d.mts","sourceRoot":"","sources":["../src/analyze.mjs"],"names":[],"mappings":"AAgBG,YAA+B,MAAM,GAA3B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAQ;AAEpC,YAAoF,MAAM,GAAhF,gBAAgB,GAAG,iBAAiB,GAAG,cAAc,GAAG,gBAAgB,CAAQ;AAK9F,eAAO,MAAM,OAAO,8BAA8B,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAHlB,OAGkB,GAFhB,MAAM,GAAG,IAAI,CAWzB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAFvB,OAEuB;;;;;;;;;;;;;;;;;;;;;;EAoBjC;AAeD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,OAG6B,EAAE,QAAQ,EAFvC,OAEuC;;;;;;;;;;;;;;EAWjD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAFvB,OAEuB;;;;;;EAkBjC;AAED,+FAA+F;AAC/F,eAAO,MAAM,gBAAgB,UAA0G,CAAC;AAyDrI,YAA+D,eAAe,GAApE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAiB;AAI9E,YAAkB,QAAQ,GAC1B;IAAmB,IAAI,EAAZ,MAAM,CACjB;IAAmB,MAAM,EAAd,MAAM,CACjB;;;;IAAoB,WAAW,EAApB,OAAO,CAClB;;;;IAAoB,OAAO,EAAhB,OAAO,CAClB;IAAmB,OAAO,EAAf,MAAM,CACnB;CAAA,CAAA;AAZD;;;GAGG;AACH;;;;;;;;GAQG;AAEH;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B,eAAe,EAAE,CAc7B;AAqBD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAFrB,OAEqB;;;;qBAMA,MAAM,EAAE;;;;;;;kBAOX,KAAK,CAAC,eAAe,GAAG;QAAE,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC;;;;WAIxD,QAAQ,EAAE;;;;;;mBAMF,MAAM,EAAE;kBAET,MAAM,EAAE;eACX,MAAM,EAAE;EAiDjC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAFvB,MAEuB,WAKjC;AAEG,YAA0C,YAAY,GAA5C,UAAU,CAAC,OAAO,WAAW,CAAC,CAAc;AAA1D,6DAA6D;AAE7D;;;;;GAKG;AACH,wBAAgB,aAAa,CAJc,CAAC,SAA9B;IAAE,aAAa,EAAE,MAAM,EAAE,CAAA;CAAK,EAId,QAAQ,EAH3B,CAG2B,GAFzB,CAAC,GAAG;IAAE,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAIvC"}

package/dist/lint.d.mts

@@ -31,10 +31,13 @@ export type ResourceInput = {
 };
 /**
  * Findings about one `_meta` object of a UI resource (the resolved one: read, falling back to list).
+ * `hosts` are the hosts the UI references (see lintResource); without a CSP the host blocks them,
+ * and that is MCPAPP001. A UI that references none needs no CSP: the restrictive default fits it.
  * @param {unknown} meta
  * @param {string} uri
+ * @param {readonly string[]} [hosts]
  */
-export declare function lintUiMeta(meta: unknown, uri: string): Finding[];
+export declare function lintUiMeta(meta: unknown, uri: string, hosts?: readonly string[]): Finding[];
 /**
  * Findings about a UI resource as served: listing entry, read result content item, HTML.
  * @param {ResourceInput} resource

package/dist/lint.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"lint.d.mts","sourceRoot":"","sources":["../src/lint.mjs"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAe,YAAY,EAA2D,MAAM,eAAe,CAAC;AAMhH,OAAQ,KAAA,EAAE,WAAW,EAAE,MAAM,WAAW,CACxC;AAAA,OAAQ,KAAA,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAMpC,YAAkB,OAAO,GACzB;IAAmB,MAAM,EAAd,MAAM,CACjB;;;;IAAmB,KAAK,AAAxB,CACA,EADW,KAAK,CAChB;IAAmB,OAAO,EAAf,MAAM,CACjB;IAAmB,GAAG,EAAX,MAAM,CACjB;IAAyD,MAAM,AAA/D,CACA,EADW;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CACtD;IAA4C,OAAO,AAAnD,CACA,EADW;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CACzC;IAAqC,UAAU,AAA/C,CAAgD,EAArC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAc;CAAA,CAAA;AAE/C,YAAuD,YAAY,GAAzD,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC,CAAc;AAIpE,YAAkB,aAAa,GAC/B;IAAmB,GAAG,EAAX,MAAM,CACjB;IAAqB,QAAQ,AAA7B,CACA,EADW,OAAO,CAClB;IAAqB,QAAQ,AAA7B,CACA,EADW,OAAO,CAClB;IAA2B,IAAI,AAA/B,CAAgC,EAArB,MAAM,GAAG,IAAI,CAAQ;CAAA,CAAA;AAsCnC;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAHpB,OAGoB,EAAE,GAAG,EAFzB,MAEyB,aAgBnC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,EAAE,GAAG,EAAE,QAAe,EAAE,QAAe,EAAE,IAAW,EAAE,EAFxE,aAEwE,aAYlF;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAHlB,MAGkB,EAAE,GAAG,EAFvB,MAEuB,aAEjC;AAiCD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAHpB,OAGoB,EAAE,GAAG,AAFjC,CAAqB,EAAb,MAEwC,aAelD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAHzB,WAGyB,EAAE,IAAI,AAFvC,CAAsB,EAAd,MAEqC,aAqB/C;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAHnB,MAGmB,GAFjB,KAAK,CAIjB;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"lint.d.mts","sourceRoot":"","sources":["../src/lint.mjs"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAe,YAAY,EAA2D,MAAM,eAAe,CAAC;AAMhH,OAAQ,KAAA,EAAE,WAAW,EAAE,MAAM,WAAW,CACxC;AAAA,OAAQ,KAAA,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAMpC,YAAkB,OAAO,GACzB;IAAmB,MAAM,EAAd,MAAM,CACjB;;;;IAAmB,KAAK,AAAxB,CACA,EADW,KAAK,CAChB;IAAmB,OAAO,EAAf,MAAM,CACjB;IAAmB,GAAG,EAAX,MAAM,CACjB;IAAyD,MAAM,AAA/D,CACA,EADW;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CACtD;IAA4C,OAAO,AAAnD,CACA,EADW;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CACzC;IAAqC,UAAU,AAA/C,CAAgD,EAArC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAc;CAAA,CAAA;AAE/C,YAAuD,YAAY,GAAzD,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC,CAAc;AAIpE,YAAkB,aAAa,GAC/B;IAAmB,GAAG,EAAX,MAAM,CACjB;IAAqB,QAAQ,AAA7B,CACA,EADW,OAAO,CAClB;IAAqB,QAAQ,AAA7B,CACA,EADW,OAAO,CAClB;IAA2B,IAAI,AAA/B,CAAgC,EAArB,MAAM,GAAG,IAAI,CAAQ;CAAA,CAAA;AAgDnC;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAJpB,OAIoB,EAAE,GAAG,EAHzB,MAGyB,EAAE,KAAK,AAFxC,CAAkC,EAA1B,SAAS,MAAM,EAEsB,aAgB/C;AASD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,EAAE,GAAG,EAAE,QAAe,EAAE,QAAe,EAAE,IAAW,EAAE,EAFxE,aAEwE,aAalF;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAHlB,MAGkB,EAAE,GAAG,EAFvB,MAEuB,aAEjC;AAiCD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAHpB,OAGoB,EAAE,GAAG,AAFjC,CAAqB,EAAb,MAEwC,aAelD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAHzB,WAGyB,EAAE,IAAI,AAFvC,CAAsB,EAAd,MAEqC,aAsB/C;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAHnB,MAGmB,GAFjB,KAAK,CAIjB;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-app-lint",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "SARIF findings about what an MCP App declares (CSP domain lists, permissions, tool visibility) and what its HTML does (innerHTML sinks, postMessage to '*', external hosts, data sinks).",
   "license": "MIT",
   "type": "module",
@@ -29,7 +29,7 @@
     "node": ">=22.12"
   },
   "dependencies": {
-    "@render-policy/core": "^0.1.1",
+    "@render-policy/core": "^0.1.4",
     "eslint": "^10.11.0",
     "eslint-plugin-render-policy": "^0.1.2"
   },

package/src/analyze.mjs

@@ -80,22 +80,23 @@ function canonical(value) {
 
 /**
  * Does `resources/read` declare a different policy than `resources/list`? The host that checked list is then wrong.
+ * `mismatch` is any difference, for the census. A listing may stay silent: the MCP Apps SDK puts the CSP in the read
+ * result only. So `conflict` and `readWider`, which the rules use, compare a field (csp, permissions, domain) only
+ * when both sides declare it; `readWider` is a CSP entry at read time that the listing's same key does not have.
  * @param {unknown} listMeta `_meta` of the listing entry
  * @param {unknown} readMeta `_meta` of the read result's content item
  */
 export function compareListRead(listMeta, readMeta) {
   const a = uiMetaOf(listMeta);
   const b = uiMetaOf(readMeta);
-  if (!a && !b) return { comparable: false, mismatch: false };
+  if (!a && !b) return { comparable: false, mismatch: false, conflict: false, readWider: false };
+  const FIELDS = /** @type {const} */ (['csp', 'permissions', 'domain']);
   /** @param {UiMeta | null} m */
-  const pick = (m) => (m ? { csp: m.csp ?? null, permissions: m.permissions ?? null, domain: m.domain ?? null } : null);
-  const left = JSON.stringify(canonical(pick(a)));
-  const right = JSON.stringify(canonical(pick(b)));
-  const readWider = (() => {
-    if (!a?.csp || !b?.csp) return false;
-    return CSP_KEYS.some((k) => (b.csp[k]?.length ?? 0) > (a.csp[k]?.length ?? 0) || (b.csp[k] ?? []).some((/** @type {unknown} */ d) => String(d).includes('*') && !(a.csp[k] ?? []).includes(d)));
-  })();
-  return { comparable: true, mismatch: left !== right, readWider, listOnly: !!a && !b, readOnly: !a && !!b };
+  const pick = (m) => (m ? Object.fromEntries(FIELDS.map((f) => [f, m[f] ?? null])) : null);
+  const same = (/** @type {unknown} */ x, /** @type {unknown} */ y) => JSON.stringify(canonical(x)) === JSON.stringify(canonical(y));
+  const conflict = FIELDS.some((f) => a?.[f] != null && b?.[f] != null && !same(a[f], b[f]));
+  const readWider = !!(a?.csp && b?.csp) && CSP_KEYS.some((k) => (b.csp[k] ?? []).some((/** @type {unknown} */ d) => !(a.csp[k] ?? []).includes(d)));
+  return { comparable: true, mismatch: !same(pick(a), pick(b)), conflict, readWider, listOnly: !!a && !b, readOnly: !a && !!b };
 }
 
 /**
@@ -211,6 +212,24 @@ export function postMessageStarCalls(code) {
   return calls;
 }
 const URL_ATTR_RE = /\b(?:src|href|action|poster|data)\s*=\s*["']([^"']+)["']/gi;
+// A network call with an absolute URL literal: fetch, sendBeacon, import(), WebSocket, EventSource, XHR open.
+const NETWORK_CALL_RE = /(?:\b(?:fetch|sendBeacon|import)\s*\(|\bnew\s+(?:WebSocket|EventSource)\s*\(|\.open\s*\(\s*["'`][A-Za-z]+["'`]\s*,)\s*["'`]((?:https?|wss?):\/\/[^"'`\s]+)/g;
+
+/**
+ * Hostnames of URLs, skipping the ones that do not parse.
+ * @param {Iterable<string>} urls
+ */
+function hostnames(urls) {
+  const hosts = new Set();
+  for (const url of urls) {
+    try {
+      hosts.add(new URL(url.startsWith('//') ? `https:${url}` : url).hostname.toLowerCase());
+    } catch {
+      /* ignore */
+    }
+  }
+  return [...hosts].sort();
+}
 
 /**
  * Static signals in a UI resource's HTML. Heuristic by design; the report says so.
@@ -240,19 +259,12 @@ export function analyzeHtml(html) {
     formsWithAction: (text.match(/<form\b[^>]*\baction\s*=/gi) ?? []).length,
     metaCsp: /<meta\b[^>]*http-equiv\s*=\s*["']content-security-policy["']/i.test(text),
     externalHosts: /** @type {string[]} */ ([]),
+    // Hosts that script calls with an absolute URL (fetch, WebSocket, …), bundles included.
+    networkHosts: /** @type {string[]} */ ([]),
     sinkHosts: /** @type {string[]} */ ([]),
   };
-  const hosts = new Set();
-  for (const match of text.matchAll(URL_ATTR_RE)) {
-    const value = match[1] ?? '';
-    if (!/^(https?:)?\/\//i.test(value)) continue;
-    try {
-      hosts.add(new URL(value.startsWith('//') ? `https:${value}` : value).hostname.toLowerCase());
-    } catch {
-      /* ignore */
-    }
-  }
-  result.externalHosts = [...hosts].sort();
+  result.externalHosts = hostnames([...text.matchAll(URL_ATTR_RE)].map((m) => m[1] ?? '').filter((v) => /^(https?:)?\/\//i.test(v)));
+  result.networkHosts = hostnames([...text.matchAll(NETWORK_CALL_RE)].map((m) => m[1] ?? ''));
   for (const match of text.matchAll(SCRIPT_RE)) {
     const attrs = match[1] ?? '';
     const body = match[2] ?? '';

package/src/lint.mjs

@@ -69,18 +69,31 @@ function cspEntryFindings(key, raw, uri, extra) {
   return findings;
 }
 
+/**
+ * The hosts a UI document loads from or calls, sorted and without duplicates.
+ * @param {Iterable<{ externalHosts?: string[], networkHosts?: string[] }>} docs
+ */
+function referencedHosts(docs) {
+  const hosts = new Set();
+  for (const doc of docs) for (const host of [...(doc.externalHosts ?? []), ...(doc.networkHosts ?? [])]) hosts.add(host);
+  return [...hosts].sort();
+}
+
 /**
  * Findings about one `_meta` object of a UI resource (the resolved one: read, falling back to list).
+ * `hosts` are the hosts the UI references (see lintResource); without a CSP the host blocks them,
+ * and that is MCPAPP001. A UI that references none needs no CSP: the restrictive default fits it.
  * @param {unknown} meta
  * @param {string} uri
+ * @param {readonly string[]} [hosts]
  */
-export function lintUiMeta(meta, uri) {
+export function lintUiMeta(meta, uri, hosts = []) {
   /** @type {Finding[]} */
   const findings = [];
   const ui = uiMetaOf(meta);
   const analysis = analyzeUiMeta(meta);
   if (!analysis.cspDeclared) {
-    findings.push(finding('MCPAPP001', 'No ui.csp declared; a compliant host applies default-src \'none\'.', uri));
+    if (hosts.length > 0) findings.push(cspMissing(hosts, uri));
   } else {
     for (const key of CSP_KEYS) {
       for (const raw of ui?.csp?.[key] ?? []) findings.push(...cspEntryFindings(key, raw, uri, { logical: { name: `csp.${key}`, kind: 'member' } }));
@@ -92,6 +105,13 @@ export function lintUiMeta(meta, uri) {
   return findings;
 }
 
+/**
+ * @param {readonly string[]} hosts
+ * @param {string} uri
+ */
+const cspMissing = (hosts, uri) =>
+  finding('MCPAPP001', `No ui.csp declared, but the UI references ${hosts.join(', ')}; a compliant host applies default-src 'none' and blocks them.`, uri, { properties: { hosts: [...hosts] } });
+
 /**
  * Findings about a UI resource as served: listing entry, read result content item, HTML.
  * @param {ResourceInput} resource
@@ -100,13 +120,14 @@ export function lintResource({ uri, listMeta = null, readMeta = null, html = nul
   /** @type {Finding[]} */
   const findings = [];
   const effective = readMeta ?? listMeta;
-  findings.push(...lintUiMeta(effective, uri));
+  const analysis = typeof html === 'string' ? withSinkHosts(analyzeHtml(html)) : null;
+  findings.push(...lintUiMeta(effective, uri, analysis ? referencedHosts([analysis]) : []));
   if (listMeta && readMeta) {
     const compared = compareListRead(listMeta, readMeta);
     if (compared.readWider) findings.push(finding('MCPAPP018', 'resources/read declares a wider policy than resources/list.', uri));
-    else if (compared.mismatch) findings.push(finding('MCPAPP017', 'resources/read and resources/list declare different policies.', uri));
+    else if (compared.conflict) findings.push(finding('MCPAPP017', 'resources/read and resources/list declare different policies.', uri));
   }
-  if (typeof html === 'string') findings.push(...lintHtml(html, uri));
+  if (analysis) findings.push(...htmlFindings(analysis, uri));
   return findings;
 }
 
@@ -187,11 +208,12 @@ export function lintPackageScan(scan, root = '.') {
     if (!scan.cspDeclared) delete fake.ui.csp;
     if (Array.isArray(scan.domainSites)) {
       // Each entry where it is written, so code scanning can point at the line.
-      if (!scan.cspDeclared && servesUi) findings.push(...lintUiMeta({ ui: {} }, root));
+      const hosts = referencedHosts(scan.html ?? []);
+      if (!scan.cspDeclared && servesUi && hosts.length > 0) findings.push(cspMissing(hosts, root));
       for (const site of scan.domainSites) findings.push(...cspEntryFindings(site.key, site.raw, `${root}/${site.file}`.replace(/^\.\//, ''), { region: { startLine: site.line } }));
       findings.push(...lintUiMeta({ ui: { csp: {}, permissions: fake.ui.permissions } }, root).filter((f) => f.ruleId === 'MCPAPP007'));
     } else {
-      findings.push(...lintUiMeta(fake, root));
+      findings.push(...lintUiMeta(fake, root, servesUi ? referencedHosts(scan.html ?? []) : []));
     }
   }
   for (const doc of scan.html ?? []) {

package/src/rules.mjs

@@ -9,7 +9,7 @@
  * @type {readonly Rule[]}
  */
 export const RULES = [
-  { id: 'MCPAPP001', name: 'csp-missing', level: 'warning', short: 'UI resource declares no CSP domain list', full: "A compliant host applies default-src 'none' and connect-src 'none' to a resource without ui.csp. Declare the domains the app uses, or confirm it needs none. For a package, reported when it serves a UI resource (registers one, or sets the MCP Apps MIME type or a ui:// URI on a resource) and no domain list is found, literal or built at runtime." },
+  { id: 'MCPAPP001', name: 'csp-missing', level: 'warning', short: 'UI references external hosts but declares no CSP domain list', full: "A compliant host applies default-src 'none' and connect-src 'none' to a resource without ui.csp, so the hosts the UI loads from or calls are blocked. Reported when the HTML references an external host (src, href and similar attributes) or calls one with an absolute URL (fetch, WebSocket, EventSource, XMLHttpRequest, sendBeacon, import()); a UI that references none needs no CSP. For a package, reported when it serves a UI resource (registers one, or sets the MCP Apps MIME type or a ui:// URI on a resource), no domain list is found, literal or built at runtime, and one of its HTML documents references a host." },
   { id: 'MCPAPP002', name: 'csp-allows-every-host', level: 'error', short: 'CSP entry allows every host', full: "A bare '*' or a scheme-only entry such as 'https:' is expanded by hosts into a CSP source that allows every host, including request catchers and tunnels. Name the hosts." },
   { id: 'MCPAPP003', name: 'csp-wildcard-host', level: 'warning', short: 'CSP entry allows every subdomain', full: 'A *.example.com entry allows every subdomain, including user-controlled ones on multi-tenant services. Prefer exact hosts.' },
   { id: 'MCPAPP004', name: 'csp-insecure-scheme', level: 'warning', short: 'CSP entry uses http:', full: 'An http: origin can be read and modified in transit. Use https:. Loopback origins are reported as development origins (MCPAPP006) instead.' },
@@ -25,8 +25,8 @@ export const RULES = [
   { id: 'MCPAPP014', name: 'html-form-action', level: 'note', short: 'Form posts to a URL', full: "The specification's CSP has no form-action directive; a form is a way out of the sandbox for data. Check the destination." },
   { id: 'MCPAPP015', name: 'html-external-host', level: 'note', short: 'Document references external hosts', full: 'Scripts, styles, images or media are loaded from hosts outside the document. They must be declared in resourceDomains or the host blocks them.' },
   { id: 'MCPAPP016', name: 'html-sink-host', level: 'error', short: 'Document references a data sink', full: 'A URL in the document points at a service on the sink denylist.' },
-  { id: 'MCPAPP017', name: 'meta-list-read-mismatch', level: 'warning', short: 'resources/read declares a different policy than resources/list', full: 'Hosts must prefer the read-time policy. A wider policy at read time means the policy reviewed at connection time is not the one enforced.' },
-  { id: 'MCPAPP018', name: 'meta-read-wider-than-list', level: 'error', short: 'resources/read widens the policy seen at resources/list', full: 'The read-time policy adds domains or wildcards the listing did not declare. This is the pattern a host that reviews at connection time cannot see.' },
+  { id: 'MCPAPP017', name: 'meta-list-read-mismatch', level: 'warning', short: 'resources/read declares a different policy than resources/list', full: 'Hosts must prefer the read-time policy. Reported when both sides declare the same field (csp, permissions or domain) with different values and the read-time CSP adds nothing (that is MCPAPP018). A listing that declares no CSP is not a mismatch: the MCP Apps SDK puts the CSP in the read result only.' },
+  { id: 'MCPAPP018', name: 'meta-read-wider-than-list', level: 'error', short: 'resources/read widens the policy seen at resources/list', full: 'Both sides declare a CSP and the read-time one has an entry the listing does not have under the same key (a new domain, a replaced one, or a wildcard). This is the pattern a host that reviews at connection time cannot see.' },
   { id: 'MCPAPP019', name: 'csp-sink-tenant-host', level: 'note', short: 'CSP entry names one account on a multi-tenant service', full: 'The host is a single bucket, worker or app on a storage or serverless service from the sink denylist (acct.blob.core.windows.net, pub-<id>.r2.dev). It reaches only that account, which is fine while the owner keeps it; a deleted bucket or app name can be registered by someone else.' },
 ];
 

package/src/sarif.mjs

@@ -68,6 +68,6 @@ export function toSarif(findings, { invocation = {} } = {}) {
 export function toText(findings) {
   if (findings.length === 0) return 'no findings\n';
   return `${findings
-    .map((f) => `${(f.level ?? levelOf(f.ruleId)).padEnd(7)} ${f.ruleId} ${f.uri}${f.region ? `:${f.region.startLine}:${f.region.startColumn}` : ''}  ${f.message}`)
+    .map((f) => `${(f.level ?? levelOf(f.ruleId)).padEnd(7)} ${f.ruleId} ${f.uri}${f.region ? `:${f.region.startLine}${f.region.startColumn ? `:${f.region.startColumn}` : ''}` : ''}  ${f.message}`)
     .join('\n')}\n`;
 }