feat: support proxy for rawHtml by idosal · Pull Request #132 · MCP-UI-Org/mcp-ui

idosal · 2025-10-22T00:18:41Z

When the proxy prop is passed to the <UIResourceRenderer>, rawHtml resources will be rendered inside a nested iframe. This opens the path to define a custom CSP for resources that is detached from the host's CSP.

Copilot

Pull Request Overview

This PR adds support for proxying raw HTML content (text/html MIME type) through a proxy server, extending the existing proxy functionality that previously only supported external URLs (text/uri-list). The implementation uses a double-iframe architecture where the HTML content is delivered to the proxy via postMessage after the proxy signals readiness, enabling raw HTML to work with restrictive Content Security Policies.

Key changes:

Extended proxy flow to support raw HTML delivery via postMessage with contentType=rawhtml parameter
Added new internal message types for proxy lifecycle communication (UI_PROXY_IFRAME_READY, UI_HTML_CONTENT)
Updated proxy script to handle both external URLs and raw HTML content with proper sandbox configuration

Reviewed Changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
sdks/typescript/server/src/index.ts	Added new internal message type constant for raw HTML content transport
sdks/typescript/client/src/utils/processResource.ts	Modified HTML processing logic to support proxy with postMessage-based content delivery
sdks/typescript/client/src/utils/tests/processResource.test.ts	Added comprehensive test coverage for proxy-based raw HTML rendering scenarios
sdks/typescript/client/src/components/tests/UIResourceRenderer.unmocked.test.tsx	Added integration test verifying proxy readiness signal and content delivery flow
sdks/typescript/client/src/components/tests/ProxyScript.test.ts	Added new test file validating proxy script behavior with raw HTML content
sdks/typescript/client/src/components/UIResourceRenderer.tsx	Simplified rawHtml case to pass proxy prop through to HTMLResourceRenderer
sdks/typescript/client/src/components/HTMLResourceRenderer.tsx	Implemented proxy readiness handling and HTML content delivery via postMessage
sdks/typescript/client/scripts/proxy/index.html	Extended proxy script to handle raw HTML mode with double-iframe architecture and permissive CSP
sdks/typescript/client/package.json	Added @types/jsdom dev dependency for proxy script testing
docs/src/guide/client/using-a-proxy.md	Updated documentation with raw HTML proxy architecture, flow diagrams, and implementation requirements

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

sdks/typescript/client/src/utils/__tests__/processResource.test.ts

sdks/typescript/client/src/components/__tests__/ProxyScript.test.ts

sdks/typescript/client/scripts/proxy/index.html

cloudflare-workers-and-pages · 2025-10-22T00:29:18Z

Deploying mcp-ui with Cloudflare Pages

Latest commit:	`0acab70`
Status:	✅ Deploy successful!
Preview URL:	https://31051951.mcp-ui.pages.dev
Branch Preview URL:	https://feat-rawhtml-proxy.mcp-ui.pages.dev

View logs

Copilot

Pull Request Overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

sdks/typescript/client/src/components/HTMLResourceRenderer.tsx

sdks/typescript/client/scripts/proxy/index.html

Copilot

Pull Request Overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

sdks/typescript/client/src/components/HTMLResourceRenderer.tsx

docs/src/guide/client/using-a-proxy.md

Co-authored-by: Copilot <[email protected]>

…t/v5.14.0) (2025-10-22) ### Features * support proxy for rawHtml ([#132](#132)) ([1bbeb09](1bbeb09))

…r/v5.13.0) (2025-10-22) ### Bug Fixes * fix file extension reference in package.json ([927989c](927989c)) ### Features * support proxy for rawHtml ([#132](#132)) ([1bbeb09](1bbeb09))

infoxicator

@idosal Are you thinking about adding support for proxy to the remoteDom iframe as well?

# 1.0.0 (2025-11-04) ### Bug Fixes * add a bridge to pass messages in and out of the proxy ([#38](#38)) ([30ccac0](30ccac0)) * bump client version ([75c9236](75c9236)) * **client:** specify iframe ([fd0b70a](fd0b70a)) * **client:** styling ([6ff9b68](6ff9b68)) * dependencies ([887f61f](887f61f)) * Enable bidirectional message relay in rawhtml proxy mode ([#138](#138)) ([f0bdefb](f0bdefb)) * ensure Apps SDK adapter is bundled properly and initialized wth config ([#137](#137)) ([4f7c25c](4f7c25c)) * export RemoteDomResource ([2b86f2d](2b86f2d)) * export ResourceRenderer and HtmlResource ([2b841a5](2b841a5)) * exports ([3a93a16](3a93a16)) * fix file extension reference in package.json ([927989c](927989c)) * iframe handle ([#15](#15)) ([66bd4fd](66bd4fd)) * lint ([4487820](4487820)) * lint ([d0a91f9](d0a91f9)) * minor typo ([a0bee9c](a0bee9c)) * move react dependencies to be peer dependencies ([#91](#91)) ([f672f3e](f672f3e)), closes [#90](#90) * package config ([8dc1e53](8dc1e53)) * packaging ([9e6babd](9e6babd)) * pass ref explicitly using iframeProps ([#33](#33)) ([d01b5d1](d01b5d1)) * publish ([0943e7a](0943e7a)) * ref passing to UIResourceRenderer ([#32](#32)) ([d28c23f](d28c23f)) * remove shared dependency ([e66e8f4](e66e8f4)) * rename components and methods to fit new scope ([#22](#22)) ([6bab1fe](6bab1fe)) * rename delivery -> encoding and flavor -> framework ([#36](#36)) ([9a509ed](9a509ed)) * Ruby comment ([b22dc2e](b22dc2e)) * support react-router ([21ffb95](21ffb95)) * text and blob support in RemoteDOM resources ([ec68eb9](ec68eb9)) * trigger release ([aaca831](aaca831)) * typescript ci publish ([e7c0ebf](e7c0ebf)) * typescript types to be compatible with MCP SDK ([#10](#10)) ([74365d7](74365d7)) * update deps ([4091ef4](4091ef4)) * update isUIResource to use EmbeddedResource type ([#122](#122)) ([5a65a0b](5a65a0b)), closes [#117](#117) * use targetOrigin in the proxy message relay ([#40](#40)) ([b3fb54e](b3fb54e)) * validate URL ([b7c994d](b7c994d)) * wc dist overwrite ([#63](#63)) ([9e46c56](9e46c56)) ### Documentation * bump ([#4](#4)) ([ad4d163](ad4d163)) ### Features * add convenience function isUIResource to client SDK ([#86](#86)) ([607c6ad](607c6ad)) * add embeddedResourceProps for annotations ([#99](#99)) ([b96ec44](b96ec44)) * add proxy option to externalUrl ([#37](#37)) ([7b95cd0](7b95cd0)) * add remote-dom content type ([#18](#18)) ([5dacf37](5dacf37)) * add Ruby server SDK ([#31](#31)) ([5ffcde4](5ffcde4)) * add sandbox permissions instead of an override ([#83](#83)) ([b1068e9](b1068e9)) * add ui-request-render-data message type ([#111](#111)) ([26135ce](26135ce)) * add UIResourceRenderer Web Component ([#58](#58)) ([ec8f299](ec8f299)) * auto resize with the autoResizeIframe prop ([#56](#56)) ([76c867a](76c867a)) * change onGenericMcpAction to optional onUiAction ([1913b59](1913b59)) * **client:** allow setting supportedContentTypes for HtmlResource ([#17](#17)) ([e009ef1](e009ef1)) * consolidate ui:// and ui-app:// ([#8](#8)) ([2e08035](2e08035)) * pass iframe props down ([#14](#14)) ([112539d](112539d)) * refactor UTFtoB64 (bump server version) ([#95](#95)) ([2d5e16b](2d5e16b)) * send render data to the iframe ([#51](#51)) ([d38cfc7](d38cfc7)) * separate html and remote-dom props ([#24](#24)) ([a7f0529](a7f0529)) * support adapters ([#127](#127)) ([d4bd152](d4bd152)) * support generic messages response ([#35](#35)) ([10b407b](10b407b)) * support metadata in Python SDK ([#134](#134)) ([9bc3c64](9bc3c64)) * support passing resource metadata ([#87](#87)) ([f1c1c9b](f1c1c9b)) * support proxy for rawHtml ([#132](#132)) ([1bbeb09](1bbeb09)) * support ui action result types ([#6](#6)) ([899d152](899d152)) * switch to ResourceRenderer ([#21](#21)) ([6fe3166](6fe3166)) ### BREAKING CHANGES * The existing naming is ambiguous. Renaming delivery to encoding and flavor to framework should clarify the intent. * exported names have changed * removed deprecated client API * (previous one didn't take due to semantic-release misalignment)

…nt/v5.13.1...client/v5.14.0) (2025-10-22) ### Features * support proxy for rawHtml ([#132](MCP-UI-Org/mcp-ui#132)) ([dca6fa4](MCP-UI-Org/mcp-ui@dca6fa4))

…er/v5.12.0...server/v5.13.0) (2025-10-22) ### Bug Fixes * fix file extension reference in package.json ([121c7f6](MCP-UI-Org/mcp-ui@121c7f6)) ### Features * support proxy for rawHtml ([#132](MCP-UI-Org/mcp-ui#132)) ([dca6fa4](MCP-UI-Org/mcp-ui@dca6fa4))

# 1.0.0 (2025-11-04) ### Bug Fixes * add a bridge to pass messages in and out of the proxy ([#38](MCP-UI-Org/mcp-ui#38)) ([3938917](MCP-UI-Org/mcp-ui@3938917)) * bump client version ([a9c9638](MCP-UI-Org/mcp-ui@a9c9638)) * **client:** specify iframe ([216034f](MCP-UI-Org/mcp-ui@216034f)) * **client:** styling ([b5e07fd](MCP-UI-Org/mcp-ui@b5e07fd)) * dependencies ([65fb8df](MCP-UI-Org/mcp-ui@65fb8df)) * Enable bidirectional message relay in rawhtml proxy mode ([#138](MCP-UI-Org/mcp-ui#138)) ([a728581](MCP-UI-Org/mcp-ui@a728581)) * ensure Apps SDK adapter is bundled properly and initialized wth config ([#137](MCP-UI-Org/mcp-ui#137)) ([eabd84b](MCP-UI-Org/mcp-ui@eabd84b)) * export RemoteDomResource ([79278b6](MCP-UI-Org/mcp-ui@79278b6)) * export ResourceRenderer and HtmlResource ([db19b70](MCP-UI-Org/mcp-ui@db19b70)) * exports ([b802886](MCP-UI-Org/mcp-ui@b802886)) * fix file extension reference in package.json ([121c7f6](MCP-UI-Org/mcp-ui@121c7f6)) * iframe handle ([#15](MCP-UI-Org/mcp-ui#15)) ([daabb36](MCP-UI-Org/mcp-ui@daabb36)) * lint ([ec7df69](MCP-UI-Org/mcp-ui@ec7df69)) * lint ([8d7fd19](MCP-UI-Org/mcp-ui@8d7fd19)) * minor typo ([7e0213b](MCP-UI-Org/mcp-ui@7e0213b)) * move react dependencies to be peer dependencies ([#91](MCP-UI-Org/mcp-ui#91)) ([596630a](MCP-UI-Org/mcp-ui@596630a)), closes [#90](MCP-UI-Org/mcp-ui#90) * package config ([a798ca7](MCP-UI-Org/mcp-ui@a798ca7)) * packaging ([31b4e10](MCP-UI-Org/mcp-ui@31b4e10)) * pass ref explicitly using iframeProps ([#33](MCP-UI-Org/mcp-ui#33)) ([5889829](MCP-UI-Org/mcp-ui@5889829)) * publish ([a77cd3e](MCP-UI-Org/mcp-ui@a77cd3e)) * ref passing to UIResourceRenderer ([#32](MCP-UI-Org/mcp-ui#32)) ([02305a6](MCP-UI-Org/mcp-ui@02305a6)) * remove shared dependency ([a167581](MCP-UI-Org/mcp-ui@a167581)) * rename components and methods to fit new scope ([#22](MCP-UI-Org/mcp-ui#22)) ([0179f4d](MCP-UI-Org/mcp-ui@0179f4d)) * rename delivery -> encoding and flavor -> framework ([#36](MCP-UI-Org/mcp-ui#36)) ([d523bcf](MCP-UI-Org/mcp-ui@d523bcf)) * Ruby comment ([786071a](MCP-UI-Org/mcp-ui@786071a)) * support react-router ([be4a6a5](MCP-UI-Org/mcp-ui@be4a6a5)) * text and blob support in RemoteDOM resources ([fb89026](MCP-UI-Org/mcp-ui@fb89026)) * trigger release ([fc78758](MCP-UI-Org/mcp-ui@fc78758)) * typescript ci publish ([a613dd2](MCP-UI-Org/mcp-ui@a613dd2)) * typescript types to be compatible with MCP SDK ([#10](MCP-UI-Org/mcp-ui#10)) ([67be52c](MCP-UI-Org/mcp-ui@67be52c)) * update deps ([3a1610e](MCP-UI-Org/mcp-ui@3a1610e)) * update isUIResource to use EmbeddedResource type ([#122](MCP-UI-Org/mcp-ui#122)) ([4a3781d](MCP-UI-Org/mcp-ui@4a3781d)), closes [#117](MCP-UI-Org/mcp-ui#117) * use targetOrigin in the proxy message relay ([#40](MCP-UI-Org/mcp-ui#40)) ([8f5047b](MCP-UI-Org/mcp-ui@8f5047b)) * validate URL ([d2fd894](MCP-UI-Org/mcp-ui@d2fd894)) * wc dist overwrite ([#63](MCP-UI-Org/mcp-ui#63)) ([34b4e81](MCP-UI-Org/mcp-ui@34b4e81)) ### Documentation * bump ([#4](MCP-UI-Org/mcp-ui#4)) ([6ecd050](MCP-UI-Org/mcp-ui@6ecd050)) ### Features * add convenience function isUIResource to client SDK ([#86](MCP-UI-Org/mcp-ui#86)) ([abe684e](MCP-UI-Org/mcp-ui@abe684e)) * add embeddedResourceProps for annotations ([#99](MCP-UI-Org/mcp-ui#99)) ([c2011f0](MCP-UI-Org/mcp-ui@c2011f0)) * add proxy option to externalUrl ([#37](MCP-UI-Org/mcp-ui#37)) ([d2d5ea8](MCP-UI-Org/mcp-ui@d2d5ea8)) * add remote-dom content type ([#18](MCP-UI-Org/mcp-ui#18)) ([26bfc36](MCP-UI-Org/mcp-ui@26bfc36)) * add Ruby server SDK ([#31](MCP-UI-Org/mcp-ui#31)) ([a2c9f3d](MCP-UI-Org/mcp-ui@a2c9f3d)) * add sandbox permissions instead of an override ([#83](MCP-UI-Org/mcp-ui#83)) ([a04586a](MCP-UI-Org/mcp-ui@a04586a)) * add ui-request-render-data message type ([#111](MCP-UI-Org/mcp-ui#111)) ([e94559f](MCP-UI-Org/mcp-ui@e94559f)) * add UIResourceRenderer Web Component ([#58](MCP-UI-Org/mcp-ui#58)) ([bd0e046](MCP-UI-Org/mcp-ui@bd0e046)) * auto resize with the autoResizeIframe prop ([#56](MCP-UI-Org/mcp-ui#56)) ([d4ec53f](MCP-UI-Org/mcp-ui@d4ec53f)) * change onGenericMcpAction to optional onUiAction ([47fdc88](MCP-UI-Org/mcp-ui@47fdc88)) * **client:** allow setting supportedContentTypes for HtmlResource ([#17](MCP-UI-Org/mcp-ui#17)) ([589de06](MCP-UI-Org/mcp-ui@589de06)) * consolidate ui:// and ui-app:// ([#8](MCP-UI-Org/mcp-ui#8)) ([2c36520](MCP-UI-Org/mcp-ui@2c36520)) * pass iframe props down ([#14](MCP-UI-Org/mcp-ui#14)) ([30ee06d](MCP-UI-Org/mcp-ui@30ee06d)) * refactor UTFtoB64 (bump server version) ([#95](MCP-UI-Org/mcp-ui#95)) ([f95acfd](MCP-UI-Org/mcp-ui@f95acfd)) * send render data to the iframe ([#51](MCP-UI-Org/mcp-ui#51)) ([2dc9d53](MCP-UI-Org/mcp-ui@2dc9d53)) * separate html and remote-dom props ([#24](MCP-UI-Org/mcp-ui#24)) ([7b06bc9](MCP-UI-Org/mcp-ui@7b06bc9)) * support adapters ([#127](MCP-UI-Org/mcp-ui#127)) ([90300fe](MCP-UI-Org/mcp-ui@90300fe)) * support generic messages response ([#35](MCP-UI-Org/mcp-ui#35)) ([4deead6](MCP-UI-Org/mcp-ui@4deead6)) * support metadata in Python SDK ([#134](MCP-UI-Org/mcp-ui#134)) ([e510fd4](MCP-UI-Org/mcp-ui@e510fd4)) * support passing resource metadata ([#87](MCP-UI-Org/mcp-ui#87)) ([fcac6b9](MCP-UI-Org/mcp-ui@fcac6b9)) * support proxy for rawHtml ([#132](MCP-UI-Org/mcp-ui#132)) ([dca6fa4](MCP-UI-Org/mcp-ui@dca6fa4)) * support ui action result types ([#6](MCP-UI-Org/mcp-ui#6)) ([1d48c62](MCP-UI-Org/mcp-ui@1d48c62)) * switch to ResourceRenderer ([#21](MCP-UI-Org/mcp-ui#21)) ([9b318f1](MCP-UI-Org/mcp-ui@9b318f1)) ### BREAKING CHANGES * The existing naming is ambiguous. Renaming delivery to encoding and flavor to framework should clarify the intent. * exported names have changed * removed deprecated client API * (previous one didn't take due to semantic-release misalignment)

feat: support proxy for rawHtml

e7788f0

idosal requested a review from Copilot October 22, 2025 00:18

Copilot AI reviewed Oct 22, 2025

View reviewed changes

github-advanced-security bot found potential problems Oct 22, 2025

View reviewed changes

sdks/typescript/client/scripts/proxy/index.html Dismissed Show dismissed Hide dismissed

sdks/typescript/client/scripts/proxy/index.html Dismissed Show dismissed Hide dismissed

CR

be01732

fix tests

1cb8496

idosal requested a review from Copilot October 22, 2025 00:31

Copilot AI reviewed Oct 22, 2025

View reviewed changes

sdks/typescript/client/src/components/HTMLResourceRenderer.tsx Outdated Show resolved Hide resolved

sdks/typescript/client/scripts/proxy/index.html Outdated Show resolved Hide resolved

idosal added 2 commits October 22, 2025 18:42

CR

974ba3c

fix mermaid

6d452ab

idosal requested a review from Copilot October 22, 2025 16:07

Copilot AI reviewed Oct 22, 2025

View reviewed changes

sdks/typescript/client/src/components/HTMLResourceRenderer.tsx Show resolved Hide resolved

docs/src/guide/client/using-a-proxy.md Outdated Show resolved Hide resolved

idosal and others added 2 commits October 22, 2025 19:16

Update docs/src/guide/client/using-a-proxy.md

5d9ae6c

Co-authored-by: Copilot <[email protected]>

use a proxy

0acab70

idosal marked this pull request as ready for review October 22, 2025 16:21

idosal merged commit 1bbeb09 into main Oct 22, 2025
14 checks passed

github-actions bot pushed a commit that referenced this pull request Oct 22, 2025

chore(release): 5.14.0 [skip ci]\n\n# [5.14.0](client/v5.13.1...clien…

7b32ce7

…t/v5.14.0) (2025-10-22) ### Features * support proxy for rawHtml ([#132](#132)) ([1bbeb09](1bbeb09))

infoxicator reviewed Oct 23, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: support proxy for rawHtml#132

feat: support proxy for rawHtml#132
idosal merged 7 commits intomainfrom
feat/rawhtml-proxy

idosal commented Oct 22, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cloudflare-workers-and-pages bot commented Oct 22, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

infoxicator left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

idosal commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cloudflare-workers-and-pages bot commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying mcp-ui with Cloudflare Pages

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

infoxicator left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

idosal commented Oct 22, 2025 •

edited

Loading

cloudflare-workers-and-pages bot commented Oct 22, 2025 •

edited

Loading